OCI Identity Domains Guide

Introduction

Oracle Cloud Infrastructure Identity Domains is a critical concept in modern cloud security and identity management within Oracle Corporation’s Oracle Cloud Infrastructure ecosystem. In real-world implementations, Identity Domains act as the backbone for authentication, authorization, and user lifecycle management across enterprise cloud environments.

If you are working on OCI projects—especially in environments with multiple applications, integrations, or business units—you will inevitably deal with Identity Domains. Understanding how they work is not optional; it is essential for designing secure and scalable cloud architectures.

What are Oracle Cloud Infrastructure Identity Domains?

Oracle Cloud Infrastructure Identity Domains are logical containers for managing users, groups, roles, and security policies within OCI.

Think of an Identity Domain as:

A centralized identity store + security boundary for a specific application ecosystem or business unit.

In earlier OCI setups, identity was managed using IAM users at the tenancy level. However, with Identity Domains (introduced and enhanced in recent OCI versions including 26A), Oracle provides a more flexible, SaaS-aligned identity model.

Key Characteristics

• Supports user authentication and authorization
• Enables Single Sign-On (SSO)
• Integrates with external identity providers (like Azure AD)
• Provides fine-grained access control
• Supports OAuth2, SAML, and OpenID Connect

Why Identity Domains are Important in Oracle Cloud

In enterprise implementations, identity management becomes complex due to:

• Multiple applications (ERP, HCM, SCM)
• Hybrid environments
• Third-party integrations
• Compliance requirements

Identity Domains solve these problems by:

Key Concepts Explained Clearly

1. Domain Types

Oracle provides different types of Identity Domains:

• Default Domain – Created automatically with tenancy
• IAM Domain – Used for OCI resource access
• App Domain – Used for SaaS applications

2. Users

Users represent individuals or systems accessing OCI.

Example:

• Finance user accessing Fusion ERP
• Integration user for OIC APIs

3. Groups

Groups are collections of users used for access control.

Example:

• Finance Team
• HR Managers
• Integration Developers

4. Roles

Roles define what actions a user can perform.

• Predefined roles (Administrator, Auditor)
• Custom roles (based on business needs)

5. Policies

Policies define who can access what resources.

Example:

Allow group FinanceTeam to read buckets in compartment Finance

6. Authentication Methods

• Username & Password
• Multi-Factor Authentication (MFA)
• SSO via SAML
• OAuth2 tokens

Real-World Implementation Scenarios

Scenario 1 – Multi-Department Enterprise Setup

A large organization uses:

• Finance on Fusion ERP
• HR on Fusion HCM
• Custom apps on OCI

Solution:

• Create separate Identity Domains:
  • Finance Domain
  • HR Domain
  • Integration Domain

Benefit:
Isolation + better governance.

Scenario 2 – External Identity Provider Integration

Client uses Microsoft Azure AD for corporate login.

Implementation:

• Configure SAML-based federation
• Map Azure users to OCI Identity Domain groups

Outcome:
Users log in once and access OCI + Fusion apps seamlessly.

Scenario 3 – API Security for Integrations

Using Oracle Integration Cloud (Gen 3), APIs need secure access.

Approach:

• Create a confidential application in Identity Domain
• Use OAuth2 client credentials flow

Result:
Secure machine-to-machine communication.

Architecture / Technical Flow

A typical Identity Domain authentication flow looks like this:

1. User accesses OCI/Fusion application
2. Request is redirected to Identity Domain
3. Authentication happens (Password/MFA/SSO)
4. Token is generated (OAuth/SAML)
5. Access is granted based on roles and policies

Prerequisites

Before configuring Identity Domains:

• OCI Tenancy access
• Admin privileges
• Network access setup
• Understanding of:
  • SAML / OAuth2
  • OCI compartments
  • Security policies

Step-by-Step Build Process

Step 1 – Navigate to Identity Domains

Navigation Path:

Navigator → Identity & Security → Domains

Step 2 – Create a New Identity Domain

1. Click Create Domain
2. Enter:
   • Name: Finance_Domain
   • Description: Finance Department Identity Domain
   • Type: IAM/App Domain
3. Click Create

Step 3 – Configure Users

1. Go to Users
2. Click Create User

Example:

Step 4 – Create Groups

1. Navigate to Groups
2. Click Create Group

Example:

• Name: FinanceTeam
• Description: Finance Department Users

Step 5 – Assign Users to Groups

• Open User → Add to Group → FinanceTeam

Step 6 – Define Policies

Go to Policies → Create Policy

Example:

Allow group FinanceTeam to manage instances in compartment Finance

Step 7 – Configure SSO (Optional)

1. Go to Security → Identity Providers
2. Add SAML provider
3. Upload metadata from external IdP

Step 8 – Configure OAuth Applications

1. Go to Applications → Add Application
2. Select Confidential Application
3. Enable:
   • Client Credentials Flow
   • Token endpoint

Testing the Technical Component

Test Scenario 1 – User Login

• Login using created user
• Verify:
  • Access to OCI console
  • Access based on role

Test Scenario 2 – API Authentication

Use Postman:

Token Request:

POST /oauth2/v1/token
grant_type=client_credentials

Expected Result:

• Access token generated
• API call succeeds

Common Errors and Troubleshooting

Best Practices

1. Use Separate Domains for Isolation

• Finance, HR, Integration should not share the same domain

2. Enable MFA

• Always enforce MFA for admin users

3. Follow Least Privilege Principle

• Avoid giving broad permissions

4. Use Naming Conventions

Example:

• FIN_GRP_USERS
• HR_ADMIN_ROLE

5. Audit Regularly

• Use OCI Audit logs to track access

Frequently Asked Questions (FAQ)

1. What is the difference between IAM and Identity Domains in OCI?

IAM manages policies at tenancy level, while Identity Domains provide modern identity management with SSO, OAuth, and federation support.

2. Can we integrate Identity Domains with external systems?

Yes, Identity Domains support:

• SAML 2.0
• OAuth2
• OpenID Connect

3. Is Identity Domain required for Oracle Fusion Applications?

Yes, Fusion applications rely on Identity Domains for:

• User authentication
• Role-based access
• SSO integration

Expert Tips from Real Projects

• Always design Identity Domains during solution architecture phase, not later
• Avoid mixing human users and integration users in same groups
• Use separate domains for DEV, TEST, PROD
• Document all policies clearly for audits

Summary

Oracle Cloud Infrastructure Identity Domains are a modern, scalable, and secure way to manage identities in OCI environments. They go beyond traditional IAM by enabling:

• Advanced authentication mechanisms
• Seamless integrations
• Enterprise-grade security

In real-world implementations, Identity Domains are not just a feature—they are a foundation for secure cloud architecture.

For deeper reference, always review official Oracle documentation:
https://docs.oracle.com/en/cloud/saas/index.html

Also refer to the provided implementation guide content here: