In this tutorial you learn to integrate your on-premises Microsoft Active Directory with Oracle Identity Cloud Service using a Directory Integration, also known as a bridge.
Time to Complete
60 minutes.
Background
Oracle Identity Cloud Service provides four different methods for managing entities (users, groups, and applications) and configurations in bulk:
Methods supported for managing users, groups, and applications in Identity Cloud Service
Identity Domain Administrators or User Administrators manually download, edit, and upload a CSV file containing users or groups for bulk-loading in Oracle Identity Cloud Service.
An Oracle Identity Cloud Service agent installed in your local environment automatically and continuously synchronizes users and groups from your Microsoft Active Directory to Oracle Identity Cloud Service
The Oracle Identity Cloud Service REST APIs are used by your custom application for managing users and groups
An Oracle Identity Manager (OIM) connector is used to automatically and continuously provision and reconcile users and groups from Oracle Identity Cloud Service
Characteristics
Best way to manually bulkload users and groups
Quick and convenient
Does not require coding and integration skills
Supports only user and group creation and modification (does not support deletion)
Requires human interaction (cannot be automated)
Best way to automatically and continuously synchronize your company users and groups from your Microsoft Active Directory to Oracle Identity Cloud Service, when you don't have an identity management solution
Leverages a windows installer for setup and configuration
Does not require coding skills
Supports only unidirectional integration (from Microsoft Active Directory to Oracle Identity Cloud Service)
Best way to integrate a custom application with Oracle Identity Cloud Service
Can be integrated with any code language that supports cloud standards (REST, JSON, OAuth, and SCIM)
Requires coding skills
Best way to automatically and continuously synchronize your Oracle Identity Manager on premises with Oracle Identity Cloud Service in a hybrid cloud solution
Leverages an out-of-the-box connector for integration
Does not require coding skills
Can leverage Oracle Identity Manager governance features, such as Certification and Segregation of Duties with closed loop remediation for a complete identity governance
In this tutorial, you learn to use a bridge for integrating your Microsoft Active Directory on premises with Oracle Identity Cloud Service.
What Do You Need?
Access to Oracle Identity Cloud Service with authorization to manage Directory Integrations (either Identity Domain Administrator or Security Administrator)
A Windows OS desktop or server (to host the bridge agent). Tip: For learning purposes, you can use your own Windows desktop. For production, its recommended to use a server.
Your Active Directory Domain Name. Tip: You can get this information in the Active Directory Users and Computers utility.
In this tutorial, the domain name is example.com.
In this task, you download the bridge agent software using the Oracle Identity Cloud Service console.
In the Identity Cloud Service console, expand the Navigation Drawer , click Settings, and then click Directory Integrations.
Click Add to add a Directory Integration
View Image
Description of this image
If it its the first bridge you are configuring then you can either click the Add a Microsoft Active Directory Bridge green button.
Click Reveal to show the secret value,and then copy both the Client ID and the Client Secret to a text file. Important: The information in this page will be required during the bridge setup. Don't close the windows or change the page.
ClickDownloadand save the Oracle Identity Cloud Service Active Directory Agent installer in your local desktop.
Install the Bridge Agent
In this task, you install the Oracle
Identity Cloud Service Active Directory Agent.
The agent continuously synchronizes users and groups from your Microsoft Active Directory to Oracle Identity Cloud Service.
Launch the Oracle
Identity Cloud Service Active Directory Agent installer (double click the ad-id-bridge.exe file) from the host where the agent will run.
Tip: If the installer displays a pop-up message requiring the .NET framework, follow the instructions provided and restart the installer.
In the Welcome window, click Next.
In the Install Path window, click Next.
In the Specify Proxy windows, click Next.
In the Enter Provided Credentials window, provide information about your Oracle Identity Cloud Service:
Cloud Service URL: The Oracle Identity Cloud Service URL. For example, https://example.oraclecloud.com
Identity Bridge Client ID and Identity Bridge Secret The information you copied from Oracle Identity Cloud Service earlier in this tutorial. Tip: In case you lost your client ID or secret, you can generate new ones by following the first 3 steps in previous topic.
Configure the Bridge and Perform the Synchronization
In this task, you configure the bridge registered with Oracle Identity Cloud Service and select users and groups for synchronization.
Select Organizational Units for Users and Groups and configure the Synchronization
In the Identity Cloud Service console, expand the Navigation Drawer , click Settings, click the Directory Integrations, and then click the bridge you just registered.
Tip: The page contains four items where you can select organizational units for users, for groups and configure the synchronization.
In the Select Organizational Units (OUs) for Users section, select the users that you want to synchronize with Oracle Identity Cloud Service.
In this example, if you select both Employees and Local Users, only users under these organizational units are synchronized with Oracle Identity Cloud Service.
In the Select organizational units(OUs) for Groups Section, select groups to be synchronized with Oracle Identity Cloud Service.
In this example, if you select the organizational unit Employees, only groups under this organizational unit are synchronized with Oracle Identity Cloud Service.
In the Set import frequency section, select the interval at which the agent will run and synchronize users and groups with Oracle Identity Cloud Service.
The federated authentication is enabled by default. This configuration means the user credentials will be validated against a configured Identity Provider.
In this tutorial, you need to uncheck the federated authentication checkbox. The Oracle Identity Cloud Service will generate the password for the users and send the notification by email (the email attribute must be filled in Microsoft Active Directory and mapped to the Oracle Identity Cloud Service).
Click Save.
You now see the summary of the bridge configuration.
Click Attribute Mappings tab to modify the default attribute mappings between the Microsoft Active Directory and the Oracle Identity Cloud Service.
This tutorial uses the default mappings.
Description of this image
Refresh the page by clicking Refresh. The Last Import Status shows Running.
View Image
Description of this image
After few seconds (or minutes, depending on the number of entries), the synchronization is completed.
At the end of the synchronization you see important information such as:
How many users were successfully imported.
How many groups were successfully imported.
How many users failed to import, mainly due to attribute value issues.
How many groups failed to import, mainly due to attribute value issues.
Verify the Synchronization Results in Oracle Identity Cloud Service
In the Oracle Identity Cloud Service Console, expand the Navigation Drawer , and then click Users.
The users imported from the Microsoft Active Directory are displayed in Oracle Identity Cloud Service.
In the Navigation Drawer , click Groups.
The groups imported from Microsoft Active Directory are displayed in Oracle Identity Cloud Service.
In the Navigation Drawer , click Group and then click Users tab. The group membership reflects the membership from Active Directory.
Manage the Bridge Agent
In this last task, you manage the Bridge Agent and its connection to Oracle Identity Cloud Service.
Manage the bridge from Oracle Identity Cloud Service
The Oracle Identity Cloud Service UI allows you to manage the connection between Oracle Identity Cloud Service and the Identity Bridge agent.
In the Oracle Identity Cloud Service console, expand the Navigation Drawer , click Settings, and then click Directory Integrations.
Review the bridge page: Tip: This is the same page you review after downloading the Bridge Agent.
The bridge example.com status is Active.
You can click the bridge and modify the configurations. You can also run an import.
Optionally, explore the options for the bridge agent row. Oracle Identity Cloud Service offers options for deactivating, activating, and deleting a bridge.
View Image
Description of this imageTip: When you delete an agent from the Oracle Identity Cloud Service console, you delete the agent connection. To completely uninstall the agent, run the agent uninstaller on the host machine.
Manage the Agent Configuration
The Identity Bridge configuration utility allows you to manage the connection parameters between Active Directory and Oracle Identity Cloud Service, as well as the user and group synchronization selections.
In the bridge agent host, launch the bridge configuration utility (C:\Program Files\Oracle\IDBridge\IDBridgeUI.exe).
If the OS displays an authorization dialog, click Yes.
The Oracle Identity Cloud Service Active Directory Agent window is displayed.
Optionally, explore the View logs and Stop button.
The View logs button opens a file explorer where the agent log files are stored.
The Stop and Start button control the agent service by enabling and disabling it.
Close the utility.
Start, Stop, and Restart the Agent
In this task, you learn to stop, start, and restart the Identity Bridge Agent Windows service.
Launch Windows Services (Click Start > Run. Enter services.msc and click OK). Tip: The Services utility manages daemon processes in the Windows OS.
Scroll down the list of services and click Oracle Identity Cloud Service Active Directory Agent Service. The left hand will display a description for the bridge service, with options for stopping or restarting the service.
Optionally, stop, start, and restart the Oracle Identity Cloud Service Active Directory Agent Service.
Optionally, right-click Oracle Identity Cloud Service Active Directory Agent Service, click Properties, and review the additional options. Tip: Observe that the Startup Type for this service by default is Automatic. This means that windows launches the agent automatically during the host startup.
Close the Services utility.
Want to Learn More?
To learn more about how to integrate Oracle Identity Cloud Service with Active Directory Federation Service (AD FS) for Single Sign-On, visit:
, click Settings, and then click Directory Integrations.
