Integrating SailPoint with Oracle Cloud Infrastructure SaaS

Use this connector to manage Oracle Cloud Infrastructure (OCI) access in SailPoint. You can govern OCI IAM users as accounts, OCI IAM groups and OCI IAM policies as entitlements, OCI Generative AI Agents and OCI Hosted Applications as machine identities, OCI IAM credentials as non-human identities, including API keys, auth tokens, customer secret keys, and SMTP credentials, and OCI Vault secret metadata as credentials.

Each Oracle Cloud Infrastructure SaaS source connects to a single tenancy. The connector is read-only. It does not create, update, or delete objects in OCI.

To set up the source, refer to Connecting SailPoint and Oracle Cloud Infrastructure SaaS.

To onboard this source with SailPoint Agentic Fabric, refer to Configuring Sources.

Supported Features

The Oracle Cloud Infrastructure SaaS source supports these features:

• Test Connection

• Account Aggregation

  • Aggregates OCI IAM users as accounts. Each account includes the IAM groups that user belongs to.

• Entitlement Aggregation

  • Aggregates OCI IAM groups and OCI IAM policies as entitlements.
  • On an account, each group links to the group entitlement.
  • On a group, each related policy links to the policy entitlement.
  • On a policy, each OCI IAM group named in the policy links to the group entitlement. A reference that cannot be matched to an aggregated OCI IAM group is shown as text.

• Machine Identity Governance

  • Aggregates OCI Generative AI Agents and related resources, including agent endpoints and tools.
  • Aggregates OCI Hosted Applications as agent resources in the OCI Hosted Application Agents dataset. This includes applications that use identity domain authentication and applications that use OCI IAM authentication. Deployment details are collected on each application. These objects are not accounts.
  • Aggregates OCI IAM credentials as credential resources, including API keys, auth tokens, customer secret keys, and SMTP credentials. These objects are not accounts. IAM users appear on the Accounts tab from account aggregation.
  • Aggregates Oracle Cloud Infrastructure Vault secret metadata as credential resources in the OCI Vault Secrets dataset. These objects are not accounts. Secret values are not aggregated. Discovery uses the optional Regions and Compartment OCIDs filters. Domains do not apply to Vault secrets.
  • During dataset aggregation, the connector collects these objects in the OCI Generative AI Agents, OCI Hosted Application Agents, OCI IAM Credentials, and OCI Vault Secrets datasets. For more information, refer to Supported Datasets.

Non-Human Identity Discovery

• Aggregate OCI Generative AI agents and related resources
• Aggregate OCI IAM credentials
• Aggregate OCI Vault secret metadata

Refer to Dataset Management for more information.

Refer to Discovering Potential Non-Human Accounts for more information.

Prerequisites

The following prerequisites are required:

• An Oracle Cloud Infrastructure (OCI) tenancy with access to create IAM users, groups, and policies.
• A dedicated IAM user for the connector. Do not use a personal administrator account.
• An IAM group that contains the dedicated user.
• An API signing key for that user, including the PEM private key and fingerprint.
• The tenancy OCID, user OCID, API key fingerprint, and PEM private key from the OCI Console.
• The regions and compartments that host Generative AI Agents and hosted applications. Agents run only in supported Generative AI Agents regions, for example us-chicago-1. Hosted applications are available only in regions where OCI Generative AI is offered.
• (Optional) Identity domain OCIDs if you want to limit IAM credential discovery to specific domains.

Creating the Service User and API Key

To collect the values you enter in Connection Settings:

1. In the OCI Console, go to Identity > Users and create a dedicated user. Record the User OCID.
2. Go to Identity > Groups. Create a group and add the user to the group.
3. Go to Identity > Policies and grant the group the permissions listed in Required Permissions.
4. Open the user, go to API Keys, and add an API key. Download the private key and record the Fingerprint.
5. Open the tenancy details page and record the Tenancy OCID.

Required Permissions

Configure the permissions required to grant necessary access rights to resources or data within the system to perform connector operations.

Create an IAM policy in the root compartment of the target tenancy. SailPoint recommends referencing the group by OCID, for example group id <GROUP_OCID>, so the policy works across identity domains.

Generative AI Agents

Grant the following permissions to aggregate Generative AI Agents:

allow group id <GROUP_OCID> to read genai-agent in tenancy
allow group id <GROUP_OCID> to read genai-agent-tool in tenancy
allow group id <GROUP_OCID> to read genai-agent-endpoint in tenancy
allow group id <GROUP_OCID> to inspect compartments in tenancy

Hosted Applications

Grant the following permissions to aggregate hosted applications and their deployments:

allow group id <GROUP_OCID> to read generative-ai-hosted-application in tenancy
allow group id <GROUP_OCID> to read generative-ai-hosted-application-iam in tenancy
allow group id <GROUP_OCID> to inspect generative-ai-hosted-deployment in tenancy

read is required for the two application types because the connector retrieves each application. inspect is sufficient for deployments because the connector lists them. inspect compartments is already required.

For more information, refer to IAM Policies for OCI Generative AI, API-Level Permissions for Default Applications, API-Level Permissions for OCI IAM Applications, and API-Level Permissions for Deployments.

IAM Users and Credentials

Grant the following permissions to aggregate IAM users, API keys, auth tokens, and customer secret keys:

allow group id <GROUP_OCID> to inspect domains in tenancy
allow group id <GROUP_OCID> to read domains in tenancy
allow group id <GROUP_OCID> to inspect users in tenancy
allow group id <GROUP_OCID> to read users in tenancy

Grant the following permission to aggregate SMTP credentials. The OCI resource type is credentials:

allow group id <GROUP_OCID> to inspect credentials in tenancy

(Optional) To limit the grant to SMTP credentials:

allow group id <GROUP_OCID> to inspect credentials in tenancy where target.credential.type = 'smtp'

In each identity domain used for credential discovery, the service user must be able to list users.

IAM Groups and Policies

Grant the following permissions to aggregate IAM groups, group memberships, and IAM policies. Group membership also uses the existing inspect users permission.

allow group id <GROUP_OCID> to inspect groups in tenancy
allow group id <GROUP_OCID> to inspect policies in tenancy

inspect compartments is already required and is used when collecting policies from compartments. ListGroups requires inspect groups. ListUserGroupMemberships requires inspect groups and inspect users. ListPolicies is covered by inspect policies. For more information, refer to Details for IAM without Identity Domains.

Vault Secrets

Vault secrets use a different OCI service from IAM user credentials. The users permissions do not cover Vault. Do not grant secret-bundles. That permission allows access to secret contents.

Grant the following permissions to aggregate Vault secret metadata:

allow group id <GROUP_OCID> to inspect vaults in tenancy
allow group id <GROUP_OCID> to inspect secret-family in tenancy
allow group id <GROUP_OCID> to read secret-family in tenancy

The secret-family resource type covers secrets and related Vault secret resources. Use inspect and read so the connector can list secrets and read metadata without retrieving secret contents. The inspect compartments permission is already listed for Generative AI Agents.

Documentation Feedback

Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.