Step 1: Register a Confidential Application in Oracle Identity Cloud Service

When you register a confidential application in the Oracle Identity Cloud Service administrative console, you obtain some of the key parameters that you need to work with OAuth 2.0: Client ID, Client Secret, and Scopes. OAuth 2.0 is a standard for implementing delegated authorization, and authorization is based on the access token required to access a resource. The access token can be issued for a given scope, which defines what the access token can do and what resources it can access. When you register a web application in Oracle Identity Cloud Service, you add scopes. In the following example, the required scopes to request User searches, edits, creates, and deletes are added. But, if you were to do other things-for example, manage Audit Events, that would require other scopes.

To create and register a confidential application:

1. Access your Oracle Identity Cloud Service instance (for example: https://tenant-base-url/ui/v1/adminconsole) and log in with your Identity Domain Administrator credentials.

2. Click Applications, and then Add.

3. Select Confidential Application as the type of application.

4. Enter an application name and a description, and then click Next.

5. On the Authorization page, define the following items:

   • Select the Configure this application as a client now option.

   • Select Client Credentials from the Allowed Grant Type section.

   • At the bottom of the page select the Grant the client access to Identity Cloud Service Admin APIs check box.

   • Click your cursor in the box that appears below the check box, and then select the type of access for the REST APIs. For example, select Identity Domain Administrator. Your credentials and all tasks available to the Identity Domain Administrator will be accessible to you.

   • Click Next, and then Finish.

   • Make note (using your preferred note utility) of the Client ID and the Client Secret that appear in the confirmation window, and then click Close.

6. Click Activate in the upper-right section of the page to activate the application.

Step 2: Base64 Encode the Client ID and Client Secret

Windows

1. Launch Notepad, and then paste the client ID and client secret into Notepad.

2. Place the client ID and client secret on the same line and insert a colon between them: clientid:clientsecret

3. Save the file to C:\temp and name the file appCreds.txt.

4. In Windows Explorer, right-click C:\temp, and then select CMD Prompt Here from the context menu.

5. Enter the following command to encode the client ID and client secret:

   certutil -encode appCreds.txt appbase64Creds.txt

6. In Notepad, open C:\temp\appbase64Creds.txt, copy its contents, and then close the file.

   Note:

   For security reasons, delete the appCreds.txt and the appbase64Creds.txt files after you finish.

Mac and Linux

1. Launch your preferred note utility (for example, Mac Notes, LINUX gedit, or Vi), and then paste the client ID and client secret into the note utility.

2. Place the client ID and client secret on the same line and insert a colon between them: clientid:clientsecret.

3. Copy the clientid:clientsecret line.

4. Launch a terminal and enter the following command, replacing clientid:clientsecret with the value that you just copied to the clipboard.

   echo -n "clientid:clientsecret" | base64 -w 0

   Note:

   For Linux, add -w 0 to the command to remove line breaks.
5. Copy the value that is returned.

   Note:

   If the value that is returned is broken into more than one line, return to your text editor and make sure the entire results are on a single line with no text wrapping.

Step 3: Obtain an Access Token

The next step in this process is to request the access token.

1. Launch a command prompt.

2. Enter the cURL command below, replacing the text in brackets ( < > ) with the appropriate values:

   curl -i
   -H "Authorization: Basic <base64encoded clientid:secret>"
   -H "Content-Type: application/x-www-form-urlencoded;charset=UTF-8"
   --request POST https://tenant-base-url/oauth2/v1/token
   -d "grant_type=client_credentials&scope=urn:opc:idm:__myscopes__"

   Note:

   If you are using a UNIX OS, you can append | awk -F"\"" '{print $4}' to the end of the cURL command to parse out just the Bearer token. Just remember the default expiration of the token is 3600 seconds from the time of the request.

   Note:

   Optionally, execute the following cURL command to have the access token value accessible through a UNIX variable called AccessTokenValue in your environment:

   export AccessTokenValue=`curl -i
   -H "Authorization: Basic <base64encoded clientid:secret>"
   -H "Content-Type: application/x-www-form-urlencoded;charset=UTF-8"
   --request POST https://tenant-base-url/oauth2/v1/token
   -d "grant_type=client_credentials&scope=urn:opc:idm:__myscopes__" | awk -F"\"" '{print $4}' |  tail -n +16`

   You can then execute echo $AccessTokenValue command to get the access token value.

   Text in Brackets	Value
   base64encoded clientid:secret	Replace with the encoded credentials that you generated in the Base64 Encode the client ID and client secret section.
   IDCS_Service_Instance	Replace with your Oracle Identity Cloud Service URL (for example, https://tenant-base-url).

   Note:

   The urn:opc:idm:__myscopes__ scope in the command is used as a tag by Oracle Identity Cloud Service clients requesting access tokens from the OAuth authorization server. Access tokens are returned that contain all applicable Oracle Identity Cloud Service scopes based on the privileges represented by the Oracle Identity Cloud Service administrator roles granted to the requesting client and the user being specified by the client's request (if present). This scope is not granted directly to any Oracle Identity Cloud Service administrator role.

3. Copy the access_token value from the response. Make sure to copy only the actual token, which is the access_token value between the quotation marks:

   Status: 200
   "access_token":"eyJ4NXQiOiI4Wk. . ."
   "token":"Bearer",
   "expires_in":3600
   

   Note:

   The response includes the expires_in: 3600 parameter. This means that your token is no longer valid after one hour from the time that you generate it. After one hour, you must refresh the token or get a new access token.

Step 4: Make a REST Request to the Environment

After you obtain the OAuth 2.0 access token, you can use the token in a cURL command to send a REST request to the Oracle Identity Cloud Service REST API. The following command returns a list of users in your Oracle Identity Cloud Service instance.

curl
-X GET
-H "Content-Type:application/scim+json"
-H "Authorization: Bearer <access_token>"
https://tenant-base-url/admin/v1/Users