Oracle Cloud Infrastructure IAM integration with Autonomous Database supports both database password authentication and token-based authentication. See Authenticating and Authorizing IAM Users for Oracle Autonomous Databases for complete details about the architecture for using IAM users on Autonomous Database.

Before using Identity and Access Management (IAM) authentication on Autonomous Database, you must ensure the following:

Describes the steps to change the external identity provider from (IAM) authentication and authorization to another external authentication provider and vice-versa.

Describes the steps to write policy statements for an IAM group to enable IAM user access to Oracle Cloud Infrastructure resources, specifically Autonomous Database instances.

1. Perform Oracle Cloud Infrastructure Identity and Access Management prerequisites by creating a group and adding users to the group.

   For example, create the group sales_dbusers.

   See Managing Groups for more information.

2. Write policy statements to enable access to Oracle Cloud Infrastructure resources.
   1. In the Oracle Cloud Infrastructure console click Identity & Security.
   2. Under Identity & Security click Policies.
   3. To a write policy, click Create Policy.
   4. On the Create Policy page, enter a Name and a Description.
   5. On the Create Policy page, select Show manual editor.
      
      
   6. Use the Policy Builder to create a policy.

      For example to create a policy to allow users in IAM group DBUsers to access any Autonomous Database in their tenancy:

      Allow group DBUsers to use autonomous-database-family in tenancy

      For example to create a policy that limits members of DBUsers group to access Autonomous Databases in compartment testing_compartment only:

      allow group DBUsers to use autonomous-database-family in compartment testing_compartment 

      For example to create a policy that limits group access to a single database in a compartment:

      allow group DBUsers to use autonomous-database-family in compartment testing_compartment where target.database.id = 'ocid1.autonomousdatabase.oc1.iad.aaaabbbbcccc'

      Refer to Creating an IAM Policy to Authorize Users Authenticating with Tokens in Database Security Guide for more information on IAM policies to access the database.

   7. Click Create.

      See Managing Policies for more information on policies.

To add IAM users to allow access to Autonomous Database, map database global users to IAM groups or users with CREATE USER or ALTER USER statements (with IDENTIFIED GLOBALLY AS clause).

1. Log in as the ADMIN user to the database that is enabled to use IAM (the ADMIN user has the required CREATE USER and ALTER USER system privileges that you need for these steps).
2. Create a mapping between the Autonomous Database user (schema) with CREATE USER or ALTER USER statements and include the IDENTIFIED GLOBALLY AS clause, specifying the IAM group name.

   Use the following syntax to map a global user to an IAM group:

   CREATE USER global_user IDENTIFIED GLOBALLY AS 'IAM_GROUP_NAME=IAM_GROUP_NAME';

   For example, to map an IAM group named db_sales_group to a shared database global user named sales_group:

   CREATE USER sales_group IDENTIFIED GLOBALLY AS
        'IAM_GROUP_NAME=db_sales_group';
   

   This creates a shared global user mapping. The mapping, with global user sales_group, is effective for all users in the IAM group. Thus, anyone in the db_sales_group can log in to the database using their IAM credentials (through the shared mapping of the sales_group global user).

   The following example shows how to accomplish this for a non-default domain:

   CREATE USER shared_sales_schema IDENTIFIED GLOBALLY AS
        'IAM_GROUP_NAME=sales_domain/db_sales_group';

3. If you want to create additional global user mappings for other IAM groups or users, follow these steps for each IAM group or user.

Optionally, create global roles to provide additional database roles and privileges to IAM users when multiple IAM users are mapped to the same shared global user.

1. Log in as the ADMIN user to the database that is enabled to use IAM (the ADMIN user has the required CREATE USER and ALTER USER system privileges that you need for these steps).
2. Set database authorization for Autonomous Database roles with CREATE ROLE or ALTER ROLE statements and include the IDENTIFIED GLOBALLY AS clause, specifying the IAM group name.

   Use the following syntax to map a global role to an IAM group:

   CREATE ROLE global_role IDENTIFIED GLOBALLY AS
       'IAM_GROUP_NAME=IAM_GROUP_of_WHICH_the_IAM_USER_IS_a_MEMBER';

   For example, to map an IAM group named ExporterGroup to a shared database global role named export_role:

   CREATE ROLE export_role IDENTIFIED GLOBALLY AS
        'IAM_GROUP_NAME=ExporterGroup';
   

   The following example shows how to create the role by specifying a non-default domain, sales_domain:

   CREATE ROLE export_role IDENTIFIED GLOBALLY AS
        'IAM_GROUP_NAME=sales_domain/ExporterGroup';
   

   All members of the ExporterGroup in the sales_domain domain will be authorized with the database global role export_role when they log in to the database.

3. Use GRANT statements to grant the required privileges or other roles to the global role.

   GRANT CREATE SESSION TO export_role;
   GRANT DWROLE TO export_role;

4. If you want an existing database role to be associated with an IAM group, then use ALTER ROLE statement to alter the existing database role to map the role to an IAM group. Use the following syntax to alter an existing database role to map it to an IAM group:

   ALTER ROLE existing_database_role 
      IDENTIFIED GLOBALLY AS 'IAM_GROUP_NAME=IAM_Group_Name';

To add an IAM user and allow the IAM user to login to Autonomous Database by supplying a username and password, you must create an IAM database password.

After the database ADMIN user maps global users and global roles to the IAM users and IAM groups, users log in to the Autonomous Database instance using their Oracle Cloud Infrastructure IAM credentials or access the database through an Oracle Cloud Infrastructure IAM database token.

You can still log in to the Autonomous Database using your local database account username and password (non-global database user account).

