Integrating SailPoint with Oracle Access Governance
Oracle Access Governance is a cloud-based identity governance and administration service on Oracle Cloud Infrastructure. It connects to applications as orchestrated systems and manages access through access bundles and roles.
Use the Oracle Access Governance connector to aggregate identities as accounts and roles and access bundles as entitlements. The connector also aggregates direct permissions and supports entitlement grants and revocations and account enable and disable operations.
Each SailPoint source connects to one Oracle Access Governance service instance.
Note
To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the SaaS Release Notes page.
Supported Features
| Feature | Description |
|---|---|
| Test connection | Validates the Oracle Access Governance and OCI IAM configuration. |
| Account aggregation | Aggregates Oracle Access Governance identities as accounts, including their direct permissions. |
| Account read | Reads an Oracle Access Governance identity by ID. |
| Entitlement aggregation | Aggregates Oracle Access Governance roles and access bundles as entitlements. |
| Add entitlement | Grants a role or access bundle to an identity. |
| Remove entitlement | Revokes a role or access bundle from an identity. |
| Enable and disable account | Enables or disables an identity or its account on an orchestrated system. |
Prerequisites
Before you configure the Oracle Access Governance source, ensure you have:
- An Oracle Access Governance Premium license. The connector uses the Oracle Access Governance REST APIs, which require a Premium license. For more information, refer to Oracle Access Governance REST APIs in the Oracle documentation.
- An Oracle Access Governance service instance.
- Orchestrated systems onboarded and loaded in the service instance. Identities, roles, and access bundles aggregate from the instance. The applications an identity has access on come from its permissions. An instance with no orchestrated systems loaded aggregates identities and little else.
- An OCI IAM identity domain that can issue access tokens for the Oracle Access Governance service instance.
- A confidential application in the OCI IAM identity domain.
- The client ID and client secret for the confidential application.
- A token issuance policy that includes the Oracle Access Governance resource and required scope.
- A supported Oracle Access Governance application role assigned to the confidential application. Refer to Required Permissions.
Create one SailPoint source for each Oracle Access Governance service instance. Each instance is bound to a single OCI tenancy and identity domain. No Oracle Access Governance API spans instances.
A virtual appliance is not required. The connector runs on SaaS Connectivity and calls Oracle Access Governance over HTTPS. The service instance URL and identity domain URL must be publicly resolvable.
Before you go live, configure No Approval Required on Oracle Access Governance roles and access bundles that SailPoint must grant immediately. Refer to Provisioning Behavior.
For more information, refer to Configuration Prerequisites in the Oracle documentation.
Note
The linked document is not maintained by SailPoint and is subject to change without notice.
Configuring the Confidential Application
Oracle documents how to create the confidential application in Before You Begin: Key Prerequisites for Configuration.
The connector requires the following from that application:
- The client credentials grant type only. Oracle offers additional grant types and suggests authorization code for create, update, and delete operations. The connector authenticates with no user present and does not need a redirect URL, so client credentials is the correct grant type.
- The Oracle Access Governance service instance added as a resource, which yields the scope
<Service Instance URL>/urn:opc:agcs:all. Adding the resource places it in the application's token issuance policy. Without that resource, a token is still issued and then rejected, and Test Connection fails. - An Active status. A confidential application is created inactive and issues no token until you activate it.
- An Oracle Access Governance application role assigned to it. Assign
AG_Administratorto provision, orAG_Auditorfor a read-only source. Refer to Required Permissions. - The client ID and client secret for the application. These are two of the four values the source requires.
Required Permissions
Assign an Oracle Access Governance application role to the confidential application based on the operations the source performs.
| Connector Operation | Minimum Application Role |
|---|---|
| Test connection | AG_Auditor |
| Account aggregation | AG_Auditor |
| Entitlement aggregation | AG_Auditor |
| Add entitlement | AG_Auditor |
| Remove entitlement | AG_Administrator |
| Enable or disable an identity or account | AG_Administrator |
Best Practice
Assign AG_Administrator when the source performs aggregation and provisioning. This is the only predefined role that supports both operation types.
For a read-only source, assign AG_Auditor. This role supports account, entitlement, and direct permission aggregation without administrator privileges.
Revocation admits only AG_Administrator or AG_ServiceDesk_Admin. AG_ServiceDesk_Admin cannot read the role and access bundle catalogs that aggregation requires.
In Oracle Cloud Infrastructure, go to Identity & Security > Domains > your domain > Oracle Cloud Services > your Oracle Access Governance service instance > Application roles > Manage applications > Assign applications to assign the role.
For more information, refer to Application Roles in the Oracle documentation.
Note
The linked document is not maintained by SailPoint and is subject to change without notice.
Documentation Feedback
Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.