1Z0-1151-25 Question 32
Select 2Your organization maintains user accounts centrally in Azure Active Directory (Azure AD) and wants to provide single sign-on (SSO) into a new Oracle Cloud Infrastructure (OCI) Identity Domain. You have been asked to implement SAML federation so that users can log in to OCI resources using their Azure AD credentials. Which two actions must you perform to complete this federation setup?
- A
Export the Azure AD IdP metadata and upload it to the OCI Identity Domain� federation configuration.
- B
Register the OCI Identity Domain as a SAML application in Azure AD using the domain� service provider (SP) metadata file or URL.
- C
Set the OCI Identity Domain� default password policy to match Azure AD� password complexity requirements.
- D
Manually create matching user accounts in the OCI Identity Domain for all Azure AD users before federation can work.
Show answer and explanation
Correct answers: A, B
Explanation
To implement SAML federation between the OCI Identity Domain and an external IdP like Azure AD, you configure a SAML application in Azure AD and upload Azure AD� IdP metadata into OCI. This establishes bidirectional trust so users can log in using existing Azure AD credentials. Refer to the OCI documentation on 'Identity Federation with Third-Party IdPs' for detailed steps and best practices.
- A. Correct.
Correct. When configuring SAML federation, you must upload the external identity provider� metadata (e.g., from Azure AD) into the OCI Identity Domain so that OCI can trust the external IdP� assertions.
- B. Correct.
Correct. You must set up a new SAML application in Azure AD and provide the OCI Identity Domain� SP metadata (file or URL). This ensures Azure AD recognizes OCI as a service provider and can generate valid SAML tokens for user authentication.
- C. Incorrect.
Incorrect. SAML federation does not require matching password policies between Azure AD and OCI. User authentication is delegated to Azure AD; OCI� local password policy does not affect federated user logins.
- D. Incorrect.
Incorrect. In a typical SAML federation scenario, you do not need to pre-create user accounts in the OCI Identity Domain if just-in-time (JIT) provisioning is enabled or you are solely using federated login without local accounts. The federation handshake handles user authentication, and attributes can be used to create or map user attributes automatically.