Note:

Configure Sign-on Policies for Oracle Analytics Cloud and APEX Apps on OCI

Introduction

Oracle Cloud Infrastructure Identity and Access Management (OCI IAM) Identity Domain Sign-on Policies are a key element for managing access to applications deployed on Oracle Cloud Infrastructure (OCI).

This tutorial is inspired by a customer use case and outlines how an ISV or an Application Services Provider can implement sign-on policies to allow authentication to the applications they deliver to end-users while preventing these from accessing the OCI console.

For this tutorial, two applications are used: an Oracle Analytics Cloud application and an APEX application running on Autonomous Transaction Processing (ATP) service.

Objectives

Architecture

This tutorial uses the following architecture:

Prerequisites

Task 1: Configure a compartment

  1. Sign in to the OCI Console in the Default domain with a user that has permissions to manage resources in the tenancy or at the compartment level from which you will then create the tutorial compartment as a child compartment.

  2. Create a compartment for the tutorial.

    Create a compartment

  3. Make sure the Default domain user you are logged on with is in a group that has manage permissions on this compartment. If not, create (or ask your tenancy administrators to create) a policy using the following template:

    Allow group <group to which your user belongs> to manage all-resources in compartment <compartment name>

Task 2: Configure the Applications Domain

  1. In this newly created compartment, create an Identity Domain for the applications users. For the purpose of this tutorial, you can use a free domain. This is best practice, as it separates application users from administrator users.

    Create domain

  2. In the newly created domain, create a group for the application users. For now, don’t add any users to this group. You’ll do it later in the tutorial, when you perform testing.

    Create group

  3. Create a group for the users who can provision Oracle Analytics Cloud and ATP instances, and assign a user to this group. You might need to create a user for this purpose.

    Create user group

    Add user to group

  4. Create policies to enable users of this group to create Oracle Analytics Cloud and ATP instances in the compartment you created for this tutorial.

    Allow group <apps_domain>/<oac_provisioning_group> to manage analytics_instances in compartment <compartment name>
Allow group <apps_domain>/<oac_provisioning_group> to manage autonomous_databases in compartment <compartment name>

Task 3: Configure the Oracle Analytics Cloud application

  1. Sign in to the Applications Domain you created in Task 2 with the user you added to the group that manages Oracle Analytics Cloud and ATP instances.

  2. Create the Oracle Analytics Cloud instance. Using the OCI Console, you need to provision the Oracle Analytics Cloud instance with a user belonging to the Domain your application users will be created and managed on. The reason for this is that the Oracle Analytics Cloud provisioning process automatically creates an Oracle Analytics Cloud application in the domain the user that provisions it is logged on.

    Create Analytics instance

    Note: If you used the OCI API to provision the Oracle Analytics Cloud instance, you could provision the Oracle Analytics Cloud instance with a user from another domain, but this is outside the scope of the present tutorial.

  3. Verify that the Oracle Analytics Cloud instance is bound to the Identity Domain you are signed in to. To do this, go to the Identity Domain you created in Task 2 and go to Oracle Cloud Services. You should see an application automatically created by the Oracle Analytics Cloud provisioning process in OCI.

    Oracle Analytics Cloud application

  4. Assign an Oracle Analytics Cloud Application role to the application users group.

    Oracle Analytics Cloud application role

Task 4: Configure the APEX application

  1. Create an ATP instance.

    Create an ATP instance

  2. Create an APEX workspace and install in it a sample APEX application. Go to the Application Gallery and select one of the sample applications (for instance the Sample Calendar app).

    APEX App Gallery

  3. Sign out of the domain with this Oracle Analytics Cloud and ATP provisioning user. You will now need to sign in with the user you used at the beginning of the tutorial, which has permissions to manage all resources in the tutorial compartment.

  4. Integrate the sample application with the OCI Identity Domain, following this guide.

    • Create a Confidential Application in the applications Domain, for the APEX Application you installed in the previous step.
    • Create a new Web Credential in your APEX workspace.
    • Create a new authentication scheme for the APEX Application.

Task 5: Configure Sign-On Policies

  1. Sign in to the Default domain and change the Default Sign-On Policy of the applications Domain. Start by changing the Default Sign-on Rule to only allow access to members of the Oracle Analytics Cloud and ATP provisioning group.

    Note: For the purpose of this tutorial, we keep the rule as simple as you see below, but you should prescribe access with MFA for a production use case.

    Default Policy

  2. Add another Sign-on Rule to the Default Sign-on Policy. This rule is evaluated after the first rule and denies access to the domain to every user.

    Default policy rule2

    You should now have two rules in the Default Sign-on Policy, like shown below.

    Sign-on Rules

  3. Create a new Sign-on Policy to allow application users to sign-on only to their applications.

    New Sign-on policy

  4. Associate to this new policy both the APEX application created in Task 4 and the Oracle Analytics Cloud application automatically provisioned in Task 3.

    Add app

  5. Create a Sign-on Rule for this policy to allow users from the application group to sign-on to these two applications.

    Create a sign-on rule for this policy

Note: Domain Toggling

If, instead of Oracle Analytics Cloud or Oracle Integration based applications, you need to deploy custom web applications, you should skip steps 1 and 2 of this task, and instead just toggle the domain and thus prevent it from being selected on the OCI console sign-on page.

On the Domain main page, edit the domain and prevent the domain from being selected on the OCI console sign-on page. This will prevent OCI web console access to the domain (including both the application users and the Domain administrator).

Edit Domain

Task 6: Test

  1. Create a new user in the applications domain and add it to the applications group created in the previous tasks.

    Add User to Apps Group

  2. Sign-on to the OCI console with the newly created user, selecting the applications Domain, and confirm the access is denied.

    Domain Denied Access

  3. Sign-on to the APEX application with the newly created user and confirm you can successfully sign-on.

    Allowed APEX Access

  4. Sign-on to the Oracle Analytics Cloud application with the newly created user and confirm you can successfully sign-on.

    Sign-on to the Oracle Analytics Cloud application

Next Steps

Sign-on Policies are not just a key element of application authentication in OCI, they are also very easy to use. This tutorial illustrates how simple it is to make sure you have complete control over the authentication of application users, enforcing the policies that make sense for your organization. Sign-on Policies provide additional functionality beyond what is used in this tutorial (such as enforcing MFA for specific groups of users). Make sure you check the additional resources to build a wider understanding of what Sign-on Policies can be used for.

Acknowledgments

More Learning Resources

Explore other labs on docs.oracle.com/learn or access more free learning content on the Oracle Learning YouTube channel. Additionally, visit education.oracle.com/learning-explorer to become an Oracle Learning Explorer.

For product documentation, visit Oracle Help Center.