You can use a database client to access an Autonomous Database instance as an Oracle Cloud Infrastructure IAM user. To use a client with Oracle Cloud Infrastructure IAM username and password credentials and a password verifier, the database client must be 12c or newer.

You can configure SQL*Plus to use an IAM database password.

• As the IAM user, log in to the Autonomous Database instance by using the following syntax:

  CONNECT user_name@db_connect_string
  Enter password: password

  In this specification, user_name is the IAM user name. There is a limit of 128 bytes for the combined domain_name/user_name.

  The following example shows how IAM user peter_fitch can log in to an Autonomous Database instance.

  sqlplus /nolog
  connect peter_fitch@db_connect_string
  Enter password: password

  Some special characters will require double quotation marks around user_name and password. For example:

  "peter_fitch@example.com"@db_connect_string
  
  "IAM database password"

You can configure a client connection for SQL*Plus that uses an IAM token.

1. Ensure you have an IAM user account.
2. Check with an IAM administrator and an Oracle Database administrator to ensure you have a policy allowing you to access the database in the compartment or your tenancy and that you are mapped to a global schema in the database.
3. If your application or tool does not support direct IAM integration, then download, install, and configure the OCI CLI. (See OCI Command Line Interface Quickstart.) Set up an API key as part of the OCI CLI configuration and select default values.
   1. Set up the API key access for the IAM user.
   2. Retrieve the db-token. For example:
      • Retrieving a db-token with an API-key using the Oracle Cloud Infrastructure (OCI) command-line interface:

        oci iam db-token get

      • Retrieving a db-token with a security (or session) token:

        oci iam db-token get --auth security_token

        If the security token has expired, a window will appear so the user can log in to OCI again. This generates the security token for the user. OCI CLI will use this refreshed token to get the db-token.

      • Retrieving a db-token with a delegation token: When you log in to the cloud shell, the delegation token is automatically generated and placed in the /etc directory. To get this token, execute the following command in the cloud shell:

        oci iam db-token get

      • Retrieving an instance token by using the OCI command-line interface:

        oci iam db-token get --auth instance_principal

   3. The database client can also be configured to retrieve a database token using the IAM username and IAM database password.

      See Client Connections That Use a Token Requested by an IAM User Name and Database Password for more information.

   See Required Keys and OCIDs for more information.
4. Ensure that you are using the latest release updates for the Oracle Database client releases 19c and 21c.
   This configuration only works with the Oracle Database client release 19c or 21c.
5. Follow the existing process to download the wallet from the Autonomous Database and then follow the directions for configuring it for use with SQL*Plus.
   1. Confirm that DN matching is enabled by looking for SSL_SERVER_DN_MATCH=ON in sqlnet.ora.
   2. Configure the database client to use the IAM token by adding TOKEN_AUTH=OCI_TOKEN to the sqlnet.ora file. Because you will be using the default locations for the database token file, you do not need to include the token location.
   The TOKEN_AUTH and TOKEN_LOCATION values in the tnsnames.ora connect strings take precedence over the sqlnet.ora settings for that connection. For example, for the connect string, assuming that the token is in the default location (~/.oci/db-token for Linux):

   (description= 
     (retry_count=20)(retry_delay=3)
     (address=(protocol=tcps)(port=1522)
     (host=example.us-phoenix-1.oraclecloud.com))
     (connect_data=(service_name=aaabbbccc_exampledb_high.example.oraclecloud.com))
     (security=(ssl_server_cert_dn="CN=example.uscom-east-1.oraclecloud.com, 
        OU=Oracle BMCS US, O=Example Corporation, 
        L=Redwood City, ST=California, C=US")
     (TOKEN_AUTH=OCI_TOKEN)))
   

connect /@exampledb_high

connect /@(description= 
  (retry_count=20)(retry_delay=3)
  (address=(protocol=tcps)(port=1522)
  (host=example.us-phoenix-1.oraclecloud.com))
  (connect_data=(service_name=aaabbbccc_exampledb_high.example.oraclecloud.com))
  (security=(ssl_server_cert_dn="CN=example.uscom-east-1.oraclecloud.com, 
     OU=Oracle BMCS US, O=Example Corporation, 
     L=Redwood City, ST=California, C=US")
  (TOKEN_AUTH=OCI_TOKEN)))

After the ADMIN user enables Oracle Cloud Infrastructure IAM on Autonomous Database, an application can access the database through an Oracle Cloud Infrastructure IAM database token using an instance principal.

Proxy authentication allows an IAM user to proxy to a database schema for tasks such as application maintenance.

Proxy authentication is typically used to authenticate the real user and then authorize them to use a database schema with the schema privileges and roles in order to manage an application. Alternatives such as sharing the application schema password are considered insecure and unable to audit which actual user performed an action.

A use case can be in an environment in which a named IAM user who is an application database administrator can authenticate by using their credentials and then proxy to a database schema user (for example, hrapp). This authentication enables the IAM administrator to use the hrapp privileges and roles as user hrapp in order to perform application maintenance, yet still use their IAM credentials for authentication. An application database administrator can sign in to the database and then proxy to an application schema to manage this schema.

You can configure proxy authentication for both the password authentication and token authentication methods.

CONNECT peterfitch[hrapp]@connect_string
Enter password: password

CONNECT [hrapp]/@connect_string

You can use a database link to connect from one Autonomous Database instance to another as an Oracle Cloud Infrastructure IAM user.

Describes the steps to disable IAM external authentication user access for Autonomous Database.

ALTER SYSTEM RESET IDENTITY_PROVIDER_TYPE SCOPE=BOTH;

Provides notes for using Autonomous Database tools with IAM authentication enabled.