# SailPoint Oracle Cloud Infrastructure SaaS Connector Documentation > Oracle Cloud Infrastructure SaaS Connector Documentation # Documentation # Connecting SailPoint and Oracle Cloud Infrastructure SaaS To connect SailPoint with Oracle Cloud Infrastructure, perform the following tasks: ## Adding the Source in SailPoint To connect to SailPoint, perform the following steps. Once the connection is made, you can configure it to meet your company's needs. 1. Sign in to SailPoint. 2. Go to **Admin \> Connections \> Sources**. 3. Select **Create New**. 4. Search for the connector by entering the name in the search box, and then select **Actions**. 5. In the **Actions** dropdown list, select the setup method: - [**Express Setup**](<#configuring-a-source-using-express-setup>) - Quickly create a read-only connection to your target system by providing minimal configurations and authentication. On completion, aggregation is automatically started. > **Note** > > Express Setup supports Credential Providers. For information on supported credential providers and configuration, refer to [Credential Providers](). For more information, contact your SailPoint Customer Service Manager. - [**Standard Setup**](<#configuring-a-source-using-standard-setup>) - Provide detailed basic configuration to create the source. Once the source is created, continue with source setup. ### Configuring a Source Using Express Setup Express Setup minimizes the initial configuration process so you can quickly connect the application and immediately begin aggregating user account and entitlement data. 1. Review the directions and select **Start Express Setup**. 2. Review the pre-populated **Source Name**, **Source Owner**, and **Description**. To update, select **Edit**. > **Note** > > The source name must be unique. You can change these settings later in the source configuration. 3. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider. > **Note** > > To add a Credential Provider in SailPoint, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](). 4. Configure the authentication to allow SailPoint to connect to the source. For more information, refer to the **Connection Settings** section. 5. Select **Finish**. After a successful test connection, the system creates your source and prompts you to run an aggregation. - If you want to aggregate now, select **Aggregate**. - To see the latest account aggregation history, go to **Account Management \> Account Aggregation**. - To see the list of aggregated source accounts, go to **Account Management \> Accounts**. - If you want to aggregate later, select **Exit**. This returns you to the **Sources** page. Your new source is listed, but contains no accounts or aggregation history yet. ### Configuring a Source Using Standard Setup Use Standard Setup to configure the connector for full feature support. 1. In the **Source Name** field, enter a unique and descriptive name for your source. Source names cannot exceed 128 characters. 2. In the **Description** field, provide additional details about the source to help distinguish it from similar sources. This field allows a maximum of 2,000 characters. 3. In the **Source Owner** field, begin typing the name of an owner. Matches appear after you type two or more letters. For more information, refer to [Assigning a Source Owner](). 4. (Optional) Select a governance group to grant its members [source]() or [role]() sub-admin level oversight of the source and its access. For more information, refer to [Creating and Managing Governance Groups](). 5. If this source represents a primary system containing your organization's personnel records, select the **Authoritative Source** checkbox. For more information, refer to [Creating Identity Profiles](). 6. Select **Continue**. The source is created, and you are navigated to the **Source Setup \> Base Configuration** page. Continue to configure your connected source there. ## Base Configuration Provide the base configuration parameters. Information you entered in the Create New Source dialog is automatically entered into the fields in the Base Configuration page. You can edit this information if necessary. 1. Enter a unique name and description for the source. 2. In the **Source Owner** dropdown list, select the identity that owns this source. - To find a source owner, begin entering their name. 3. (Optional) If enabled for your organization, select the **Use a Credential Provider** checkbox to manage the source's authentication using a credential provider. > **Note** > > To add a credential provider, go to **Admin \> Connections \> Credential Providers**. For more information about credential providers, refer to [Credential Providers](). 4. Configure the authentication to allow SailPoint to connect to the source. Refer to [Connection Settings](<#connection-settings>) for more information. 5. (Optional) In the **Governance Group for Source Management** dropdown list, select a governance group to associate with this source. For more information about governance groups, refer to [Associating Governance Groups with a Source](). 6. (Optional) Select **Create Manual Work Items** to allow the connector to create manual work items for certain operations. You can also enable this option so the source supports additional source management features such as creating accounts and access profile management. > **Important** > > Once you enable this feature, you cannot disable it. For more information on manual work items in SailPoint, refer to [Work Items](). For more information on SailPoint features, refer to [SailPoint Identity Services](). 7. Select **Save**. ## Connection Settings The following values are required for SailPoint to connect to your Oracle Cloud Infrastructure (OCI) tenancy. > [!NOTE] > > **Screenshot** > > [![Connection Settings fields for Tenancy OCID, User OCID, Fingerprint, and Private Key]()]() **To configure Connection Settings:** 1. Select **Connection Settings** from the menu. 2. Enter the **Tenancy OCID** of the tenancy that owns the API key user. 3. Enter the **User OCID** of the IAM user that owns the API key. 4. Enter the **Fingerprint** of the uploaded public key. 5. Enter the **Private Key** used to authenticate with OCI. Paste the PEM key contents. Do not enter a file path, URL, or Base64 wrapper. 