{"id":1515,"date":"2023-09-01T21:00:24","date_gmt":"2023-09-01T19:00:24","guid":{"rendered":"http:\/\/wp.chaoyu.nl\/?p=1515"},"modified":"2024-03-31T18:01:12","modified_gmt":"2024-03-31T16:01:12","slug":"oracle-oci-console-social-sign-on-with-microsoft-and-google","status":"publish","type":"post","link":"https:\/\/chaoyu.nl\/?p=1515","title":{"rendered":"Oracle OCI console Social Sign On with Microsoft and Google"},"content":{"rendered":"\n<blockquote class=\"wp-block-quote has-luminous-vivid-amber-background-color has-background is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"has-medium-font-size wp-block-paragraph\"><strong>Be aware that this is done on an Always Free Account in September 2023<\/strong><\/p>\n<cite>why this is important to know in advance: OCI is change so rapidly, it might not be working the same way a year later<\/cite><\/blockquote>\n\n\n\n<h2 class=\"wp-block-heading\">Goal: soical sign-on for both Microsoft and Google <\/h2>\n\n\n<div class=\"wp-block-image is-style-default\">\n<figure class=\"aligncenter size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"593\" height=\"812\" src=\"http:\/\/wp.chaoyu.nl\/wp-content\/uploads\/2023\/09\/image.png\" alt=\"\" class=\"wp-image-1517\" style=\"width:297px;height:406px\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\"><a href=\"#id-azure\" data-type=\"internal\" data-id=\"#id-azure\">Azure<\/a>, <a href=\"#id-google\" data-type=\"internal\" data-id=\"#id-google\">Google <\/a>and <a href=\"#id-oci\" data-type=\"internal\" data-id=\"#id-oci\">OCI<\/a><\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"id-azure\"><strong>Microsoft (azure) <\/strong><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">For Microsoft, we need to go to Microsoft Azure and create <strong>Azure Active Directory<\/strong> -&gt;<strong> Add<\/strong> -&gt; <strong>App registration<\/strong><\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1672\" height=\"892\" src=\"http:\/\/wp.chaoyu.nl\/wp-content\/uploads\/2023\/09\/image-1.png\" alt=\"\" class=\"wp-image-1518\"\/><\/figure>\n<\/div>\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1527\" height=\"914\" src=\"http:\/\/wp.chaoyu.nl\/wp-content\/uploads\/2023\/09\/image-2.png\" alt=\"\" class=\"wp-image-1519\"\/><\/figure>\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">On Registration an application page, choose <strong>Personal Microsoft Accounts Only<\/strong> for Support Account Types, and <strong>Web <\/strong>for Redirect URI. Redirect URl is a must.<\/p>\n\n\n<div class=\"wp-block-image\">\n<figure class=\"aligncenter size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"1033\" height=\"870\" src=\"http:\/\/wp.chaoyu.nl\/wp-content\/uploads\/2023\/09\/image-3.png\" alt=\"\" class=\"wp-image-1520\" style=\"width:834px;height:702px\"\/><\/figure>\n<\/div>\n\n\n<ul class=\"wp-block-list\">\n<li><a rel=\"noreferrer noopener\" href=\"https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Identity\/identityproviders\/add-social-identity-provider.htm\" data-type=\"URL\" data-id=\"https:\/\/docs.oracle.com\/en-us\/iaas\/Content\/Identity\/identityproviders\/add-social-identity-provider.htm\" target=\"_blank\">Redirect URI<\/a> for OCI are two parts <strong><code>https:\/\/&lt;Identity domain base URL&gt;\/oauth2\/v1\/social\/callback<\/code><\/strong> we need to find this <code>identity domain base url<\/code> .This so called domain base url is hidden in OCI domain page Identity -&gt; Domains -&gt; Default Domain (or anyother domain you have) -&gt; overview <\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Once Application is Registered, we need 2 things<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Client ID, client id can be found in <strong>overview -&gt; Application (client) ID<\/strong><\/li>\n\n\n\n<li>Client Secret, client secret is created via<strong> Client Credential<\/strong> -&gt; <strong>New Client Secret<\/strong>. Remeber to copy <strong>Value <\/strong>NOT secret ID<\/li>\n<\/ul>\n\n\n<div class=\"wp-block-image is-style-default\">\n<figure class=\"aligncenter size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1905\" height=\"893\" src=\"http:\/\/wp.chaoyu.nl\/wp-content\/uploads\/2023\/09\/image-4.png\" alt=\"\" class=\"wp-image-1525\"\/><\/figure>\n<\/div>\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1677\" height=\"759\" src=\"http:\/\/wp.chaoyu.nl\/wp-content\/uploads\/2023\/09\/image-5.png\" alt=\"\" class=\"wp-image-1529\"\/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1423\" height=\"753\" src=\"http:\/\/wp.chaoyu.nl\/wp-content\/uploads\/2023\/09\/image-6.png\" alt=\"\" class=\"wp-image-1530\"\/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"id-google\">Google Console<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Similar to Microsoft, we need to create a client id and secret plus redirect URL, we already know what the redirect url from the Microsoft setup, so we only need to get client id and secret.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To get them, we need to go to google console and create \/ or reuse an exisiting project and click on<strong> APIs &amp; Services<\/strong> -&gt;<strong> Credentials -&gt; OAuth2.0 Client IDs<\/strong> <\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1838\" height=\"889\" src=\"http:\/\/wp.chaoyu.nl\/wp-content\/uploads\/2023\/09\/image-7.png\" alt=\"\" class=\"wp-image-1533\"\/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">there we click on <strong>Create Credentials -&gt; OAuth Client ID<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1912\" height=\"639\" src=\"http:\/\/wp.chaoyu.nl\/wp-content\/uploads\/2023\/09\/image-8.png\" alt=\"\" class=\"wp-image-1534\"\/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Choose Application Type <strong>Web<\/strong>, give it a name and most importantly <strong>Authorized Redirect URIs<\/strong> (this is the same redirect URL in Microsoft) <\/p>\n\n\n\n<p class=\"has-small-font-size wp-block-paragraph\"><em>e.g https:\/\/idcs-123456.identity.oraclecloud.com\/oauth2\/v1\/social\/callback<\/em><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">After the creation process, we can find the client id and client secret.