IAM-Managed Applications Logging On as Application Identities

In this scenario, an application or AI agent is registered in an IAM system (such as Microsoft Entra ID, OCI IAM, or Keycloak) and connects to the database directly as an application identity, using its own database-access token from IAM. This scenario is typical for services, autonomous AI agents, and scheduled jobs that access protected data with their own bounded data scope.

For an overview of the use case and authentication flow, see Applications Log On as Application Identities.

Configuration path

1. In your IAM system, register the database as an OAuth resource. Then register the application or AI agent as an OAuth client. Assign the application the IAM roles that define its access, and authorize it to obtain a database-access token for the database resource by using its client credentials.

   Depending on your IAM provider, use the applicable registration steps from one of the following topics:

   • For Microsoft Entra ID, see Configure Microsoft Entra ID for Application-Mediated Access.

   • For OCI IAM, see Configure OCI IAM for Application-Mediated Access.

   • For Keycloak, configure a confidential client for the application, enable the client credentials flow, and configure the database token audience. See the Keycloak Server Administration Guide.

   Note: For this direct-logon scenario, configure only the database and application registrations, roles or groups, scopes, and token permissions required for the application to obtain a database-access token. End-user registration is not required unless the same application also supports end-user access flows.

2. Configure the database. See Set Up IAM Integration for Logon as an Application Identity.

3. Configure the application or AI agent to authenticate to IAM by using its OAuth client credentials, obtain a database-access token for the database resource, and use that token to connect directly to the database. For the connection settings used to present the token to the database, see Configure a SQL Client for End-User Direct Logon.

Note: If an IAM-managed application accesses data as itself by attaching an end-user security context payload containing only its client-credentials database-access token to the database connection, see Set Up IAM Integration for Application-Mediated Connections for the required database configuration and How the Database Server Manages an End-User Security Context for information on payload processing.