Configure your Identity Domain for Single Sign-On

How to use this guide

1. You should have read the steps to enable Single Sign-On (SSO) for either the paying or non-paying organization. 
2. Follow the steps below to set up your Identity Domain.
3. Provide Oracle with your Identity Domain ID. You can find instructions to do this below.
4. Once Oracle confirms the Lobby is configured to use your Identity Domain, you can then create an Identity Provider (IdP) Policy. 
5. Follow the remaining steps for either the paying or non-paying organization.

Step 1: Create a SAML integration in your identity provider

The exact process in this step depends on your identity provider (IdP), such as Microsoft Entra ID, Microsoft Active Directory Federation Services (AD FS), or Okta. However, the general process is similar for all SAML integrations.

1. Follow your IdP’s instructions to create a SAML integration.
2. Download the Federation Metadata XML file from your IdP. You'll need to import this file into your Oracle Identity Domain later in the process.

Note: Your IdP will require the Entity ID and Reply URL for your Oracle Identity Domain before it can generate its Federation Metadata XML file. Depending on your IdP, you can either:

• import a SAML metadata file from your Oracle Identity Domain; or
• enter the Entity ID and Reply URL manually.

You can construct the Entity ID and Reply URL from your Identity Domain URL. For example:

• Entity ID: https://idcs-exampleid1234.identity.oraclecloud.com:443/fed
• Reply URL: https://idcs-exampleid1234.identity.oraclecloud.com/fed/v1/sp/sso

Step 2: Navigate to the details screen

1. Log in to your Oracle Cloud Console. You should see the screen below.

2. You need to navigate to the details screen that looks like this: 

3. Click the menu at the top left and select Identity & Security.
4. Click Domains.

5. Make sure the compartment is selected and click the Default link in the table.
6. You should now be on the details screen.

Step 3: Identity Domain Configuration

7. Click Federation.

8. Under Actions, click Add SAML IdP.

9. Enter a name for your Identity Provider and click Next.

Upload Federated Metadata XML

10. Upload the Federated Metadata XML file (that you downloaded from your SAML IdP in Step 1) and click Next.

11. On the Map User Identity screen, use the default values and click Next.
12. Review the details and click Create IdP.

Export SAML Metadata

This is the XML file you need to import into your identity provider (IdP).

13. Click Export SAML Metadata.

14. Click Download XML to download the Metadata file.
15. Switch back to your SAML IdP to complete the setup.

Step 4: Finish configuration in your IdP

You can now return to the configuration of your IdP service.

1. Follow your IdP application’s process to upload a metadata file and upload the Federated Metadata XML file you downloaded.
2. After the upload, you should see a screen indicating URLs and other info, taken from the metadata file.
3. Confirm that the user identity is based on the user’s email address.
4. Typically IdPs have policies or groups that indicate if a user is eligible to use a configured SAML provider. Confirm that users are added to those groups or policies in your IdP if required.
5. At this point, both your IdP and Identity Domain are fully configured and ready for testing. Switch back to the Identity Domain window and use its test capabilities.

Step 5: Test and finish configuration

1. Click the name of your Identity Provider.

2. Click Actions and select Test Login.

3. You will be presented with your IdP’s sign-in screen. Enter valid credentials for a user that exists in your IdP that is configured to use the SAML Federation App. A user account with the same email must also exist in your Identity Domain. 
4. If the test sign-in was successful you will see the following message:

Your connection is successful.
You may close this window and go back to the admin console.

If the test login failed you will see a screen similar to the one below. Please read the error description to amend the setup or create missing data:

Connection failed. Configuration may need to be modified.
No user was returned during the SAML assertion to user mapping via the NameID attribute for partner Azure AD: NamedID poleary@majestic.com, user attribute name userNamed, message: ***See below***.
Show Assertion Details
You may close this window and go back to the admin console.

Step 6: Activate your Identity Domain

1. Click Actions and select Activate IdP.

Step 7: Turn off the Oracle Cloud welcome email

Turn off this setting to prevent users from receiving an Oracle Cloud email asking them to activate their profile. The email does not provide access to Aconex and may cause confusion.
 

1. From your Oracle Cloud Console details screen click Notifications. You may need to click the > arrow to scroll to the end of the menu options.
2. Click Edit Notifications.
3. Click to expand the End user notifications list.
4. Switch off the Welcome toggle.
5. Click Save Changes.

Step 8: Provide Oracle with your Domain ID

After configuring your Identity Domain you need to provide Oracle with the ID for your Identity Domain. 

The easiest way to do this is to paste your Domain URL into the ticket. The URL will look something like this: https://idcs-.identity.oraclecloud.com/ui/v1/myconsole

You can find your Domain URL in the details screen.

You will not be able to create an Identity Provider (IdP) Policy until Oracle confirms the Lobby is configured to use your Identity Domain. 

You've successfully configured your Identity Domain. 

Next, you need to create an Identity Provider (IdP) Policy. Note: Oracle needs to have confirmed the Lobby is configured to use your Identity Domain before you complete these next steps.