6. Select **Save**. ## Aggregation Settings Open **Aggregation Settings** to scope IAM credential discovery for the Oracle Cloud Infrastructure SaaS source. **To configure Aggregation Settings:** 1. Select **Aggregation Settings** from the menu. 2. (Optional) Enter **Domains** to limit IAM credential discovery. Press Enter after each identity domain OCID. Leave blank to discover credentials in active identity domains. 3. Select **Save**. **Domains** applies to API keys, auth tokens, customer secret keys, and SMTP credentials. It does not change account aggregation, and it does not apply to groups, policies, hosted applications, Generative AI Agents, or Vault secrets. ### Additional Aggregation Settings Open **Additional Aggregation Settings** to scope Generative AI Agent, hosted application, Vault secret, and IAM policy aggregation for the Oracle Cloud Infrastructure SaaS source. **To configure Additional Aggregation Settings:** 1. Select **Additional Aggregation Settings** from the menu. 2. (Optional) Enter **Regions** to limit aggregation. Press Enter after each region identifier, for example `us-chicago-1`. Leave blank to use subscribed regions. 3. (Optional) Enter **Compartment OCIDs** to limit aggregation. Press Enter after each OCID. Leave blank to include accessible compartments in the tenancy. 4. Select **Save**. > [!NOTE] > > If you leave **Regions** and **Compartment OCIDs** blank, the connector aggregates from subscribed regions and accessible compartments in the tenancy. **Regions** and **Compartment OCIDs** apply to Generative AI Agents, hosted applications, and Vault secrets. Hosted applications are available only in regions where OCI Generative AI is offered. **Compartment OCIDs** also limits IAM policy aggregation. Leave it blank to include policies in accessible compartments. **Regions** does not apply to IAM groups or IAM policies. IAM groups are collected for the whole tenancy. **Domains** does not apply to these objects. ## Review and Test Perform a test to confirm the connection to SailPoint. 1. Go to **Review and Test**. 2. Confirm that the entries in each field are correct. If you note any mistakes, return to the section and make corrections. 3. Select **Test Connection**. ## SailPoint Application Onboarding SailPoint application onboarding enables you to easily onboard new applications and create sources following the successful onboarding of a discovery source. To use this feature, continue to **Discovered Applications** in the SailPoint user interface. For more information, refer to [Application Onboarding]() in the SailPoint SaaS documentation. # Dataset Management Dataset Management lets you review the object types a source collects and control how the source aggregates those objects into SailPoint. Use Dataset Management to view and manage resource attributes, datasets and their resources, enable dataset aggregation schedules, perform manual aggregation, and view aggregation history. > [!NOTE] > > Datasets are also available in SailPoint Agentic Fabric. Contact your Customer Success team and refer to [SailPoint Agentic Fabric]() for more information. For more information, refer to [Managing Datasets and Resources]() for datasets, resources, owner correlation, and aggregation. ## Datasets A *dataset* is a named group of one or more related resources that the source aggregates together. When aggregation runs for a dataset, the source collects all resources in that dataset from the managed system in one aggregation job. Activate or deactivate aggregation at the dataset level, not for individual resources. > [!NOTE] > > Each resource belongs to exactly one dataset for that source. The source defines which resources belong to each dataset. You can enable aggregation and review associated resources, but you cannot create or delete datasets or move resources between them. ### Dataset Aggregation Configure aggregation on the **Dataset Aggregations** tab for each dataset. Configure each dataset separately. During aggregation, your owner correlation rules are automatically applied to link machine identities to their human owners. For more information, refer to [Configuring Dataset Aggregations](). ## Resources A resource defines an object type from the managed system. It specifies the kind of object, the attributes the source collects, and how the source identifies and displays each object. Resources form the building blocks of the data model. In the UI, each resource appears under **Dataset Management** \> **Resources** with its schema. A resource does not run aggregation by itself. The dataset that owns the resource collects it during aggregation. For more information, refer to [Managing Resources](). ### Owner Correlation Configure owner correlation on each resource to link aggregated objects to human owners. If you do not configure owner correlation, or if the mapping produces no match, an owner is not assigned. For more information, refer to [Configuring Owner Correlation](). ## Supported Datasets Go to **Dataset Management \> Datasets** on your Oracle Cloud Infrastructure SaaS source to view the datasets the connector aggregates. Select a dataset to review its associated resources and configure aggregation. > [!NOTE] > > Configure aggregation for each dataset separately. For more information, refer to [Dataset Aggregation](). The connector collects OCI Generative AI Agents, OCI Hosted Application Agents, OCI IAM credentials, and OCI Vault secrets in separate datasets. | Dataset Name | Associated Resources | Dataset ID | | --- | --- | --- | | OCI Generative AI Agents | Agent, Agent Endpoint, Knowledge Base, Tool, Data Source, and relationship resources | `oci:generative-ai-agent` | | OCI Hosted Application Agents | Hosted Application