1Z0-1151-25 Question 31
Select 3You are the lead cloud architect for a technology firm that uses Oracle Cloud Infrastructure (OCI) Identity Domains. Your company wants to integrate an external SAML 2.0 identity provider so that employees can use their existing corporate credentials to log in. Which three steps must you complete within your OCI Identity Domain to properly set up this SAML federation?
- A
Create and configure a new Identity Provider in your OCI Identity Domain by uploading the SAML metadata and certificate from the external IdP.
- B
Obtain the metadata from your OCI Identity Domain� SSO configuration and configure it in the external IdP.
- C
Map the external IdP� user or group attributes to the corresponding OCI Identity Domain groups.
- D
Create a Dynamic Group in OCI that references user attributes from the external IdP.
- E
Require the external IdP to enforce the same password policy as your OCI Identity Domain.
Show answer and explanation
Correct answers: A, B, C
Explanation
Federating an OCI Identity Domain with an external SAML 2.0 IdP involves configuring a trust relationship in both systems. First, you create an Identity Provider entry by uploading the external IdP� metadata and certificate to your OCI Identity Domain. Then, you export the OCI Identity Domain� metadata and configure it in the external IdP. Lastly, you map the external IdP� user and group attributes to OCI Identity Domain groups to control access and permissions. For more details, refer to the official Oracle documentation on SAML 2.0 federation for OCI Identity Domains.
- A. Correct.
CORRECT. You must create an Identity Provider entry in your OCI Identity Domain by uploading the external IdP� SAML metadata and certificate. This establishes trust between OCI and the external IdP.
- B. Correct.
CORRECT. Once your OCI Identity Domain has its SSO federation settings, you need to download or copy the domain� metadata (or federation details) and configure them in the external IdP so that both sides trust each other.
- C. Correct.
CORRECT. To ensure users gain the right privileges in OCI when signing in from the external IdP, you need to map user or group attributes from the external IdP to the relevant OCI Identity Domain groups or user attributes.
- D. Incorrect.
INCORRECT. While Dynamic Groups are useful in OCI, they rely on IAM conditions rather than directly referencing external IdP attributes. They are not a required step for setting up basic federation with an external IdP.
- E. Incorrect.
INCORRECT. The external IdP can have its own password policies. You do not need to enforce the exact same password rules in the external IdP and OCI Identity Domain for federation to work. Federation primarily depends on a trust relationship, not identical password policies.