1Z0-1151-25 Question 33
Select 2Your organization wants to integrate Okta as a federated Identity Provider (IdP) for an existing OCI Identity Domain. They wish to enable single sign-on (SSO) without manually creating or managing local user credentials in OCI. Which TWO actions must you perform to successfully establish SAML-based federation between Okta and your OCI Identity Domain?
- A
- Import the Okta SAML metadata XML file into your OCI Identity Domain
- B
- Automatically synchronize user attributes by enabling SCIM in the OCI Identity Domain's security policies
- C
- Provide OCI� Identity Domain signing certificate to Okta so it can validate SAML assertions
- D
- Grant the IdP Administrator role to Okta in the OCI Identity Domain
Show answer and explanation
Correct answers: A, C
Explanation
In SAML federation, both the Identity Provider (Okta) and OCI Identity Domain need to trust each other� assertions. You accomplish this by exchanging metadata or certificates. On the OCI Identity Domain side, you import the IdP metadata to establish how SAML assertions will be processed. On the Okta side, you upload OCI� signing certificate to authenticate responses. For more details, refer to Oracle documentation on configuring SAML for Identity Domains, as well as Okta� guidance on setting up enterprise SAML integration.
- A. Correct.
Option 1: Correct. Importing your IdP� (Okta) SAML metadata into the OCI Identity Domain is a required step. This ensures that OCI can trust and validate SAML assertions received from the IdP.
- B. Incorrect.
Option 2: Incorrect. SCIM can be used for user lifecycle management, but simply enabling SCIM in the OCI Identity Domain� security policies does not constitute the core step for setting up SAML federation. It is optional and not strictly required for basic federation functionality.
- C. Correct.
Option 3: Correct. You need to provide your OCI Identity Domain� signing certificate or the metadata to Okta so that Okta can verify the SAML assertions. This establishes trust between the IdP and OCI.
- D. Incorrect.
Option 4: Incorrect. You do not grant an IdP Administrator role to Okta in the OCI Identity Domain. Instead, you configure trust between the two systems using SAML metadata, certificates, and attribute mappings. Roles in OCI are managed differently than roles in Okta.