and Hosted Application IAM | `oci:hosted-application-agent` | | OCI IAM Credentials | API Key, Auth Token, Customer Secret Key, and SMTP Credential | `oci:iam-credential` | | OCI Vault Secrets | Vault Secret | `oci:vault-secrets` | A scheduled aggregation runs automatically. The default schedule is every 12 hours. Your administrators can change the schedule in the tenant. ## Supported Resources A resource represents a type of object the connector collects from Oracle Cloud Infrastructure (OCI). Each resource defines the attributes collected for that object type and how each object appears in SailPoint. For more information, refer to [Managing Resources](). > [!NOTE] > > When you enable dataset aggregation for a selected dataset, all resources in that dataset are collected at once. Activate or deactivate aggregation at the dataset level, not for individual resources. Go to **Dataset Management** \> **Resources** on your Oracle Cloud Infrastructure SaaS source to view each object type the connector aggregates. Select a resource to review its schema on the **Schema** tab. | Resource Name | Resource Type | Resource ID | | --- | --- | --- | | OCI Generative AI Agent | Agent | `oci:generative-ai-agent` | | OCI Generative AI Tool | Capability | `oci:generative-ai-tool` | | OCI Hosted Application | Agent | `oci:hosted-application` | | OCI Hosted Application IAM | Agent | `oci:hosted-application-iam` | | OCI IAM API Key | Credential | `oci:iam-api-key` | | OCI IAM Auth Token | Credential | `oci:iam-auth-token` | | OCI IAM Customer Secret Key | Credential | `oci:iam-customer-secret-key` | | OCI IAM SMTP Credential | Credential | `oci:iam-smtp-credential` | | OCI Vault Secret | Credential | `oci:vault-secret` | | Relationship resources | Access or Extends | `oci:agent-uses-tool` | For attribute definitions, refer to: - [OCI Generative AI Agent Attributes](<#oci-generative-ai-agent-attributes>) - [OCI Hosted Application Attributes](<#oci-hosted-application-attributes>) - [Relationship Attributes](<#relationship-attributes>) - [OCI IAM API Key Attributes](<#oci-iam-api-key-attributes>) - [OCI IAM Auth Token Attributes](<#oci-iam-auth-token-attributes>) - [OCI IAM Customer Secret Key Attributes](<#oci-iam-customer-secret-key-attributes>) - [OCI IAM SMTP Credential Attributes](<#oci-iam-smtp-credential-attributes>) - [OCI Vault Secret Attributes](<#oci-vault-secret-attributes>) ## OCI Generative AI Agent Attributes Schema attributes for the **OCI Generative AI Agent** resource in the **OCI Generative AI Agents** dataset. | Attribute | Type | Description | | --- | --- | --- | | `compartmentId` | string | Compartment OCID that owns the agent. | | `createdBy` | string | Email address of the user who created the agent. | | `definedTags` | string | Defined tags for the agent, stored as JSON. | | `description` | string | Agent description. | | `displayName` | string | Agent display name. | | `endpointCreatedBy` | string (multi-valued) | Email address of each endpoint owner, in `{endpoint display name}::{email}` format. | | `endpointDescription` | string (multi-valued) | Description of each endpoint, in `{endpoint display name}::{value}` format. | | `endpointDisplayName` | string (multi-valued) | Display name of each endpoint, in `{agent display name}::{endpoint display name}` format. | | `endpointLifecycleDetails` | string (multi-valued) | Lifecycle details for each endpoint, in `{endpoint display name}::{value}` format. | | `endpointLifecycleState` | string (multi-valued) | Lifecycle state of each endpoint, in `{endpoint display name}::{value}` format. | | `endpointTimeCreated` | string (multi-valued) | Date and time each endpoint was created, in `{endpoint display name}::{value}` format. | | `endpointTimeUpdated` | string (multi-valued) | Date and time each endpoint was last updated, in `{endpoint display name}::{value}` format. | | `freeformTags` | string | Free-form tags for the agent, stored as JSON. | | `generationLlmCustomization` | string | LLM customization settings for the agent, stored as JSON. | | `id` | string | Agent OCID. | | `identity` | string | Unique identifier for the agent. Same as the agent OCID. | | `knowledgeBaseIds` | string | Knowledge base OCIDs associated with the agent, stored as JSON. | | `lifecycleState` | string | Agent lifecycle state. | | `llmConfig` | string | LLM configuration for the agent, stored as JSON. | | `resourceType` | string | Resource type. | | `spBusinessApplication` | string | Business application for this resource. | | `systemTags` | string | System tags for the agent, stored as JSON. | | `timeCreated` | string | Date and time the agent was created. | | `timeUpdated` | string | Date and time the agent was last updated. | | `type` | string | Resource subtype. | ## OCI Hosted Application Attributes Schema attributes for hosted applications in the **OCI Hosted Application Agents** dataset. **OCI Hosted Application** is an application that uses identity domain authentication. **OCI Hosted Application IAM** is an application that uses OCI IAM authentication. The identity attribute is `identity`. The display attribute is `displayName`. The two resources use the same attributes. `inboundAuthConfig` is collected only for **OCI Hosted Application**. | Attribute | Type | Description | | --- | --- | --- | | `compartmentId` | string | Compartment OCID that owns the application. | | `createdBy` | string | Email address of the user who created the application. | | `definedTags` | string | Defined tags, stored as JSON. | | `deploymentDetails` | string | Deployments of this application, stored as JSON. Empty when the application has no deployments. | | `description` | string | Application description. | | `displayName` | string | Application display name. | | `environmentVariables` | string | Environment variables, stored as JSON. | | `freeformTags` | string | Free-form tags, stored as JSON. | | `id` | string | Application OCID. | | `identity` | string | Unique identifier for the application. Same as the application