> ## Documentation Index
> Fetch the complete documentation index at: https://docs.stackone.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect Oracle Identity Domains with OAuth 2.0 (Client Credentials) – StackOne Hub

> Link a Oracle Identity Domains account in the StackOne Hub using OAuth 2.0 (Client Credentials). End-user guide to authorize the integration and start using Oracle Identity Domains actions.

> [!WARNING]
>
> Oracle offers no read-only app role that covers everything this connection reads. Give the application the **User Administrator** app role. It reads users, groups, app roles and grants, and it can also change users, groups and grants. StackOne only reads. One connection reads one identity domain.

## Find your Domain URL

The **Domain URL** is the address of the identity domain you want to connect. The identity domain ID is part of it.

**1. Sign in to Oracle Cloud**

Sign in to the [Oracle Cloud Console](https://cloud.oracle.com) as an identity domain administrator.

<ul>
  <li>Open the navigation menu and select **Identity & Security**.</li>
  <li>Under **Identity**, select **Domains**.</li>
  <li>Select the identity domain you want to connect.</li>
  <li>You may need to change the compartment to find it.</li>
</ul>

**2. Copy the Domain URL**

On the **Domain information** tab, view or copy the **Domain URL**.

<ul>
  <li>Format: `https://{identity domain ID}.identity.oraclecloud.com`</li>
  <li>Example: `https://idcs-example.identity.oraclecloud.com`</li>
  <li>The host must look like `idcs-example.identity.oraclecloud.com`. A Domain URL on any other host does not work with this connection.</li>
  <li>Paste the address as the console shows it. The connection always uses https.</li>
  <li>Paste it into the **Domain URL** field in StackOne Hub.</li>
</ul>

## Register a Confidential Application

The application signs in to your identity domain with its own Client ID and Client Secret, using the Client Credentials grant. It acts as itself, not as a user.

**1. Add the application**

In the identity domain, select **Integrated applications**, then select **Add application**.

<ul>
  <li>In the **Add application** dialog box, select **Confidential Application**.</li>
  <li>Select **Launch workflow**.</li>
</ul>

**2. Name the application**

On the **Add application details** page, enter an application name and a description, then select **Next**.

<ul>
  <li>Name: `StackOne Integration`</li>
  <li>If the page shows **Submit** instead of **Next**, select **Submit**. Then open the **OAuth configuration** tab, select **Edit OAuth configuration**, make the choices in the next two steps, and select **Submit**. Activate with **Actions** > **Activate**, then **Activate application**.</li>
</ul>

**3. Choose the Client Credentials grant**

On the **Configure OAuth** page, under **Client configuration**, select **Configure this application as a client now**.

<ul>
  <li>Under **Authorization**, select only **Client Credentials** as the **Allowed Grant Type**.</li>
</ul>

**4. Add the app role**

At the bottom of the page, select **Add app roles**, then select **Add roles**.

<ul>
  <li>In the **Add app roles** panel, select **User Administrator**, then select **Add**.</li>
  <li>**User Administrator** reads users, groups, app roles and grants, which is everything this connection reads.</li>
  <li>**Audit Administrator**, **Security Administrator**, **User Manager** and **Help Desk Administrator** are not documented to read app roles, so the connection test is expected to fail with any of them.</li>
  <li>**Identity Domain Administrator** also works, but it gives full control of the identity domain, which this connection does not need.</li>
</ul>

**5. Create the application**

Select **Next**, then select **Finish**.

<ul>
  <li>The **Application added** dialog box shows the **Client ID** and **Client secret**. Copy both and store them securely for use later, then select **Close**.</li>
</ul>

**6. Activate the application**

At the top of the application detail page, to the right of the application name, select **Activate**, then confirm the activation.

<ul>
  <li>Oracle adds the application in a deactivated state.</li>
</ul>

**7. Paste the Client ID and Client Secret**

Paste the Client ID into the **Client ID** field and the Client Secret into the **Client Secret** field in StackOne Hub.

<ul>
  <li>To see them again, open the application and scroll down to **General Information**.</li>
</ul>

## Know how long access lasts

Oracle issues access tokens that usually last 3600 seconds (one hour). StackOne requests a new one when it expires. Oracle documents no expiry for the Client Secret.

## Rotate or revoke access

To rotate the Client Secret, regenerate it, then paste the new one into the **Client Secret** field in StackOne Hub right away. Until you do, the connection still sends the old secret.

<ul>
  <li>Navigate to **Domains**, select the identity domain, then select **Integrated applications** and select the application.</li>
  <li>Select the **OAuth configuration** tab and select **Regenerate secret**, or select **Regenerate** in the **General Information** section.</li>
  <li>Confirm your choice. The new secret appears in the **New client secret** dialog box. Copy it, then select **Close**.</li>
  <li>To revoke access, delete the application. Oracle requires you to deactivate it first. In **Integrated applications**, open the **Actions** menu (three dots) next to the application, select **Deactivate**, then select **Deactivate application**. Open the **Actions** menu again, select **Delete**, then select **Delete application**.</li>
</ul>

## Linking the Account from the Hub

**1. Navigate to the Hub**

Use one of the three [Linking Account Methods](https://docs.stackone.com/connect/managing-connectors/linking-accounts.md) to access the Hub.

**2. Fill out the fields**

Fill out the following fields using details from your provider:

<ul>
  <li>**Domain URL**</li>
  <li>**Client ID**</li>
  <li>**Client Secret**</li>
</ul>

**3. Connect**

<ul>
  <li>Click **Connect**</li>
  <li>If applicable, the provider will redirect you to a sign-in or authorization page. Complete the provider's authorization flow.</li>
  <li>Once authorization is successful, you will see a confirmation popup</li>
</ul>

If the account linking is successful, you will see the newly linked account on your [Accounts](https://app.stackone.com/accounts) page.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.