Skip to main content
Oracle offers no read-only app role that covers everything this connection reads. Give the application the User Administrator app role. It reads users, groups, app roles and grants, and it can also change users, groups and grants. StackOne only reads. One connection reads one identity domain.

​
Find your Domain URL

The Domain URL is the address of the identity domain you want to connect. The identity domain ID is part of it.

1

Sign in to Oracle Cloud

Sign in to the Oracle Cloud Console as an identity domain administrator.

  • Open the navigation menu and select Identity & Security.
  • Under Identity, select Domains.
  • Select the identity domain you want to connect.
  • You may need to change the compartment to find it.
2

Copy the Domain URL

On the Domain information tab, view or copy the Domain URL.

  • Format: https://{identity domain ID}.identity.oraclecloud.com
  • Example: https://idcs-example.identity.oraclecloud.com
  • The host must look like idcs-example.identity.oraclecloud.com. A Domain URL on any other host does not work with this connection.
  • Paste the address as the console shows it. The connection always uses https.
  • Paste it into the Domain URL field in StackOne Hub.

​
Register a Confidential Application

The application signs in to your identity domain with its own Client ID and Client Secret, using the Client Credentials grant. It acts as itself, not as a user.

1

Add the application

In the identity domain, select Integrated applications, then select Add application.

  • In the Add application dialog box, select Confidential Application.
  • Select Launch workflow.
2

Name the application

On the Add application details page, enter an application name and a description, then select Next.

  • Name: StackOne Integration
  • If the page shows Submit instead of Next, select Submit. Then open the OAuth configuration tab, select Edit OAuth configuration, make the choices in the next two steps, and select Submit. Activate with Actions > Activate, then Activate application.
3

Choose the Client Credentials grant

On the Configure OAuth page, under Client configuration, select Configure this application as a client now.

  • Under Authorization, select only Client Credentials as the Allowed Grant Type.
4

Add the app role

At the bottom of the page, select Add app roles, then select Add roles.

  • In the Add app roles panel, select User Administrator, then select Add.
  • User Administrator reads users, groups, app roles and grants, which is everything this connection reads.
  • Audit Administrator, Security Administrator, User Manager and Help Desk Administrator are not documented to read app roles, so the connection test is expected to fail with any of them.
  • Identity Domain Administrator also works, but it gives full control of the identity domain, which this connection does not need.
5

Create the application

Select Next, then select Finish.

  • The Application added dialog box shows the Client ID and Client secret. Copy both and store them securely for use later, then select Close.
6

Activate the application

At the top of the application detail page, to the right of the application name, select Activate, then confirm the activation.

  • Oracle adds the application in a deactivated state.
7

Paste the Client ID and Client Secret

Paste the Client ID into the Client ID field and the Client Secret into the Client Secret field in StackOne Hub.

  • To see them again, open the application and scroll down to General Information.

​
Know how long access lasts

Oracle issues access tokens that usually last 3600 seconds (one hour). StackOne requests a new one when it expires. Oracle documents no expiry for the Client Secret.

​
Rotate or revoke access

To rotate the Client Secret, regenerate it, then paste the new one into the Client Secret field in StackOne Hub right away. Until you do, the connection still sends the old secret.

  • Navigate to Domains, select the identity domain, then select Integrated applications and select the application.
  • Select the OAuth configuration tab and select Regenerate secret, or select Regenerate in the General Information section.
  • Confirm your choice. The new secret appears in the New client secret dialog box. Copy it, then select Close.
  • To revoke access, delete the application. Oracle requires you to deactivate it first. In Integrated applications, open the Actions menu (three dots) next to the application, select Deactivate, then select Deactivate application. Open the Actions menu again, select Delete, then select Delete application.

​
Linking the Account from the Hub

1

Navigate to the Hub

Use one of the three Linking Account Methods to access the Hub.
2

Fill out the fields

Fill out the following fields using details from your provider:
  • Domain URL
  • Client ID
  • Client Secret
3

Connect

  • Click Connect
  • If applicable, the provider will redirect you to a sign-in or authorization page. Complete the provider’s authorization flow.
  • Once authorization is successful, you will see a confirmation popup

If the account linking is successful, you will see the newly linked account on your Accounts page.