OCID. | | `inboundAuthConfig` | string | Identity domain authentication settings, stored as JSON. Collected only for **OCI Hosted Application**. | | `lifecycleDetails` | string | Additional details about the lifecycle state. | | `lifecycleState` | string | Application lifecycle state. | | `networkingConfig` | string | Networking settings, stored as JSON. | | `owner` | string | Email address of the application owner. Same value as `createdBy`. | | `region` | string | OCI region where the application was aggregated. | | `resourceType` | string | Resource type. The value is Agent. | | `scalingConfig` | string | Scaling settings, stored as JSON. | | `spBusinessApplication` | string | Business application for this resource. | | `storageConfigs` | string | Storage settings for the application, stored as JSON. | | `systemTags` | string | System tags, stored as JSON. | | `timeCreated` | string | Date and time the application was created. | | `timeUpdated` | string | Date and time the application was last updated. | | `type` | string | `HostedApplication` or `HostedApplicationIam`. | ## Relationship Attributes Schema attributes for relationship resources in the **OCI Generative AI Agents** dataset, such as agent-to-tool links. | Attribute | Type | Description | | --- | --- | --- | | `displayName` | string | Display name of the relationship. | | `id` | string | Unique identifier for the relationship. | | `identity` | string | Unique identifier for the relationship. | | `resourceId` | string | Identifier of the linked resource. | ## OCI IAM API Key Attributes Schema attributes for the **OCI IAM API Key** resource in the **OCI IAM Credentials** dataset. The identity attribute is `identity`. The display attribute is `displayName`. | Attribute | Type | Description | | --- | --- | --- | | `createdBy` | string | Email address of the user who owns the API key. | | `displayName` | string | Display name of the API key, in `{user name}/{fingerprint}` format. | | `fingerprint` | string | API key fingerprint. | | `id` | string | Unique identifier for the API key, in `{tenancy OCID}/{user OCID}/{fingerprint}` format. | | `identity` | string | Unique identifier for the API key, in `{tenancy OCID}/{user OCID}/{fingerprint}` format. | | `inactiveStatus` | string | Indicates whether the API key is inactive. | | `keyId` | string | Identifier of the API key, in `{tenancy OCID}/{user OCID}/{fingerprint}` format. | | `keyValue` | string | Public key for the API key. | | `lifecycleState` | string | Current lifecycle state of the API key. | | `region` | string | Region where the API key was aggregated. | | `resourceType` | string | Resource type. | | `spBusinessApplication` | string | Business application for this resource. | | `spType` | string | Credential subtype. The value is `API_KEY`. | | `timeCreated` | string | Date and time the API key was created. | | `userId` | string | OCID of the IAM user who owns the API key. | | `userName` | string | Name of the IAM user who owns the API key. | > [!NOTE] > > The **OCI IAM Credentials** dataset also aggregates auth tokens, customer secret keys, and SMTP credentials. For more information, refer to [Supported Datasets](<#supported-datasets>). ## OCI IAM Auth Token Attributes Schema attributes for the **OCI IAM Auth Token** resource in the **OCI IAM Credentials** dataset. The identity attribute is `identity`. The display attribute is `displayName`. | Attribute | Type | Description | | --- | --- | --- | | `authTokenUrl` | string | Oracle Cloud Console URL for the owning user's auth tokens. | | `capabilities` | string | Capability flags enabled on the owning IAM user. | | `createdBy` | string | Email address of the user who owns the auth token. | | `description` | string | Description of the auth token. | | `displayName` | string | Display name of the auth token, typically in `{user name}/{auth token ID}` format, or the token description when present. | | `id` | string | Unique identifier for the auth token, in `{tenancy OCID}/{user OCID}/{auth token ID}` format. | | `identity` | string | Unique identifier for the auth token, in `{tenancy OCID}/{user OCID}/{auth token ID}` format. | | `inactiveStatus` | string | Indicates whether the auth token is inactive. | | `lifecycleState` | string | Current lifecycle state of the auth token. | | `owner` | string | Owning identity used for owner correlation. | | `region` | string | Region where the auth token was aggregated. | | `resourceType` | string | Resource type. | | `spBusinessApplication` | string | Business application for this resource. | | `spType` | string | Credential subtype. The value is `AUTH_TOKEN`. | | `timeCreated` | string | Date and time the auth token was created. | | `timeExpires` | string | Date and time the auth token expires. | | `userId` | string | OCID of the IAM user who owns the auth token. | | `userName` | string | Name of the IAM user who owns the auth token. | | `userUrl` | string | Oracle Cloud Console URL for the owning IAM user. | > [!NOTE] > > The connector does not aggregate the auth token secret. ## OCI IAM Customer Secret Key Attributes Schema attributes for the **OCI IAM Customer Secret Key** resource in the **OCI IAM Credentials** dataset. The identity attribute is `identity`. The display attribute is `displayName`. | Attribute | Type | Description | | --- | --- | --- | | `capabilities` | string | Capability flags enabled on the owning IAM user. | | `createdBy` | string | Email address of the user who owns the customer secret key. | | `customerSecretKeyUrl` | string | Oracle Cloud Console URL for the owning user's customer secret keys. | | `displayName` | string | Display name of the customer secret key. Uses the OCI display name, or `{user name}/{id}`. | | `id` | string | Unique identifier for the customer secret key, in `{tenancy OCID}/{user OCID}/{customer secret key ID}` format. | | `identity` | string | Unique identifier for the customer secret key, in `{tenancy OCID}/{user OCID}/{customer secret key ID}` format. | | `inactiveStatus` | string | Indicates whether the customer secret key is inactive. | | `lifecycleState` | string | Current lifecycle state of the customer secret key. | | `owner` | string | Owning identity used for owner correlation. | | `region` | string | Region where the customer secret key was aggregated. | | `resourceType` | string | Resource type. | | `spBusinessApplication` | string | Business application for this resource. | | `spType` | string | Credential subtype. The value is `CUSTOMER_SECRET_KEY`. | | `timeCreated` | string | Date and time the customer secret key was created. | | `timeExpires` | string | Date and time the customer secret key expires. | | `userId` | string | OCID of the IAM user who owns the customer secret key. | | `userName` | string | Name of the IAM user who owns the customer secret key. | | `userUrl` | string | Oracle Cloud Console URL for the owning IAM user. | > [!NOTE] > > The connector does not aggregate the secret key value. ## OCI IAM SMTP Credential Attributes Schema attributes for the **OCI IAM SMTP Credential** resource in the **OCI IAM Credentials** dataset. The identity attribute is `identity`. The display attribute is `displayName`. | Attribute | Type | Description | | --- | --- | --- | | `capabilities` | string | Capability flags enabled on the owning IAM user. | | `createdBy` | string | Email address of the user who owns the SMTP credential. | | `description` | string | Description of the SMTP credential. | | `displayName` | string | Display name of the SMTP credential. Uses the SMTP username, or `{user name}/{id}`. | | `id` | string | Unique identifier for the SMTP credential, in `{tenancy OCID}/{user OCID}/{SMTP credential ID}` format. | | `identity` | string | Unique identifier for the SMTP credential, in `{tenancy OCID}/{user OCID}/{SMTP credential ID}` format. | | `inactiveStatus` | string | Indicates whether the SMTP credential is inactive. | | `lifecycleState` | string | Current lifecycle state of the SMTP credential. | | `owner` | string | Owning identity used for owner correlation. | | `region` | string | Region where the SMTP credential was aggregated. | | `resourceType` | string | Resource type. | | `smtpCredentialUrl` | string | Oracle Cloud Console URL for the owning user's SMTP credentials. | | `spBusinessApplication` | string | Business application for this resource. | | `spType` | string | Credential subtype. The value is `SMTP_CREDENTIAL`. | | `timeCreated` | string | Date and time the SMTP credential was created. | | `timeExpires` | string | Date and time the SMTP credential expires. | | `userId` | string | OCID of the IAM user who owns the SMTP credential. | | `userName` | string | Name of the IAM user who owns the SMTP credential. | | `username` | string | SMTP username. | | `userUrl` | string | Oracle Cloud Console URL for the owning IAM user. | > [!NOTE] > > The connector does not aggregate the SMTP password. ## OCI Vault Secret Attributes Schema attributes for the **OCI Vault Secret** resource in the **OCI Vault Secrets** dataset. The identity attribute is `identity`. The display attribute is `displayName`. Owner correlation uses `createdBy`. The connector matches `createdBy` to the identity email address first, then to the identity name. | Attribute | Type | Description | | --- | --- | --- | | `identity` | string | Vault secret OCID. Same value as `id`. | | `id` | string | Vault secret OCID, for example `ocid1.vaultsecret.oc1...`. | | `displayName` | string | Vault secret name, or the secret OCID when the name is blank. | | `resourceType` | string | SailPoint resource type (`std:credential`). | | `spBusinessApplication` | string | SailPoint business application (`oracle_oci_generative_ai_agents`). | | `secretName` | string | Vault secret name. | | `compartmentId` | string | OCID of the compartment that contains the secret. | | `vaultId` | string | OCID of the Vault that contains the secret. | | `keyId` | string | OCID of the encryption key used by the secret. | | `lifecycleState` | string | Current lifecycle state of the secret, for example `ACTIVE`. | | `lifecycleDetails` | string | Additional details about the secret lifecycle state. | | `description` | string | Vault secret description. | | `timeCreated` | string | Date and time the secret was created. | | `timeOfCurrentVersionExpiry` | string | Date and time the current secret version expires. | | `timeOfDeletion` | string | Date and time the secret is scheduled for deletion. | | `rotationStatus` | string | Current rotation status, for example `NOT_ENABLED`. | | `lastRotationTime` | string | Date and time of the most recent rotation. | | `nextRotationTime` | string | Date and time of the next scheduled rotation. | | `isAutoGenerationEnabled` | boolean | Indicates whether automatic secret generation is enabled. | | `currentVersionNumber` | number | Current secret version number. Present when extra metadata is fetched. | | `definedTags` | string | Defined tags, stored as JSON. | | `freeformTags` | string | Free-form tags, stored as JSON. | | `systemTags` | string | System tags, stored as JSON. | | `metadata` | string | Secret metadata, stored as JSON. Present when extra metadata is fetched. | | `rotationConfig` | string | Secret rotation configuration, stored as JSON. | | `secretGenerationContext` | string | Secret generation configuration, stored as JSON. | | `secretRules` | string | Secret rules, stored as JSON. Present when extra metadata is fetched. | | `createdBy` | string | Creator email parsed from `definedTags` / `Oracle-Tags.CreatedBy`. Used for owner correlation. | | `region` | string | Region where the secret was aggregated. | > [!NOTE] > > The connector does not aggregate secret contents. Map-valued OCI fields are stored as JSON strings. Extra metadata attributes (`secretRules`, `currentVersionNumber`, and `metadata`) are populated unless `skipVaultSecretMetadata` is true on the source object. That attribute is not shown on the source form. # Integrating SailPoint with Oracle Cloud Infrastructure SaaS Use