Recent Posts by Kiran Thakkar

In the last few months, I ran into several Oracle SaaS and PaaS customers that use both Okta and Identity Cloud Service for various use cases. While working with those customers, I figured that we did not have automated users/groups provisioning supported by Okta.  As I worked on the integration myself, I figured that there is some incompatibility between Okta and IDCS's SCIM implementation for Group membership management. I came up with a solution to put proxy between Okta...

Overview In the last couple of weeks, few customers asked me about using compute instance metadata to update SSH keys for user authentication. I knew Oracle Cloud Infrastructure supported that. However, there is no blog that talks about the step-by-step process to make it work. There we go. I found the topic for my next blog. "Using AuthorizedKeysCommand on OCI Compute." First of all, thanks for your overwhelming support. The number of unique views on my blogs increased by more...

Overview Oracle has never been more committed to customer success. To enable customers' success, we are releasing more services and features every day. Secrets management is the new feather in the cap. As part of the Oracle Cloud Infrastructure Vault, we can now manage both secrets and keys. Secrets are credentials such as passwords, certificates, SSH keys, or authentication tokens for third-party cloud services that you use with Oracle Cloud Infrastructure services. Storing...

Overview Cloud has fueled business growth like no other technology in the past. Opening a new data center or starting a new business on the web is easier than ever before. While that has helped companies, it has also strengthened competition. User experience is of paramount importance. Businesses are going global, and they are using the internet as the growth engine. The ability of companies to serve their users better determines whether or not they are successful. One of the...

Overview As a follow up on my last blog about invoking OCI function from Event, I am happy to announce that OCI now supports calling OCI functions from OCI Notifications. This is a huge value add because the event, as I mentioned in my last blog post, is triggered by OCI when a new OCI resource is created/removed or when there is a change in the state of an OCI resource. While that is valuable in governance context and you can implement some use cases using object storage, you...

Overview In the cloud era, the key metric is speed. That, in combination with a self-service model (every service team owns their little space on the cloud), leads to a less secure cloud. Some of the examples are, Creation of compute instance with public IP  Creation of public bucket Termination of a compute instance in PROD environment Creation or deletion of API key Route table or Security List changes To be agile, you want users to be able to perform all of the above actions....

Identity is the new perimeter. Sounds familiar? In a traditional on-prem world, all the workload had one thing in common. They were all part of a large private network. You could shield that common attack vector (network) with strong security policies using both Web Application Firewall (WAF) and network firewall. As the workload moved to cloud, it moved to a lot of different cloud providers some SaaS and some Iaas_PaaS. In such a distributed world, the network is no more...

Overview IDCS (Identity Cloud Service) is Oracle's next-gen Identity solution built in the cloud for the cloud. It is fully standards-compliant and implements various standards like SAML (Security Assertion Markup Language), OAuth, OIDC (OpenID Connect), etc. Those standards help customers integrate with other products implementing that same standard. One use case that I came across, a few times recently, is integrating Okta as Identity Provider to IDCS using SAML. I thought I...

Overview As more and more customers move Identity to the cloud, we will run into applications that cannot be migrated in short term or cannot be migrated at all to cloud for various reasons including security. That leads to the question, how do we integrate those on-prem applications to cloud Identity solution? There are a few common patterns to integrate an application to central IDAM (IDentity and Access Management) solution (not to suggest that these are the only possible...