4.3.2.1 ADS Credential Validation through the IDCS Integrated Application

The Integrated App Migration feature allows tenants registered in OPC (Oracle Platform Cloud) Support to transition their Application Data Services (ADS) subscription to an Integrated Application model. You can configure this migration from the OCI Application Data Services Subscriptions interface.

To use ADS, you need to set up secure credentials using an Integrated Application in IDCS. This is a one-time setup that replaces the older Oracle Cloud Services (OPC) method.

Note:

Tenants with existing credentials can continue using the older automatic Oracle Cloud Services (OPC), based setup until further notice.

Unlike the older Oracle Cloud Services (OPC) setup, the new Integrated Application approach requires the administrator to manually create an application in IDCS. Once created, a Client ID and Client Secret are generated.

• First-time Subscription: Enter the Client ID and Client Secret from the Integration Application, along with any other required credentials.
• Existing Subscription: Update your subscription by replacing the current credentials with the new Client ID and Client Secret generated from the Integration Application.

Adding a Confidential Application

1. Go to Oracle Cloud Console and navigate to Identity & Security > Domains.
2. On the Domains list page, select the domain in which you want to make changes. Select your domain to Open Details tab.
3. On the details page, select Integrated applications. A list of applications in the domain is displayed.
4. Select Add application.
5. In the Add application window, select Confidential Application.
6. Click Launch workflow.
7. In the Add application details page, use the following table to configure application details and the display settings.

   Option	Description
   Name	Enter a name for the confidential application. You can enter up to 125 characters. It is recommended to enter the tenant name. For applications with lengthy names, the application name appears truncated in the My Apps page. Consider keeping application names as short as possible.
   Description	Enter a description for the confidential application. You can enter up to 250 characters.

8. On the Client configuration OAuth pane, select Configure this application as a client now.
   Use the following table to provide the information needed to configure this application as a client.

   Option	Description
   Resource owner	Use when the resource owner has a trust relationship with the confidential application, such as a computer operating system or a highly privileged application, because the confidential application must discard the password after using it to obtain the access token. Note: DFCS_PBSM_INTEGRATION must be mapped to the application.
   Resources	The Resources section lists the scopes currently assigned to the application. Each row shows the resource name, whether it is protected, and the associated scope value. Adding a Scope In the Resources section, select the edit action if the page is not already in edit mode. Select Add scope. The Add scope window opens. Use the Add scope window to locate and select the resources that provide the scopes required by your application. Optional: Enter a resource name in Search and Filter, then select Search to narrow the list. Select the checkbox next to every resource scope you want to add. You may select multiple scopes before continuing. If needed, use the expand arrow next to a resource to view available scope details. Select Add. All checked scopes are added to the OAuth configuration. Note: You can select multiple scopes at the same time. Use the checkbox next to each required scope, then choose Add once. After you select Add, you return to the Edit OAuth configuration page. The Resources table shows the scopes selected for the application. Review the Resource, Protected, and Scope columns to confirm that all required scopes are present. To remove an unwanted scope, select its checkbox and choose Remove. Select Submit to save the updated OAuth configuration. Select Cancel if you do not want to save the changes.
   Client credentials	Use when the authorization scope is limited to the protected resources under the control of the client or to the protected resources registered with the authorization server. The client presents its own credentials to obtain an access token. This access token is either associated with the client's own resources, and not a particular resource owner, or is associated with a resource owner for whom the client is otherwise authorized to act.
   Refresh token	Select this grant type when you want a refresh token supplied by the authorization server, and then use it to obtain a new access token. Refresh tokens are used when the current access token becomes invalid or expires and don't require the resource owner to reauthenticate.

9. Click Submit.
10. Select Finish.
11. Record the Client ID and Client secret in the Application added dialog box.

    To integrate with your confidential application, use this Client ID and Client Secret as part of your connection settings.

12. Select Close.

    The new application's details page is displayed.

13. To Update Subscription UI, open the ADS Subscription UI and enter the following details.
    • Domain URL
    • Client ID
    • Client Secret
    • Username
    • Password

      Note:

      Do not check in the Integrated App Migration check box.
14. Click Update Credentials.
15. To test connection, click Test Connection. The system validates the subscriber, publisher.
16. If successful, the connection is established, credentials are saved.

    Note:

    • OPC to Integrated App Migration is one-time only
    • You cannot revert to old (OPC) method

Regenerating a Client Secret for Confidential Applications

When you create a confidential application, you use a Client ID and a Client Secret as part of your connection settings. You can regenerate your Client Secret at any time for a confidential application using the identity domains console. For more details, see Adding a Confidential Application.

1. On the Domains list page, select Integrated applications tab. A list of applications in the domain is displayed.
2. Select the confidential application for which you want to regenerate a client secret.
3. Depending on the options you see, do one of the following:
   • Select the OAuth configuration tab and then select Regenerate secret, or
   • In the General information section of the application detail page, select Regenerate.
4. Confirm your choice to regenerate the secret. The new Client Secret appears in the New Client Secret dialog box.
5. Update the ADS subscription credentials with the new Client Secret.