this connector to manage Oracle Cloud Infrastructure (OCI) access in SailPoint. You can govern OCI IAM users as accounts, OCI IAM groups and OCI IAM policies as entitlements, OCI Generative AI Agents and OCI Hosted Applications as machine identities, OCI IAM credentials as non-human identities, including API keys, auth tokens, customer secret keys, and SMTP credentials, and OCI Vault secret metadata as credentials. Each Oracle Cloud Infrastructure SaaS source connects to a single tenancy. The connector is read-only. It does not create, update, or delete objects in OCI. To set up the source, refer to [Connecting SailPoint and Oracle Cloud Infrastructure SaaS](). To onboard this source with SailPoint Agentic Fabric, refer to [Configuring Sources](). > [!NOTE] > > To view the latest features, enhancements, and fixes for all SaaS connectors, refer to the [SaaS Release Notes]() page. ## Supported Features The Oracle Cloud Infrastructure SaaS source supports these features: - **Test Connection** - **Account Aggregation** - Aggregates OCI IAM users as accounts. Each account includes the IAM groups that user belongs to. - **Entitlement Aggregation** - Aggregates OCI IAM groups and OCI IAM policies as entitlements. - On an account, each group links to the group entitlement. - On a group, each related policy links to the policy entitlement. - On a policy, each OCI IAM group named in the policy links to the group entitlement. A reference that cannot be matched to an aggregated OCI IAM group is shown as text. - **Machine Identity Governance** - Aggregates OCI Generative AI Agents and related resources, including agent endpoints and tools. - Aggregates OCI Hosted Applications as agent resources in the **OCI Hosted Application Agents** dataset. This includes applications that use identity domain authentication and applications that use OCI IAM authentication. Deployment details are collected on each application. These objects are not accounts. - Aggregates OCI IAM credentials as credential resources, including API keys, auth tokens, customer secret keys, and SMTP credentials. These objects are not accounts. IAM users appear on the **Accounts** tab from account aggregation. - Aggregates Oracle Cloud Infrastructure Vault secret metadata as credential resources in the **OCI Vault Secrets** dataset. These objects are not accounts. Secret values are not aggregated. Discovery uses the optional **Regions** and **Compartment OCIDs** filters. **Domains** do not apply to Vault secrets. - During dataset aggregation, the connector collects these objects in the **OCI Generative AI Agents**, **OCI Hosted Application Agents**, **OCI IAM Credentials**, and **OCI Vault Secrets** datasets. For more information, refer to [Supported Datasets](). > [!NOTE] > > After account aggregation, accounts are listed on the **Accounts** tab. Users in a non-default identity domain often appear with a domain prefix, for example `oracleidentitycloudservice/user@example.com`. Users in the default domain typically appear as an email address or user name only. > [!NOTE] > > Your organization must have SailPoint Agentic Fabric to use dataset aggregation. Contact your Customer Success team or refer to [SailPoint Agentic Fabric]() for more information. ### Non-Human Identity Discovery - Aggregate OCI Generative AI agents and related resources - Aggregate OCI IAM credentials - Aggregate OCI Vault secret metadata Refer to Dataset Management for more information. Refer to [Discovering Potential Non-Human Accounts]() for more information. ## Prerequisites The following prerequisites are required: - An Oracle Cloud Infrastructure (OCI) tenancy with access to create IAM users, groups, and policies. - A dedicated IAM user for the connector. Do not use a personal administrator account. - An IAM group that contains the dedicated user. - An API signing key for that user, including the PEM private key and fingerprint. - The tenancy OCID, user OCID, API key fingerprint, and PEM private key from the OCI Console. - The regions and compartments that host Generative AI Agents and hosted applications. Agents run only in supported Generative AI Agents regions, for example `us-chicago-1`. Hosted applications are available only in regions where OCI Generative AI is offered. - (Optional) Identity domain OCIDs if you want to limit IAM credential discovery to specific domains. ### Creating the Service User and API Key **To collect the values you enter in Connection Settings:** 1. In the OCI Console, go to **Identity \> Users** and create a dedicated user. Record the **User OCID**. 2. Go to **Identity \> Groups**. Create a group and add the user to the group. 3. Go to **Identity \> Policies** and grant the group the permissions listed in [Required Permissions](<#required-permissions>). 4. Open the user, go to **API Keys**, and add an API key. Download the private key and record the **Fingerprint**. 5. Open the tenancy details page and record the **Tenancy OCID**. > [!CAUTION] > > OCI does not store or redisplay the private key. If you lose the key, generate a new API key. ## Required Permissions Configure the permissions required to grant necessary access rights to resources or data within the system to perform connector operations. Create an IAM policy in the root compartment of the target tenancy. SailPoint recommends referencing the group by OCID, for example `group id `, so the policy works across identity domains. ### Generative AI Agents Grant the following permissions to aggregate Generative AI Agents: ```text allow group id to read genai-agent in tenancy allow group id to read genai-agent-tool in tenancy allow group id to read genai-agent-endpoint in tenancy allow group id to inspect compartments in tenancy ``` ### Hosted Applications Grant the following permissions to aggregate hosted applications and their deployments: ```text allow group id to read generative-ai-hosted-application in tenancy allow group id to read generative-ai-hosted-application-iam in tenancy allow group id to inspect