To create a confidential client application, use cURL to send an HTTP/HTTPS request to the Oracle IDCS URL. The following command creates a confidential client application named OCOMC-RestClient with the following values:

• The allowed grants are client_credentials and refresh_token.

• The allowed operation is introspect.

• The application scopes are Designer, Operator, and Viewer.

• The allowed scopes specify the fully qualified server (FQS) value in the format AudienceScope. If you have changed the default audience, update it here. The default value is ocomcScope. For example, ocomcDesigner, or ocomcOperator.

curl --location 'https://idcs_hostname/admin/v1/Apps' 
--header 'Authorization: Bearer *******access_token' 
--header 'Content-Type: application/json' 
--data '{"schemas":["urn:ietf:params:scim:schemas:oracle:idcs:App"],
"basedOnTemplate":{"value":"CustomWebAppTemplateId"},"displayName":"OCOMC-RestClient","name":"OCOMC--RestClient","clientType":"confidential","isAliasApp":false,
"isOPCService":false,"active":true,"isOAuthClient":true,"isUnmanagedApp":false,"isWebTierPolicy":false,"isOAuthResource":false,"allowedGrants":["client_credentials","refresh_token"],"allowOffline":true,
"allUrlSchemesAllowed":true,"trustScope":"Explicit",
"redirectUris":["https://omdUI_hostname/webApps/mediation"],
"postLogoutRedirectUris":["https://omdUI_hostname/webApps/mediation"],
"allowedOperations":["introspect"],
"allowedScopes":[{"fqs":"ocomcOperator","value":"Operator","description":"RSM Operator scope","requiresConsent":false},{"fqs":"ocomcDesigner","designer_value":"Designer","description":"RSM Designer scope","requiresConsent":false},{"fqs":"ocomcViewer","value":"Viewer","description":"RSM Viewer scope","requiresConsent":false}]}'

where:

• idcs_hostname is the hostname of your Identity Cloud Service instance.

• access_token is the access token.

• omdUI_hostname is the hostname of the server where the Offline Mediation Controller UI is deployed. If this is specified incorrectly, you will get errors from IDCS after logging in.

• designer_value is the scope or role of the user.

To generate two-legged access tokens, use cURL to send an HTTP/HTTPS request to the Oracle IDCS URL.

curl --location 'https://domain_url/oauth2/v1/token' \
--header 'Content-Type: application/x-www-form-urlencoded' \
--header 'Authorization: Basic encoded_client********\ \
--data-urlencode 'grant_type=client_credentials' \
--data-urlencode 'scope=scope'

where:

• domain_url is the hostname of your Identity Cloud Service instance.

• encoded_client is the base64-encoded string of the clientId:clientSecret that you created.

• scope is the concatenation of the primary audience (that you set when creating the Resource Server, for example ocomc) and the scope, such as Designer.

To configure Oracle IDCS in your REST Services Manager cloud native environment:

1. Open your override-values.yaml file for oc-cn-ocomc-helm-chart.

2. Set the rsm.security.provider key to IDCS.

   Note:

   Do not leave the key empty, or RSM will run without authentication.

3. Set the rsmOAuthToken key to the RSM OAuth 2.0 token.

4. Add your security information under the security.configuration.idcs section:

   • idcsUri: Set this to the IDCS domain URL.

   • idcsClientId:Set this to the client ID for your IDCS client application.

   • idcsClientSecret: Set this to the client secret in Base64-encoded format.

   • idcsIntrospectEndpointUri: Set this to the IDCS introspect URL for token validation.

5. To enable rsm-automation jobs, add the valid RSM OAuth token to the jobs.requestAutomation.config.rsmAuthToken key.

When installing Oracle Access Management, ensure that:

• OAuth 2.0 and REST Endpoints are public.

  • You must configure all /oauth2/rest/** endpoints as public resources.

  • You use these endpoints for token introspection, which allows Oracle Access Management to validate and process OAuth tokens.

• OpenID Configuration Endpoint is public.

  • The /.well-known/openid-configuration endpoint must be public.

  • This endpoint provides metadata about the OpenID Provider, which is essential for the Offline Mediation Designer UI.

To configure Oracle Unified Directory as the identity store in Oracle Access Management:

1. Launch a browser and log in to the Oracle Access Management Console: http://oam_hostname:7001/oamconsole.

2. Click the Configuration tab on the top right and then click User Identity Stores.

   The OCOMCStore tab appears.

3. Set the following values in the OCOMCStore tab:

   1. Store Name: Set this to OUDStore

   2. Store Type: Set this to OUD: Oracle Unified Directory

   3. Location: Set this to hostName:hostLDAPPort

   4. Bind DN: Set this to cn=Directory Manager

   5. Password: Set this to the Oracle Unified Directory password

   6. Login ID Attribute: Set this to uid

   7. User Password Attribute: Set this to userPassword

   8. User Search Base: Set this to ou=People,dc=ocomcexample.com

   9. Group Name Attribute: Set this to cn

   10. Group Search Base: Set this to ou=Groups,dc=ocomcexample.com

4. Click Test Connection on the top right side of the tab.

   If the connection works, click OK in the Connection Status window. If not, correct the values and test again.

