Federation

Identity federation is an enterprise security capability that allows administrators to maintain employee credentials in a single authoritative enterprise identity repository and enables the single sign-on experience for their employees across multiple systems.

Google makes many Oracle Database deployment and configuration operations available in the Google Cloud Console, CLI, API, and Terraform. Until all operations are available in Google Cloud, authorized users must use the OCI Console, CLI, API, or Terraform to perform those operations instead.

To enable authorized users to operate in OCI, Oracle AI Database@Google Cloud customers must enable identity federation between their Google and OCI environments. This requirement applies regardless of whether the identity provider is Google IAM or an alternative solution.

Oracle AI Database@Google Cloud defines a set of roles in Google Cloud IAM and only those users with the appropriate role assignments can perform operations on Oracle Database resources in Google Cloud. When users perform operations in OCI, OCI validates those same role assignments before authorizing the operation.

Setting up identity federation for Oracle AI Database@Google Cloud allows administrators to configure user sign-in to the associated OCI tenancy using their existing identity provider. OCI IAM supports SAML, OAuth 2.0, and OpenID Connect (OIDC), and can be federated with any IDP that supports these protocols.

To configure OCI IAM federation with your identity provider of choice, see the relevant OCI documentation:

• Microsoft Entra ID: Federation (Optional)
• Okta: OCI IAM with Okta Tutorials
• PingOne Identity: Set up Single Sign-On Between Oracle Cloud Infrastructure Identity and Access Management and PingOne
• Microsoft Active Directory Federation Services (ADFS): OCI IAM with ADFS Tutorials

Use the following instructions to make Google Cloud IAM & Admin the identity provider for the OCI tenancy.

1. In the Oracle Cloud Console, navigate to Identity & Security, then select Domains.

   

2. In the Domains list view, select the name of the "Default" domain to open the domain details page. Optionally, you can select another domain to configure single sign-on (SSO) for that domain.

   

3. Select Security in the left navigation menu on the identity domain Overview page.

   

4. On the Security page for the domain, select Identity providers in the left navigation menu.

   

5. On the Identity providers page, select Add IdP, then select Add SAML IdP.

   

6. Enter the Name that you want to display on the OCI sign-in page when using single sign-on (SSO) to access the Oracle Cloud Console. Optionally, you can add a Description. Select Next to continue.

   Leave this window or tab open while you perform the next steps that require the Google Cloud admin Console.

   

7. From the web browser, open another tab or window and navigate to the Google Cloud admin Console at https://admin.google.com/ac/apps/unified.

   

8. Select Add custom SAML app from the Add app menu.

   
9. Enter the following details and select Continue:
   • App name: OracleCloudFederation
   • Description: Configures identity federation between Google Cloud and Oracle Cloud for Oracle AI Database@Google Cloud use.
   

10. Under Option1: Download IdP metadata, select DOWNLOAD METADATA.

    

    Select CONTINUE. Leave this window or tab open while you perform the next steps in the Oracle Cloud Console.

    

11. Return to the window or tab that displays the Oracle Cloud Console. Select Import IdP metadata Upload metadata XML file. In the Upload identity provider metadata section, select select one..., then navigate to the XML file downloaded in the previous step from the Google Cloud admin console and upload the file.

    

12. Select Export SAML metadata.

    

13. On the Export SAML metadata dialog, select Manual export. Copy the Provider ID and Assertion consumer service URL values into a text file on your local machine. Leave this window or tab open while you perform the next steps that require the Google Cloud admin console.

    

14. Return to the tab or window displaying the Google Cloud admin console. On the Service provider details page, enter the following:

    • ACS URL: Enter the "Assertion consumer service URL" value copied from the Oracle Cloud Console in the previous step.
    • Entity ID: Enter the "Provider ID" value copied from the Oracle Cloud Console in the previous step.

    Select CONTINUE.

    

15. On the Attribute mapping page, select ADD MAPPING.

    

16. Add the following attribute mappings:

    • First name → FirstName
    • Last name → LastName
    • Primary email → PrimaryEmail

    For example, for the Basic Information attribute "First Name," enter the App attribute FirstName.

    

17. On the Attribute mapping page, in the Group membership section, add the following groups created for role-based access control (RBAC). The App attribute for the groups is MemberOf. Select FINISH to continue.

    • odbg-adbs-db-administrators
    • odbg-costmgmt-administrators
    • odbg-db-family-administrators
    • odbg-db-family-readers
    • odbg-dbmgmt-administrators
    • odbg-exa-cdb-administrators
    • odbg-exa-infra-administrators
    • odbg-exa-pdb-administrators
    • odbg-exadb-vm-cluster-administrators
    • odbg-exascale-db-storage-vault-administrators
    • odbg-metrics-readers
    • odbg-network-administrators
    • odbg-network-readers
    • odbg-vm-cluster-administrator
    

    The Google Cloud admin console automatically redirects to the details page for the SAML application that you created.

18. Expand the User access section.

    

19. In the Service status section, select ON for everyone, then select SAVE.

    

20. Return to the window or tab that displays the Oracle Cloud Console. On the Add SAML identity provider page, select Map user identity. Enter the following values:

    • Requested Name ID format: Select "Email address".
    • Identity provider user attribute: Select "SAML assertion Name ID".
    • Identity domain user attribute: Select "Username".
    

21. On the Add SAML identity provider page, select Review and Create.

    Review the SAML identity provider details, then select Create IdP.

    

22. Select Activate to activate the identity provider (IdP).

    

    A confirmation message indicates that the identity provider is active.

23. Select Add to IdP policy.

    

24. On the Identity provider (IdP) policies page, select Default Identity Provider Policy in the Name column of the list of policies.

    

25. On the Default Identity Provider Policy policy details page, in the Identity provider rules section, select Edit IdP rule.

    

26. On the Edit Identity provider rule page, find the Assign identity providers field. The field displays "Username-Password". Add "Google Cloud Federation", then select Save changes.

    

    After adding "Google Cloud Federation":

    

27. On the details page for the Google Cloud Federation identity provider, select Configure JIT.

    

28. On the Configure Just-in-time (JIT) provisioning page, turn on the Enable Just-In-Time (JIT) provisioning switch. Remain on this page for the next few steps.

    

29. On the Configure Just-in-time (JIT) provisioning page, select Create a new identity domain user and Update the existing identity domain user.

    

30. On the Configure Just-in-time (JIT) provisioning page, map the user attributes as follows:

    IdP User Attribute Type	IdP User Attribute Name	Maps To	Identity Domain User Attributes
    NameID	NameID value	→	userName
    Attribute	LastName	→	familyName
    Attribute	PrimaryEmail	→	primaryEmailAddress
    Attribute	FirstName	→	firstName

    

31. On the Configure Just-in-time (JIT) provisioning page, toggle the Assign group mapping switch to enable the group mapping you configured. The Assign group mapping section expands to display group mapping configuration options.

    

32. On the Configure Just-in-time (JIT) provisioning page, select or enter the following values:

    • Group membership attribute name: MemberOf
    • Assign implicit group membership: Select the radio button to enable this option
    • When assigning group membership...: Merge with existing group memberships
    • When a group is not found...: Ignore the missing group

    Select Save changes after you select and enter the values.

    

    You've configured identity federation between OCI and Google Cloud.

33. Test single sign-on:

    1. Sign out of the Oracle Cloud Console.
    2. In the Or sign in with section of the login screen, select Google Cloud Federation.