What is AD bridge
The Microsoft Active Directory (AD) Bridge provides a link between your AD enterprise directory structure and Oracle Identity Cloud Service. Oracle Identity Cloud Service can synchronize with this directory structure so that any new, updated, or deleted user or group records are transferred into Oracle Identity Cloud Service.
Synchronization Flow & Allowed Operations:
AD to IDCS synchronization (Mandatory) - Create/Update/Delete users from AD to IDCS
IDCS to AD synchronization (optional) - Update/Deactivate ( No create/Delete operations allowed)
Prerequisites :
Set Permissions for Your Microsoft Active Directory (AD) Account
1. Create the service account in AD
2. In order to setup AD to IDCS synchronization, Please grant Generic Read permissions for the users, groups, and organizational units (OU) in the AD domain that you want to import into Oracle Identity Cloud Service:
dsacls "DC=jay,DC=local" /I:T /g "jay.local\sanjeev:GR"
3. If you want to setup IDCS to AD sync (optional) , then please grant Generic Write permission for the users, groups, and organizational units (OU) in the AD domain,
dsacls "DC=jay,DC=local" /I:T /g "jay.local\sanjeev:GW"
Certified Components
- With the Microsoft Active Directory (AD) Bridge, Oracle Identity Cloud Service can connect to your AD enterprise directory structure. The following table lists the certified versions for Oracle Identity Cloud Service,AD, your operating system, and the Microsoft .NET software framework (which is required for the AD Bridge to run).
- Please create the machine (for deploying AD bridge) that’s attached to the Microsoft Active Directory domain for auto discovery & Make sure firewall is opened to reach IDCS.
Create a Microsoft Active Directory (AD) Bridge
To create a Microsoft Active Directory (AD) Bridge that provides a link between your AD enterprise directory structure and Oracle Identity Cloud Service, you must be assigned to either the identity domain administrator role or the security administrator role
- In the Identity Cloud Service console, expand the Navigation Drawer, click Settings, and then click Directory Integrations and click Add a Microsoft Active Directory Bridge.
- Make a note of the Identity Cloud Service URL, Client ID, and Client Secret.
- Click Download. Oracle Identity Cloud Service downloads the client for the AD Bridge.
- FTP the ad-id-bridge.exe file to window server which was created in earlier step.
Install AD bridge
- To install the client for the AD Bridge, double-click the ad-id-bridge.exe file.The Welcome to AD Bridge Installer window appears.In the Language Selection area,
- select the language that you want to use to install the client for the AD Bridge, and then click OK. The Identity Cloud Service Microsoft Active Directory Bridge Installer appears.
- In the Welcome dialog box, click Next.
In the Destination Folder dialog box, choose one of the following install choices:
- In the Specify Proxy Server dialog box:
If your organization has a firewall in place and requires communication to be handled using an HTTP Proxy Server, then select Use Proxy Server. If you select this check box, then provide the full path (or address) of the proxy server and the administrator credentials for connecting to the proxy server.
If your organization doesn’t require communication to be handled using an HTTP Proxy Server, then don't select Use Proxy Server.
Click Next.
In the Specify Identity Cloud Service Credentials dialog box:
Provide the Cloud Service URL, Client ID, and Client Secret.
Click Test.
The AD Bridge attempts to connect to the Oracle Identity Cloud Service server.
If a connection can be established, then a Connection Successful! confirmation message appears.
Otherwise, you’ll receive an error message, indicating that you entered an incorrect Cloud Service URL, Client ID, or Client Secret. Modify the incorrect values, and click Test again.
Click Next.
In the Specify Microsoft Active Directory Credentials dialog box, provide the following connection details to the AD server:
Username: The AD account that the AD Bridge uses to access the AD server.
Password: The password for the AD account.
Use SSL: If you're connecting to the server via an SSL connection, then leave this check box selected. Otherwise, deselect it.
- Click Next -->Click Close
In the Identity Cloud Service console, access the Directory Integrations page. The AD Bridge that you created for the AD domain appears with a status of Partially Configured. The bridge is created, but not configured. See Configure a Microsoft Active Directory (AD) Bridge for more information about configuring this bridge.
Note:
If you don't see the AD Bridge in the Directory Integrations page, then refresh your web browser. Also, you can create only one bridge per AD domain.
Configure a Microsoft Active Directory (AD) Bridge
You can access the Managing Security Settings infographic to see how to configure an AD Bridge.
In the Identity Cloud Service console, expand the Navigation Drawer, click Settings, and then click Directory Integrations -->Click the AD Bridge that you want to configure.
Note : The bridge has a status of Partially Configured.
In the Configure the Microsoft Active Directory Domain page, configure the AD domain to poll for changes to users or groups in AD and import those changes into Oracle Identity Cloud Service. In the Select organizational units (OUs) for users and Select organizational units (OUs) for groups panes:
