6.2 IAM-Managed Users Connecting Directly
In this scenario, you manage end users in an IAM system (Microsoft Entra ID or OCI IAM), and they connect to the database directly using a SQL client (for example, SQL*Plus) and their own IAM credentials. No application is involved. This scenario is typical for data analysts, developers, and DBAs.
For an overview of the use case and authentication flow, see End Users Connect Directly to the Database.
Configuration path
- In your IAM system, register applications to represent the
database and the SQL client. Subsequently, create end users and assign
roles. Depending on your IAM provider and token type, see one of the
following topics:
- For Microsoft Entra ID, see Create Application Registrations in Microsoft Entra ID.
- For OCI IAM with OAuth 2.0 tokens:
- Register the database as a resource server in OCI IAM. In OCI IAM, this is done by creating a confidential application for the database. See Register the Database in OCI IAM.
- Register the SQL client (SQL*Plus or SQLcl) as
a public client. In OCI IAM, use a Mobile Application
registration, configured with the authorization code grant,
a local redirect URL (for example,
http://localhost:8888/callback), and access to the database-access scope. See Adding a Mobile Application.
- For OCI IAM with auth tokens, see Configuring OCI IAM for Oracle DBaaS.
- Configure the database.
- For Microsoft Entra ID and OCI IAM with OAuth 2.0 tokens, see Set Up IAM Integration for End-User Direct Logon.
- For OCI IAM with auth tokens, see Configure the Database for OCI IAM Auth Tokens.
- Set up your SQL client for direct logon. See Configure a SQL Client for End-User Direct Logon.
Example configuration
- For a step-by-step example of this configuration using Microsoft Entra ID, see Configure Oracle Deep Data Security for Direct Logon with End Users in Microsoft Entra ID.
- For an example of this configuration using Oracle Autonomous AI Database and OCI IAM OAuth 2.0 tokens, see Autonomous AI Database OCI IAM Deep Data Security Lab.