1Z0-1151-25 Question 29
Select 2You are leading a project to integrate a third-party SAML 2.0 provider for authenticating users into an OCI Identity Domain. Your goal is to allow corporate employees to sign into the OCI console using their existing corporate credentials. Which two tasks must you complete to ensure the federation is successfully configured? (Choose two.)
- A
Import the identity provider� SAML metadata into the OCI Identity Domain and confirm that the signing certificate matches the IdP configuration.
- B
Enforce a custom IAM policy that grants the identity provider full administrative privileges in the root compartment, enabling SSO for the entire tenancy.
- C
Configure the Assertion Consumer Service (ACS) URL from the OCI Identity Domain within the third-party IdP� SAML settings.
- D
Disable all local OCI user accounts so that only the third-party Identity Provider is used for authentication.
- E
Use the same OAuth 2.0 credentials on both the third-party IdP and the OCI Identity Domain to establish SSO.
Show answer and explanation
Correct answers: A, C
Explanation
In a SAML federation setup, the critical steps are to import the IdP� metadata (including its signing certificate) into the OCI Identity Domain so that OCI trusts the IdP, and to configure the Assertion Consumer Service (ACS) URL on the IdP side so that the IdP knows where to return authenticated users. Other actions, such as granting excessive privileges or disabling local accounts, are not required and may even be counterproductive. Refer to the Oracle Cloud Infrastructure documentation on 'Federating with Identity Providers' for detailed step-by-step instructions and best practices.
- A. Correct.
Correct. You must upload or import your IdP� metadata (often an XML file) within the OCI Identity Domain configuration. Ensuring the signing certificate is valid and associated with the correct IdP is critical for SAML-based authentication success.
- B. Incorrect.
Incorrect. Granting the external IdP full administrative privileges in the root compartment is neither required nor recommended for enabling SSO. SSO is configured through federation settings in the Identity Domain, not by granting broad privileges in policies.
- C. Correct.
Correct. The Assertion Consumer Service (ACS) URL tells the IdP where to send authentication assertions. Configuring the ACS URL within the IdP� SAML settings ensures OCI can receive and verify the login responses.
- D. Incorrect.
Incorrect. Disabling all local user accounts is not necessary for establishing federation. While you can limit local sign-ins, completely disabling local accounts is an extreme approach and not required for a successful SSO setup.
- E. Incorrect.
Incorrect. SSO via SAML 2.0 does not rely on OAuth 2.0 credentials. Oracle Cloud Infrastructure� Identity Domains and the IdP use SAML assertions to handle authentication, so using OAuth credentials is not relevant to this federation scenario.