generative-ai-hosted-deployment in tenancy ``` `read` is required for the two application types because the connector retrieves each application. `inspect` is sufficient for deployments because the connector lists them. `inspect compartments` is already required. For more information, refer to [IAM Policies for OCI Generative AI](), [API-Level Permissions for Default Applications](), [API-Level Permissions for OCI IAM Applications](), and [API-Level Permissions for Deployments](). ### IAM Users and Credentials Grant the following permissions to aggregate IAM users, API keys, auth tokens, and customer secret keys: ```text allow group id to inspect domains in tenancy allow group id to read domains in tenancy allow group id to inspect users in tenancy allow group id to read users in tenancy ``` Grant the following permission to aggregate SMTP credentials. The OCI resource type is `credentials`: ```text allow group id to inspect credentials in tenancy ``` (Optional) To limit the grant to SMTP credentials: ```text allow group id to inspect credentials in tenancy where target.credential.type = 'smtp' ``` In each identity domain used for credential discovery, the service user must be able to list users. ### IAM Groups and Policies Grant the following permissions to aggregate IAM groups, group memberships, and IAM policies. Group membership also uses the existing `inspect users` permission. ```text allow group id to inspect groups in tenancy allow group id to inspect policies in tenancy ``` `inspect compartments` is already required and is used when collecting policies from compartments. `ListGroups` requires `inspect groups`. `ListUserGroupMemberships` requires `inspect groups` and `inspect users`. `ListPolicies` is covered by `inspect policies`. For more information, refer to [Details for IAM without Identity Domains](). ### Vault Secrets Vault secrets use a different OCI service from IAM user credentials. The `users` permissions do not cover Vault. Do not grant `secret-bundles`. That permission allows access to secret contents. Grant the following permissions to aggregate Vault secret metadata: ```text allow group id to inspect vaults in tenancy allow group id to inspect secret-family in tenancy allow group id to read secret-family in tenancy ``` The `secret-family` resource type covers secrets and related Vault secret resources. Use `inspect` and `read` so the connector can list secrets and read metadata without retrieving secret contents. The `inspect compartments` permission is already listed for Generative AI Agents. # Schema Reference Use these attributes to map Oracle Cloud Infrastructure (OCI) IAM users to SailPoint accounts. Group and policy attributes are listed on [Group Attributes](<#group-attributes>) and [Policy Attributes](<#policy-attributes>). Dataset resource attributes remain under [Supported Resources](). The application schema is used to configure the objects returned from a connector. > [!NOTE] > > - The **Account Schema** tab is used to define the attributes for each object type in the application being configured. The schema attributes can be defined as **Entitlement** or **Multi-Valued**. Refer to [Managing Source Account Schemas]() for more information. > - The schema attributes that are not present by [default](<#default-account-schema>) must be defined as strings if not specified. The Oracle Cloud Infrastructure SaaS connector uses the following default correlation and object configurations. ## Default Account Schema Each source supports a variety of details, or attributes, about each user who has an account, such as their name, email address, manager name, and location. The set of account attributes each source stores and how they're organized is known as the account's *schema*. To best represent your data, you can configure sources to use an account schema matching the one you use in the external connector. Refer to [Managing Source Account Schemas]() for more information. ### Default Account Attributes The Oracle Cloud Infrastructure SaaS connector supports the following default account schema attributes and customer configurable attributes. The attributes must be defined as strings if not specified. Account aggregation discovers Oracle Cloud Infrastructure (OCI) IAM users as accounts. The identity attribute is `id`. The display attribute is `name`. > [!NOTE] > > Account names can differ by identity domain. Users in a non-default identity domain often appear with a domain prefix. Users in the default domain typically appear as an email address or user name only. | Attribute | Type | Description | | --- | --- | --- | | `id` | string | Unique identifier for the account, in `{tenancy OCID}/{user OCID}` format. | | `userId` | string | OCID of the IAM user. | | `compartmentId` | string | Compartment OCID. For IAM users, this is the tenancy OCID. | | `name` | string | User name. Uses the email address if the name is blank. | | `email` | string | User email. | | `description` | string | User description. | | `emailVerified` | boolean | Indicates whether the email address is verified. | | `isMfaActivated` | boolean | Indicates whether multifactor authentication (MFA) is enabled. | | `identityProviderId` | string | OCID of the identity provider, if the user is federated. | | `externalIdentifier` | string | Identifier from the identity provider. | | `timeCreated` | string | Date and time the user was created. | | `lifecycleState` | string | Current lifecycle state of the user. | | `freeformTags` | string | Free-form tags. | | `createdBy` | string | Email address or name of the user who created the account. | | `capabilities` | string (multi-valued) | Capabilities enabled for the user. | | `Groups` | string (multi-valued) | IAM groups this user belongs to. Each value links to a Group entitlement. | ## Group Attributes OCI IAM groups aggregated as entitlements. The identity attribute is `id`. The display attribute is `name`. | Attribute | Type | Description | | --- | --- | --- | | `compartmentId` | string | Compartment OCID that owns the group. For IAM groups, this is the tenancy OCID. | | `definedTags` | string | Defined tags, stored as JSON. | | `description` | string | Group description. | | `freeformTags` | string | Free-form tags, stored as JSON. | | `id` | string | Unique identifier for the group, in `IAM/{tenancy OCID}/{group OCID}` format. | | `lifecycleState` | string | Group lifecycle state. | | `name` | string | Group name. | | `ocid` | string | Group OCID. | | `PoliciesReferencedIn` | string (multi-valued) | IAM policies that refer to this group. Each value links to a Policy entitlement. | | `PolicyStatementsReferredIn` | string (multi-valued) | IAM Authorization policy statements that reference this group. Each value is `: `, where `` is the statement text after "to" (verb, resource, location, and any where condition). Example: `AdminsPolicy: inspect domains in tenancy`. | | `timeCreated` | string | Date and time the group was created. | ## Policy Attributes OCI IAM policies aggregated as entitlements. The identity attribute is `id`. The display attribute is `name`. | Attribute | Type | Description | | --- | --- | --- | | `compartmentId` | string | Compartment OCID that owns the policy. | | `definedTags` | string | Defined tags, stored as JSON. | | `description` | string | Policy description. | | `freeformTags` | string | Free-form tags, stored as JSON. | | `GroupsReferred` | string (multi-valued) | Groups named in this policy. An OCI IAM group in this tenancy is a link to the Group entitlement. Any other reference is shown as text. | | `id` | string | Unique identifier for the policy, in `IAM/{tenancy OCID}/{policy OCID}` format. | | `lifecycleState` | string | Policy lifecycle state. | | `name` | string | Policy name. | | `ocid` | string | Policy OCID. | | `statements` | string (multi-valued) | Policy statements, as written in OCI. | | `timeCreated` | string | Date and time the policy was created. | | `versionDate` | string | Policy version date. | # Troubleshooting If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support. For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information: - [SailPoint Identity Services Documentation]() - [SailPoint Support Knowledge Base]() - [SailPoint Developer Community]() ## Debug Logs For information about managing additional source settings, including debug logging and downloading connector logs, refer to [Managing Additional Settings](). ## Account aggregation succeeds but fewer accounts than expected appear **Issue**: Account aggregation completes, but the **Accounts** tab does not list every IAM user you expect. **Resolution**: Confirm that the API key user can list users in the tenancy. The **Domains** field does not change account aggregation. ## Account names include a domain prefix for some users only **Issue**: Some accounts show a domain prefix, for example `oracleidentitycloudservice/user@example.com`, and others show only an email address or user name. **Resolution**: This is expected. Users in a non-default identity domain often appear with a domain prefix. Users in the default domain typically appear as an email address or user name only. The display attribute is the OCI user name returned by Identity. ## Generative AI Agents are missing from dataset aggregation **Issue**: Dataset aggregation completes, but agents do not appear. **Resolution**: Confirm that agents exist in a region that hosts Generative AI Agents. If you entered values in **Regions** or **Compartment OCIDs**, verify that those values include the region and compartment where the agents run. Confirm that the API key user has the Generative AI Agent permissions listed in [Prerequisites](). ## SMTP credentials are missing from dataset aggregation **Issue**: Dataset aggregation completes, and API keys, auth tokens, or customer secret keys appear, but SMTP credentials do not. **Resolution**: Grant `inspect` on the `credentials` resource type in the tenancy. API keys, auth tokens, and customer secret keys use the existing `users` permissions. SMTP credentials require a separate `credentials` policy. For more information, refer to [Required Permissions](). ## Vault secrets are missing from dataset aggregation **Issue**: Dataset aggregation completes, but Vault secrets do not appear. **Resolution**: Grant `inspect` and `read` on `secret-family`, and optionally `inspect` on `vaults`. Do not grant `secret-bundles`. If you entered values in **Regions** or **Compartment OCIDs**, verify that those values include the region and compartment that contain the secrets. **Domains** do not apply to Vault secrets. For more information, refer to [Required Permissions](). ## Groups are missing after aggregation **Issue**: Entitlement aggregation completes, but IAM groups do not appear. **Resolution**: Grant `inspect groups` in the tenancy. Group membership also requires the existing `inspect users` permission. For more information, refer to [Required Permissions](). ## Policies are missing, or groups do not list related policies **Issue**: Entitlement aggregation completes, but IAM policies do not appear, or a group has no related policies. **Resolution**: Grant `inspect policies` in the tenancy. If **Compartment OCIDs** is set, confirm that it includes the compartments that contain the policies. Groups are still aggregated when policy access is missing. For more information, refer to [Required Permissions](). ## Hosted applications are missing from dataset aggregation **Issue**: Dataset aggregation completes, but hosted applications do not appear. **Resolution**: Confirm that the applications exist in a region where OCI Generative AI is offered. If **Regions** or **Compartment OCIDs** is set, confirm that those values include the region and compartment that contain the applications. Grant `read` on `generative-ai-hosted-application` and `generative-ai-hosted-application-iam`, and `inspect` on `generative-ai-hosted-deployment`. **Domains** does not apply to hosted applications. For more information, refer to [Required Permissions]().