1.2.1 MicroTx Security Configuration when using Oracle IAM as Identity Provider

This topic provides instructions for Oracle IAM (IDCS) security configurations in MicroTx.

The following instructions enable you to configure a client/confidential application, realm roles/groups and users in Oracle IAM (IDCS). The metadata thus collected from these configurations must be used for terraform deployment.

IAM (IDCS) Configuration

Follow these instructions to configure client/credential application in Oracle IAM (IDCS):
  1. Login to the OCI console.
  2. Navigate to Identity & Security > Identity > Domains.
  3. Select the Domain in OCI as OracleIdentityCloudServices.
  4. In the Integrated applications tab, click Add application.
  5. Select Confidential Application in the Add application page.
  6. Provide the Name and Description for the application and click Launch Workflow.

    The Application Information is displayed on the Details tab.

  7. Navigate to the OAuth configuration tab and click Edit OAuth Configuration.
  8. On the Edit OAuth Configuration page, expand the Client Configuration section.
  9. Select the Configure this application as a client row option.
  10. Select the following Allowed grant types under the Authorization section:
    • Resource owner
    • Client credentials
    • JWT assertion
    • Refresh token
    • Authorization code
    • Implicit
  11. Enable the Allow non-HTTPS URLs button to use non-HTTPS URLs for Redirect URL, Logout URL, and Post-logout redirect URL fields..
  12. Enter the redirect URL in the Redirect URL field.
    Example when MicroTx deployment is HTTPS/TLS:
    https://129.xxx.xxx.xxx:443/console/oidc/redirect
https://129.xxx.xxx.126:443/*
https://129.xxx.xxx.126*
https://microtx.example.com:443/console/oidc/redirect
https://129.xxx.xxx.xxx/console/oidc/redirect
  13. Enter the post-logout URL in the Post-Logout URL field.
    Example when MicroTx deployment is HTTPS/TLS:
    https://129.xxx.xxx.xxx:443/consoleui/index.html
https://microtx.example.com:443/consoleui/index.html
  14. Enter the logout URL in the Logout URL field.
    Example when MicroTx deployment is HTTPS/TLS:
    https://microtx.example.com:443/oidc/logout

    Note:

    In case of MicroTx deployment through HTTPS/TLS, user needs to decide the domain name which is going to be used in self-signed certificate. The same domain name will be used in redirect URL's. In the above examples, microtx.example.com is the domain name and the same must be provided as terraform input.
  15. Select Client Type as Confidential.
  16. Select Client IP address as Anywhere.
  17. Under the Token insurance policy section, select Authorized resources as Specifc.
  18. Click Submit to save the OAuth configurations.
  19. From the Integrated Applications page, activate the application by selecting Activate from the Actions drop-down list on the page banner.

Assigning Users and Groups

Follow the instructions below to add users and user groups to the confidential application:
  1. Login to the OCI console.
  2. Navigate to Identity & Security > Identity > Domains.
  3. Select the Domain in OCI as OracleIdentityCloudServices.
  4. Select the User Management tab to access any existing list of Users and Groups.
  5. Next, navigate to the Users tab of the Confidential application you created.
  6. From the list of existing users, select the ones you want to assign to the application and click Assign Users.
  7. Click Assign to complete the process of adding selected users to the application.
  8. Now navigate to the Groups tab of the Confidential application.
  9. From the list of existing group(s), select the one to which you want to assign the users, and then click Assign users to group.

Domain Configuration

Follow the instructions below to add groups to token using CustomClaims API. For a new domain, this is a one-time procedure.
  1. Login to the OCI console using credentials of the Domain user.
  2. Navigate to Profile and click User Settings.
  3. Next navigate to the Tokens and Keys tab.
  4. Under My access tokens section, click Download token for Invokes identity domain APIs.
  5. In the Generate personal access token section, select Identity Domain Administrator option from the Select app role drop-down.
  6. Click Download Token.
    Use the generated token with the CustomClaims API to include group information in the access token.

    Note:

    Setting "name": "group_roles" returns the group mappings in the bearer token. If you change this value, make sure to update the following configuration properties in helm with the same claim name:
    Both configuration in MicroTx helm chart entries must reference the same claim name used in the Custom Claims API.
    commonConfiguration.security.identityProvider.roleMappings.coordinator.adminUserRolesPath: "group_roles"
commonConfiguration.security.identityProvider.roleMappings.workflow.claimsRolePaths: "group_roles"
    CustomClaims API hostname can be retrieved from Identity & Security under Domain from Domain URL property. Domain URL Example : `https://idcs-77cxxxxxxxxxxxxxd0.identity.oraclecloud.com:443` 
    curl -sS -X POST "https://idcs-77cxxxxxxxxxxxxxd0.identity.oraclecloud.com:443/admin/v1/CustomClaims" \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  --data-binary '{
    "schemas": ["urn:ietf:params:scim:schemas:oracle:idcs:CustomClaim"],
    "name": "group_roles",
    "value": "$user.groups.*.display",
    "expression": true,
    "mode": "always",
    "tokenType": "AT",
    "allScopes": true
  }'
    Optionally, to generate access token for any user for a confidential application using (Optional for creating Auth token to call REST API's):
    curl -i -H "Authorization:Basic <base64 of client_id:client_secret>" -H "Content-Type: application/x-www-form-urlencoded; charset=UTF-8" 
--request POST 
https://idcs-77cxxxxxxxxxxxxxd0.identity.oraclecloud.com:443/oauth2/v1/token -d "grant_type=password&scope=urn:opc:idm:__myscopes__&username=qauser_conductor_admin&password=xxxxxxxx"

Parent topic: Prerequisites