1. Introduction to OCI IAM

1.1 What is OCI IAM?

1.2 OCI IAM: Authentication(AuthN)

1.3 OCI IAM: Authorization(AuthZ)

1.4 OCI IAM Components

2. Overview of Identity Domains

2.1 What are OCI IAM identity domains?

2.2 Identity Domains

2.3 OCI IAM with identity Domains

3. OCI IAM Identity Domain Types

---

.
.

.
.
.

---

1. Introduction to OCI IAM

1.1 What is OCI IAM?

Oracle Cloud Infrastructure Identity and Access Management (OCI IAM) is Oracle Cloud Infrastructure's cloud-native service that provides identity and access management capabilities. It controls who can access which OCI resources and what actions can be performed on them.

1.2 OCI IAM: Authentication(AuthN)

Ensures authentication for users, applications, and services. Includes identity lifecycle management, SSO, integration with existing directories and external identity providers. Common methods: username/password, passwordless authentication, API keys, OAuth 2.0 tokens, instance principals, federation via SAML 2.0, and MFA.

1.3 OCI IAM: Authorization(AuthZ)

It provides authorization through IAM policies, with granular or role-based access control (RBAC). The policies define which actions users, groups, or services can perform on OCI resources.

1.4 OCI IAM Components

Component	Definition
Tenancy	Oracle Cloud Infrastructure root account. It is the highest-level container, which brings together all resources and the root compartment. Defines the maximum security and administration limit.
Identity Domain	Logical container for managing users, groups, and applications. Allows separating identities by team, environment, or purpose (e.g., production and development) and managing lifecycle and authentication.
Compartment	Logical container used to isolate and organize resources within the tenancy. Helps with access control, organization, and quotas. Policies can be applied at the scope of a compartment or the tenancy.
User	Individual identity that can authenticate and access OCI resources. Typically receives permissions through groups, not directly.
Group	Collection of users. Permissions are granted to groups through policies, which facilitates role-based access control (RBAC).
Policy	Document that defines authorization in OCI IAM. Determines who can perform which actions, on which resources, and in which compartment/tenancy. Example: Allow group Admins to manage instance in compartment Production.
Principal	Entity that requests access to a resource. It can be a user, group, instance, service, or application. It is the "who" of the policy.
Dynamic Group	Special group whose members are defined by matching rules (e.g., compute instances with a specific tag or in a specific compartment). Widely used to grant permissions to resources without fixed credentials.
Instance Principal	Mechanism that allows a compute instance to authenticate and access OCI services without a username and password, using membership in a dynamic group.
Identity Provider / Federation	External identity provider that enables authentication via SAML 2.0, allowing SSO and integration with existing directories or identities.
MFA	Multifactor authentication. Adds an extra layer of security to the authentication process.
API Key	Public/private key pair used to sign API calls made via SDK or CLI, proving the requester's identity.
OAuth 2.0 Token	Token used for authentication and authorization, allowing applications to access resources on behalf of the user.

2. Overview of Identity Domains

Identity Domain in OCI IAM is a logical container that represents a population of users in OCI, along with their associated configurations and security definitions. It can be understood as a self-contained identity and access management service used to address various IAM use cases.

Each identity domain functions as a container to manage:

• Users
• Groups
• Dynamic groups
• Roles
• Identity federation
• User provisioning from external directories
• Secure application integration via SSO
• Secure authentication with SAML and OAuth
• MFA and adaptive security

Furthermore, an identity domain is an OCI resource. Therefore, like other resources, it can be associated with a compartment and can have IAM policies written for it.

3. OCI IAM Identity Domain Types

Identity Domain Types

Type	Definition and Characteristics
Free / Default	Automatically created when you open an OCI account. Allows you to manage access to all OCI resources. Supports various authentication methods, but has a limit of 2,000 users. Not ideal for enterprise-level workforce management.
Oracle Apps	Linked to some Oracle services, such as SaaS, PaaS, GBU, or VBCS. Cannot be selected or created directly by the customer in the console, as it is associated with Oracle service teams.
Oracle Apps Premium	Can be selected in the console. Supports hybrid IAM scenarios, including proxies, gateways, and bridges. Extends IAM to on-premises or OCI-hosted Oracle applications, such as E-Business Suite, PeopleSoft, and databases. Allows adding non-Oracle applications, but with a limit of six applications.
Premium	Fully comprehensive type, with all features and no relevant restrictions. It has high limits on users, groups, and applications to meet business requirements. Compatible with hybrid scenarios. Suitable for those who want to use Oracle as an identity and access provider.
External User	Aimed at non-employees and consumer use cases. Suitable for contractors, partners, or public applications with a large volume of users. Supports social login, self-service, password management, and hybrid features.