{"id":7553,"date":"2020-02-25T13:04:43","date_gmt":"2020-02-25T13:04:43","guid":{"rendered":"https:\/\/rax-stg-wp-aws.com\/blogs\/overview-of-iam-in-oracle-cloud-infrastructure\/"},"modified":"2026-11-03T19:28:44","modified_gmt":"2026-11-03T19:28:44","slug":"overview-of-iam-in-oracle-cloud-infrastructure","status":"publish","type":"blogs","link":"https:\/\/www.rackspace.com\/en-gb\/blogs\/overview-of-iam-in-oracle-cloud-infrastructure\/","title":{"rendered":"Overview of IAM in Oracle Cloud Infrastructure"},"content":{"rendered":"

This blog post introduces the Oracle\u00ae  Cloud Infrastructure (OCI) Identity and Access Management (IAM) components and shows some features that help you to manage Oracle cloud resources.<\/p>\n

The post identifies the types of access for specific resources that you can assign to a group of users and how you can federate OCI with Oracle Identity Cloud Service
\n(IDCS).<\/p>\n

 Components of IAM<\/strong><\/p>\n

IAM includes the following components:<\/p>\n

– Resource<\/strong>: A resource is an object created in OCI, such as Compute instances, blocks, virtual cloud networks (VCNs), and subnets.<\/p>\n

– User<\/strong>: A user is assigned to a group that provides limited privileges and access to OCI resources according to the tenancy and compartment policies for the group.<\/p>\n

– Group<\/strong>: A group is a collection of users that have access to the same OCI resources. A user can be a member of one or more groups.<\/p>\n

– Dynamic group<\/strong>: A dynamic group provides security and enables you to manage keys on the client side rather than the server side.  A dynamic group can link specific instances in the compartment. You can assign a policy to a dynamic group to provide access to a specific instance to access through an application programmer interface (API).<\/p>\n

– Compartment<\/strong>: A compartment is a global logical container where you can enforce the policies and provide control access to Compute, Storage, Network,  Load Balancer, and other resources. For example, you can use a policy to restrict users, other than administrators, from using the resources created in that compartment.<\/p>\n

– Tenancy<\/strong>: A tenancy is the default root compartment and contains all OCI resources. Within the tenancy, administrators can create one or more compartments, users, and groups.  The administrators can then assign policies that allow groups to use resources within a compartment.<\/p>\n

– Policy<\/strong>:  A policy defines who can access resources at group and compartment levels with the following access levels:<\/p>\n

    – Inspect<\/p>\n

    – Read<\/p>\n

    – Use<\/p>\n

    – Manage<\/p>\n

– Region<\/strong>: A region is a geographical location in which IAM resources reside. IAM service resources are global and can have a single tenancy across multiple regions. Oracle propagates changes made in the home region to all the regions.<\/p>\n

– Federation<\/strong>: A federation is a mechanism between two or more parties acting as an identity provider and service provider. It manages users and groups in the identity provider. IDCS provides federation for OCI by default.
\n <\/p>\n

IAM resources<\/strong>
\nThis section describes the source of resources, resource identifiers, and resource limits.<\/p>\n

Scope of resources<\/strong><\/p>\n

Because IAM defines resources as global, they are available across all the
\nregions and availability domain components.<\/p>\n

Resource identifiers<\/strong><\/p>\n

An OCI resource uses a unique name (OCID) with the following syntax:<\/p>\n

    ocid1.<resource-type>.<realm>.[region][.future-use].<unique-ID><\/em><\/p>\n

The OCID placeholders include the following elements:<\/p>\n

– ocid1<\/strong>: OCID version.<\/p>\n

– resource-type<\/strong>: The type of resources, such as instance, volume, VCN, subnet, user, or group.<\/p>\n

– realm<\/strong>: The realm contains a set of regions and shares entities with
\n  availability domains. A realm can have the following values:<\/p>\n

     – oc1<\/strong>: commercial realm
\n     – oc2<\/strong>: Government Cloud realm
\n     – oc3<\/strong>: Federal Government Cloud realm.<\/p>\n

 Resource limits<\/strong><\/p>\n

An IAM limit is the IAM resources quota that controls the maximum number of
\nCompute instances in the availability domain.<\/p>\n

To view the tenancy’s limits and usage by region, perform the following steps:<\/p>\n

    \n
  1. Open the IAM console.<\/li>\n
  2. Open the User<\/strong> menu and click Tenancy<\/strong>.<\/li>\n
  3. Click Service Limits<\/strong>.<\/li>\n<\/ol>\n

    When an instance reaches the service limit for a specific resource, you can submit a request to increase the service limit and create new resources as needed.<\/p>\n

    1. Open the Help<\/strong> menu, go to Support<\/strong>, and click
    \n   Request service limit increase<\/strong>.<\/p>\n