5. Click Apply on the top right to save the definition.

6. Click the User Identity Store tab.

7. From the Default Store list, select OUDStore and then click Apply.

8. Under the Plug-ins tile, click Application Security and then Authentication Modules.

9. Click Search.

   The LDAP module appears.

10. Click the LDAP module and set User Identity Store to OUDStore.

11. Click the Launch Pad tab and, in the Access Manager tile, click the Authentication Schemes link.

12. On the Search Authentication Schemes page, click Search.

    The search results appear.

13. Select the LDAPScheme row in the search results and click Edit.

14. In LDAPScheme, click Duplicate.

    This creates a new scheme with the name 'Copy of LDAP Scheme'.

15. Set the following values in the scheme:

    1. Name: Set this to LDAPOUDScheme

    2. Description: Set this to LDAP Scheme Over OUD

    3. Authentication Module: Set this to LDAP

16. Click Apply.

17. Click the Set As Default option and then click OK in the confirmation pop-up box.

To create a user using Oracle Unified Directory:

1. Create a user.ldif file:

   dn: uid=ocomcuser,ou=People,dc=Distinguished Name
   sn: ocomcuser
   cn: ocomcuser
   userPassword: password
   objectClass: top
   objectClass: organizationalPerson
   objectClass: person
   objectClass: inetOrgPerson
   uid: ocomcuser

2. To create a user in the OUD Store, run the following commands:

   cd oud_home/instance_name/OUD/bin
   ./ldapmodify -a -h OUD_hostname -p OUD_port -D "cn=Directory Manager" -w password -f path/add_user.ldif

3. Create an add_group.ldif file to create a group:

   dn: ou=Designer,ou=groups,dc=ocomcexample.com
   objectclass: top
   objectclass: groupOfUniqueNames
   cn: Designer
   ou: groups
   description: example description.

4. To add the group in the OUD Store, run the following commands:

   cd oud_home/instance_name/OUD/bin
   ./ldapmodify -a -h OUD_hostname -p OUD_port -D "cn=Directory Manager" -w password -f path/add_user.ldif

5. Create an add_user_to_group.ldif file:

   dn: ou=PSA Designer,ou=Groups,dc=ocomcexample.com
   changetype: modify
   add: member
   member: uid=ocomcuser,ou=People,dc=ocomcexample.com

   or with the values:

   dn: ou=Designer,ou=Groups,dc=ocomcexample.com
   changetype: modify
   add: member
   member: uid=ocomcuser,ou=People,dc=ocomcexample.com

6. To add the user to the group in the OUD Store, run the following commands:

   cd oud_home/instance_name/OUD/bin
   ./ldapmodify -a -h OUD_hostname -p OUD_port -D "cn=Directory Manager" -w password -f path/add_user_to_group.ldif

To enable OAuth service in Oracle Access Management:

1. Go to the Available Services option in the Configuration tab in the OAM Console.

2. Click Enable Service for OAuth and OpenIDConnect Service.

To configure the Offline Mediation Controller cloud native environment to connect with Oracle Access Management, add the following keys to your override-values.yaml file for oc-cn-ocomc-helm-chart:

provider: "OAM"
configuration:
  oam:
    clientId: client_id
    clientSecret: client_secret
    tokenEndpointUri: http://OAM_hostname:14100/oauth2/rest/token
    authorizationEndpointUri: http://OAM_hostname:7777/oauth2/rest/authorize
    introspectEndpointUri: http://OAM_hostname:7777/oauth2/rest/token/introspect
    oauthIdentityDomainName: IDStore
    oudHostName: oud_hostname
    oudAdminUserName: oud_adminuser
    oudAdminUserPassword: oud_password
    oudHttpPort: oud_httpport
    oudHttpsPort: oud_httpsport
    oudUsersBaseDn: user_basedn
    oudGroupsBaseDn: group_basedn

where:

• client_id is the client ID to be used for connecting with the OAM server.

• client_secret is the client secret to be used for connecting with the Oracle Access Management server. This must be encoded in Base64 format.

• OAM_hostname is the host name of the server where Oracle Access Management is running.

• oud_hostname is the host name of the Oracle Unified Directory server.

• oud_adminuser is the admin username for the Oracle Unified Directory server.

• oud_password is the admin password encoded in Base64 format.

• oud_httpport is the HTTP port for the Oracle Unified Directory server.

• user_basedn is the Oracle Unified Directory server Base-DN to be used by Offline Mediation Controller REST Services Manager.

• group_basedn is the Oracle Unified Directory server groups-DN to be used by Offline Mediation Controller REST Services Manager.