Recent Posts by Paulo Albuquerque

Introduction The Multi-Factor Authentication part I post described the initial MFA configuration, the enrollment process and second factor authentication with the Mobile Authenticator One-Time Password. In this second post, we will go over the other factors: security questions, notifications, text messages and bypass code – and the additional security constraints for MFA in general. Multi-Factor Authentication Settings In the first post we already discussed the basic...

Introduction Oracle Identity Cloud Service (IDCS) has just released version 17.2.2 in May/2017 and with it a cool new feature: Multi-Factor Authentication, or in short, MFA. MFA is a method of authentication that requires the user to present more than one piece of evidence - or factors: one-time pass codes, SMS, security questions, etc - to an authentication mechanism before being granted access. As users becomes more connected, accessing their accounts from anywhere and from...

Introduction Federation is a well-known pattern and has been discussed at length on this blog. Almost every vendor or cloud provider out there supports Federation and it’s been around for quite some time now. In this blog post, I will talk about Federation again, but this time in combination with Weblogic's Virtual Users and Groups. What that means, in practical terms, is that users and groups won’t have to be synchronized between the Identity Provider (Oracle Identity Cloud...

Introduction Companies usually have some Identity and Access Management solution deployed on premises to manage users and roles to secure access to their corporate applications. As business move to the cloud, companies will, most likely, want to leverage the investment already made into such IAM solutions and integrate them with the new SaaS or PaaS applications that are being added to their portfolio. Oracle Public Cloud and its Shared Identity Management services (SIM)...

Introduction This post is part of a series of posts about OAM's OAuth implementation. Other posts can be found here: Part I - explains the proposed architecture and how to enable and configure OAM OAuth Services. Part II - describes a Business to Business use-case (2-legged flow); Part III  - deals with the Customer to Business use-case (3-legged flow), when the client code is running in the application server; Part IV - describes the Customer to Business use-case (3-legged flow),...

Introduction This post is part IV of a series of posts about OAM's OAuth implementation. Other posts can be found here: Part I - explains the proposed architecture and how to enable and configure OAM OAuth Services. Part II - describes a Business to Business use-case (2-legged flow); Part III  - deals with the Customer to Business use-case (3-legged flow), when the client code is running in the application server; Part IV - describes the Customer to Business use-case (3-legged...

Introduction This post is part III of a serie of posts about OAM's OAuth implementation. Other posts can be found here: Part I - explains the proposed architecture and how to enable and configure OAM OAuth Services. Part II - describes a Business to Business use-case (2-legged flow); Part III  - deals with the Customer to Business use-case (3-legged flow), when the client code is running in the application server; Part IV - describes the Customer to Business use-case (3-legged...

Introduction This post is part II of a series of posts about OAM's OAuth implementation. Other posts can be found here: Part I - explains the proposed architecture and how to enable and configure OAM OAuth Services. Part II - describes a Business to Business use-case (2-legged flow); Part III  - deals with the Customer to Business use-case (3-legged flow), when the client code is running in the application server; Part IV - describes the Customer to Business use-case (3-legged...

Introduction This post will explain the basics of OAuth 2.0 and how it can be used to protect resources by implementing some of the most common OAuth use cases. OAM provides out of the box OAuth Services, which allows a Client Application to access protected resources that belong to an end-user (that is, the Resource Owner). Before going further in this post, check out the OAuth2 specification, to understand the basic OAuth concepts, as it won’t be covered in this post. This post...