    <ol start=2>
    \n    <li>Enter the following details:
    \n        <ul padding-bottom: 0;”>
    \n           <li>Primary contact details<\/li>
    \n           <li>Service category<\/li>
    \n           <li>Resource<\/li>
    \n           <li>Reason for the request<\/li>
    \n    <\/li>
    \n<\/ol>
    \n<ol start=3>
    \n    <li>Click <b>Submit Request<\/b>.<\/li>
    \n<\/ol><\/em>
    \n <\/p>\n

    Federate with identity providers<\/strong><\/p>\n

    OCI supports federation for the following components and identity providers:<\/p>\n

      \n
    • IDCS<\/li>\n
    • Microsoft\u00ae; Active Directory\u00ae<\/li>\n
    • Microsoft Azure\u00ae Active Directory<\/li>\n
    • Okta\u00ae<\/li>\n
    • Identity providers that support Security Assertion Markup Language (SAML) 2.0 protocol<\/li>\n<\/ul>\n

      In the examples in this blog post, I use IDCS as the identity provider.<\/p>\n

      Steps to federate with IDCS<\/strong><\/p>\n

      Perform the following steps to federate with IDCS:<\/p>\n

      Step 1: Get the required information from IDCS<\/strong><\/p>\n

       <\/p>\n

        \n
      1. Log in to the OCI IDCS console with admin privileges.<\/li>\n
      2. In the IDCS console, click Applications<\/strong>.<\/li>\n
      3. Click COMPUTEBAREMETAL<\/strong>.<\/li>\n
      4. Click Configuration<\/strong>.<\/li>\n
      5. Expand General Information<\/strong> to display the Client ID.<\/li>\n
      6. Click Show Secret<\/strong> to see the Client Secret.<\/li>\n
      7. Save the Client ID and the Client Secret.<\/li>\n<\/ol>\n

         <\/p>\n

        Step 2: Add the identity provider in OCI<\/strong><\/p>\n

        \n1. Sign in to the console with your OCI login credentials.<\/p>\n

        2. Open the Governance and Administration<\/strong> navigation menu and click Identity -> Federation<\/strong>.<\/p>\n

        3. Click Add identity provider<\/strong>.<\/p>\n

        <ol start=4><\/em>
        \n    <li>Enter the following details:
        \n        <ol>
        \n           <li><b>Name<\/b>: The name must be unique
        \n             across all identity providers. Oracle adds the name to the tenancy,
        \n             and you cannot modify it.<\/li>
        \n           <li><b>Description<\/b>: A clear description.<\/li>
        \n           <li><b>IDCS Base URL<\/b>: The resource URL.<\/li>
        \n           <li><b>Client ID<\/b>: The client identifier
        \n             that you collected previously.<\/li>
        \n           <li><b>Client secret<\/b>:
        \n             The client secret that you previously collected.<\/li>
        \n        <\/ol>
        \n    <\/li>
        \n    <li>Click <b>Show Advanced Options<\/b> and enter the following details:
        \n        <ol>
        \n           <li><b>Encrypt Assertion<\/b>:<\/em><\/p>\n

        Select the checkbox to enable encryption from the IDP. If you do not select
        \n             this checkbox, you must set up encryption of the assertion in IDCS.<\/li>
        \n           <li><b>Tags<\/b>: You can
        \n             also apply tags if you have permission to create a resource. To
        \n             apply a defined tag, you must have permission to use the tag
        \n             namespace.<\/li><\/em>
        \n        <\/ol>
        \n    <\/li>
        \n    <li>Click <b>Continue<\/b>.
        \n    <li>Define the mappings between IDCS groups and IAM groups in OCI. You can
        \n        map IDCS groups to zero, one, or multiple IAM groups, and vice versa.<\/li>
        \n<\/ol><\/em><\/p>\n

        \nThe Federation<\/strong> page now shows the identity provider in the tenancy list. Oracle assigns the OCID to each group mapping.<\/p>\n

        Step 3: Set up the IAM policies for the groups<\/strong><\/p>\n

        Follow your standard procedure to set up the IAM policies for the groups.<\/p>\n

        Step 4: Give the federated users the tenant and URL<\/strong><\/p>\n

        Provide the federated users with the name of the tenant and the sign-in URL. The URL should be similar to the following example:<\/p>\n

            https:\/\/console.us-cshburn-1.oraclecloud.com<\/em><\/p>\n

        Manage identity providers in the console<\/strong><\/p>\n

        This section provides the steps to delete an identify provider and to add, update, or delete group mappings for IDCS.<\/p>\n

