Oracle GoldenGate Authorization
Oracle GoldenGate Microservices provides an infrastructure for building service-aware applications to operate and integrate into global, cloud-based deployment environments.
Authorization (AZ) includes Oracle GoldenGate to Oracle GoldenGate communication, and tasks for network and server configuration. User authorization requires roles/privileges to be assigned to users, as required.
Authorization can be done from the Oracle GoldenGate console directly or outsourcing it to external identity management providers. Identity management techniques used with Oracle GoldenGate processes help in setting up authorization profiles and configuring external identity providers that manage authorization for Oracle GoldenGate users. Oracle GoldenGate supports IDCS, IAM (Cloud), OAM (On-premise), and Microsoft EntraID for external identity management, using OAuth2 as the communication protocol.
Grant User Roles for Authorization
Authorization in Oracle GoldenGate relies on user roles. Actions performed in Oracle GoldenGate depend on the user role applied to a user. Use the REST API Service Endpoints for details on determining the required user role for performing different actions.
You can choose and assign from the following user roles when creating Oracle GoldenGate users.
Table 1 Oracle GoldenGate User Roles and Privileges {: #GUID-9757A442-A14D-4E7A-8012-F507A4B27186__TABLE_UPW_GNN_KXB .titleintable}
| Role ID | Privilege Level |
|---|---|
| User | Allows information-only service requests, which do not alter or effect the operation of either the MA. Examples of Query/Read-Only information include performance metric information and resource status and monitoring information. |
| Operator | Allows users to perform only operational actions, such as creating, starting and stopping resources. Operators cannot alter the operational parameters or profiles of the MA server. |
| Administrator | Grants full access to the user, including the ability to alter general, non-security related operational parameters and profiles of the server. |
| Security | Grants administration of security related objects and invoke security related service requests. This role has full privileges. |
User Management based on User Roles
Oracle GoldenGate users that are created at different stages of deployment configuration, have different access functions for Oracle GoldenGate Microservices.
The first user for Oracle GoldenGate is set up from the Oracle GoldenGate Configuration (OGGCA) utility. This user can access the Service Manager and all Microservices for all deployments associated with the Service Manager on the host.
After you access the Service Manager using the first user, you can create users from the Administrator page of the Service Manager. Depending on the user role, you can enable users to access Oracle GoldenGate Microservices.
For example, if you create a user with the Operator role, you cannot access the Service Manager with these credentials.
User Management with External Identity Providers
Oracle GoldenGate supports IDCS and IAM as cloud-based identity providers and OAM as an on-premise identity provider. Starting with Oracle GoldenGate 23.9, Microsoft Azure EntraID is also available as an extternal identity provider.
See Delegate User Management to an External Identity Provider for instructions on implementing any of the supported external identity providers.