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1747\" height=\"778\" src=\"http:\/\/wp.chaoyu.nl\/wp-content\/uploads\/2023\/09\/image-9.png\" alt=\"\" class=\"wp-image-1535\"\/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"id-oci\">OCI<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Once we have the client id and secret, it is pretty straight forward to set social sign on ( identify provider) in OCI. <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Head to <strong>Identify &amp; Security -&gt; Domains<\/strong>, click on your domain ( mine is Default). Once you are in your identify Domain click on <strong>Security -&gt; Identity Provider<\/strong> and chose Add Social IdP<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Choose Microsoft to set up Microsoft, here you need Client ID and Secret. For Google, it is the same. e.g<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1822\" height=\"918\" src=\"http:\/\/wp.chaoyu.nl\/wp-content\/uploads\/2023\/09\/image-10.png\" alt=\"\" class=\"wp-image-1538\"\/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Once we have created our IdPs, we need to <strong>Active it manually. <\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1633\" height=\"589\" src=\"http:\/\/wp.chaoyu.nl\/wp-content\/uploads\/2023\/09\/image-11.png\" alt=\"\" class=\"wp-image-1539\"\/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">We are almost done, one last step is to add these IdPs we created to IdP policies, so the sign on will start to use it. To do it, head to <strong>IdP policies <\/strong>-&gt; <strong>Default Identity Policy <\/strong>-&gt; <strong>Edit first Rule<\/strong> and <strong>add two new identity providers<\/strong> and <strong>save changes<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1912\" height=\"780\" src=\"http:\/\/wp.chaoyu.nl\/wp-content\/uploads\/2023\/09\/image-12.png\" alt=\"\" class=\"wp-image-1540\"\/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<h2 class=\"wp-block-heading\">To allow email + pwd MFA and google auth at the same time<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">what does it mean? if you use email + pwd , user still needs TFA. if user choose google auth no need of MFA. ( ofc, it is also fine to force always MFA) <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">to achive this : <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">go to Domain > Domain ( for me it is default domain) > Security > Sign On Policy > Default Policy ( for me) > sign on Rules > create a new Rule <\/p>\n\n\n\n<p class=\"wp-block-paragraph\">after Rule created, make sure it is priority 1 <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"580\" src=\"https:\/\/chaoyu.nl\/wp-content\/uploads\/2024\/03\/Screenshot-2024-03-31-at-17.59.52-1024x580.png\" alt=\"\" class=\"wp-image-1735\" srcset=\"https:\/\/chaoyu.nl\/wp-content\/uploads\/2024\/03\/Screenshot-2024-03-31-at-17.59.52-1024x580.png 1024w, https:\/\/chaoyu.nl\/wp-content\/uploads\/2024\/03\/Screenshot-2024-03-31-at-17.59.52-300x170.png 300w, https:\/\/chaoyu.nl\/wp-content\/uploads\/2024\/03\/Screenshot-2024-03-31-at-17.59.52-768x435.png 768w, https:\/\/chaoyu.nl\/wp-content\/uploads\/2024\/03\/Screenshot-2024-03-31-at-17.59.52-1536x870.png 1536w, https:\/\/chaoyu.nl\/wp-content\/uploads\/2024\/03\/Screenshot-2024-03-31-at-17.59.52-2048x1160.png 2048w, https:\/\/chaoyu.nl\/wp-content\/uploads\/2024\/03\/Screenshot-2024-03-31-at-17.59.52-850x481.png 850w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>Be aware that this is done on an Always Free Account in September 2023 why this is important to know in advance: OCI is change so rapidly, it might not be working the same way a year later Goal: soical sign-on for both Microsoft and Google Azure, Google and OCI Microsoft (azure) For Microsoft, we&#8230;<\/p>\n","protected":false},"author":1,"featured_media":1517,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1515","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/chaoyu.nl\/index.php?rest_route=\/wp\/v2\/posts\/1515","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/chaoyu.nl\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/chaoyu.nl\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/chaoyu.nl\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/chaoyu.nl\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1515"}],"version-history":[{"count":14,"href":"https:\/\/chaoyu.nl\/index.php?rest_route=\/wp\/v2\/posts\/1515\/revisions"}],"predecessor-version":[{"id":1736,"href":"https:\/\/chaoyu.nl\/index.php?rest_route=\/wp\/v2\/posts\/1515\/revisions\/1736"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/chaoyu.nl\/index.php?rest_route=\/wp\/v2\/media\/1517"}],"wp:attachment":[{"href":"https:\/\/chaoyu.nl\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1515"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/chaoyu.nl\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1515"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/chaoyu.nl\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1515"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}