        Delete an identity provider<\/strong><\/p>\n

        To delete an identity provider, perform the following steps:<\/p>\n

        <ol>
        \n    <li>Delete the Identity Provider from the tenancy.
        \n        <ol>
        \n           <li>Open the <b>Governance and Administration<\/b>
        \n             navigation menu and click <b>Identity -> Federation<\/b> to see the
        \n             list of Identity Providers in the tenancy.<\/li>
        \n           <li>Click on the Identity Provider that you
        \n             want to delete to view its details.<\/li>
        \n           <li>Click <b>Delete<\/b>
        \n             and confirm.<\/li>
        \n        <\/ol>
        \n    <\/li>
        \n    <li>Delete the tenancy from the IDCS account.
        \n        <ol>
        \n           <li>Open the IDCS console and sign in to the
        \n             federated account.<\/li>
        \n           <li>Click <b>Applications<\/b> to display the
        \n             list of applications.<\/li>
        \n           <li>Find the tenancy and click on its name
        \n             to view the details page.<\/li>
        \n           <li>Click <b>Deactivate<\/b> and confirm.<\/li>
        \n           <li>Click <b>Remove<\/b>
        \n             and confirm.<\/li>
        \n        <\/ol>
        \n     <\/li>
        \n<\/ol><\/em><\/p>\n

         Add group mappings for IDCS<\/strong><\/p>\n

        To add group mappings for IDCS, perform the following steps:<\/p>\n

        1. Open the Governance and Administration<\/strong> navigation menu and click Identity<\/strong> to display a list of the identity providers in the tenancy.<\/p>\n

        2. Click Federation<\/strong> and click on the IDCS federation name to view its details.<\/p>\n

        3. Click Edit Provider Details<\/strong>.<\/p>\n

        <ol start=4>
        \n    <li>Add at least one mapping.
        \n        <ol>
        \n           <li>Click <b>+ Add Mapping<\/b>.<\/li>
        \n           <li>Select an IDCS group from the
        \n             <b>Identity Provider Group<\/b> list.<\/li>
        \n           <li>Select the <b>IAM group<\/b> to get the
        \n             list of OCI Groups.<\/li>
        \n           <li>Select <b>New OCI Group<\/b>
        \n             to create a new OCI group in IAM, rather than a new IAM group, and
        \n             map the new OCI group to the IDP group.<\/li>
        \n        <\/ol>
        \n    <\/li>
        \n    <li>Repeat step 4 for each mapping and click <b>Submit<\/b> after you have
        \n      added all the mappings.<\/li>
        \n<\/ol><\/em><\/p>\n

        Update or delete a group mapping<\/strong><\/p>\n

        To update or delete a group mapping, perform the following steps:<\/p>\n

        1. Open the Governance and Administration<\/strong> navigation menu and click Identity -> Federation <\/strong>to display the list of Identity Providers in the tenancy.<\/p>\n

        2. Click on an Identity Provider to see the details.<\/p>\n

        3. Click Edit Mapping<\/strong>.<\/p>\n

        4. Update the mappings or click on X<\/strong> to delete the mapping.<\/p>\n

        5. Click Submit<\/strong><\/p>\n

        Conclusion<\/strong><\/p>\n

        This blog post describes how different IAM components work together and how you can federate multiple IDCS accounts in OCI.<\/p>\n","protected":false},"excerpt":{"rendered":"

        Overview of IAM in Oracle Cloud Infrastructure<\/p>\n","protected":false},"author":2,"featured_media":7555,"menu_order":0,"comment_status":"open","ping_status":"open","template":"","format":"standard","meta":{"content-type":"","nid":"26432","content_type":"blog","created_by":"10130","authored_on":"2024-01-01T13:04:43+00:00","field_article_industries":"","tag_category":"Technical","field_blog_author_text":"by Rackspace Technology Staff","seo_description":"Explore the Identity and Access Management (IAM) components in Oracle Cloud Infrastructure and learn how they help manage Oracle cloud resources effectively.\r\n","field_featured_image":"","insights_image":"\/wp-content\/uploads\/2026\/blog_technical_images\/26432-insights_image-oracle-technical-blog-1-insights.jpg","field_partners":"","rxt_platforms":"Oracle","product":"","publisheddate":"2020-02-25T13:04:43","rxt_solutions":"Cloud Management & Operations, Public Cloud","opengraph_tag":"","x_tag":"","teaser_flag":"Technical Blog","seo_titile":"Managing Access in OCI IAM | Rackspace Technology","field_topics":"","field_slug":"overview-of-iam-in-oracle-cloud-infrastructure","footnotes":""},"categories":[178],"tags":[204],"class_list":["post-7553","blogs","type-blogs","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-technical"],"_links":{"self":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs\/7553","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs"}],"about":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/types\/blogs"}],"author":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/comments?post=7553"}],"version-history":[{"count":1,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs\/7553\/revisions"}],"predecessor-version":[{"id":7554,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs\/7553\/revisions\/7554"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/media\/7555"}],"wp:attachment":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/media?parent=7553"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/categories?post=7553"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/tags?post=7553"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}