Skip to content

Commit 894e3ac

Browse files
authored
Merge pull request #1448 from oracle-devrel/oag-dbat-integration
OAG DBAT integration asset
2 parents a57c2af + 6148d26 commit 894e3ac

File tree

4 files changed

+274
-3
lines changed

4 files changed

+274
-3
lines changed

security/identity-and-access-management/oracle-access-governance/README.md

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
Access Governance is a cloud native identity governance and administration (IGA) service that provides enterprisewide visibility to govern access to cloud and on-premises environments. With an intuitive user experience, dynamic access control, and a prescriptive analytics-driven access review process, it helps customers automate access provisioning, get insights into access permission and cloud infrastructure policy reviews, identify anomalies, and remediate security risks.
44

5-
Reviewed: 28.10.2024
5+
Reviewed: 10.02.2025
66

77
# Useful Links
88

@@ -23,11 +23,17 @@ Reviewed: 28.10.2024
2323
## OAG Training & Live Labs
2424

2525
- [Cloud Coaching - Oracle Access Governance - Identity Governance and Access Reviews (Video)](https://www.youtube.com/watch?v=9reHN697x6g)
26-
- [Demo & Labs](https://luna.oracle.com/lab/6345863c-42c4-4f17-96fc-130278ac4b1f/steps)
26+
- [Demo & Labs](https://luna.oracle.com/lab/6345863c-42c4-4f17-96fc-130278ac4b1f/steps)
27+
28+
# Reusable Assets Overview
29+
30+
**Note:** The below assets are provided for reference purposes only and for use in demos/PoC activities where required.
31+
32+
- [DBAT OS Account Sample integration for OAG](dbat-os-accounts-sample/README.md)
2733

2834
# License
2935

30-
Copyright (c) 2024 Oracle and/or its affiliates.
36+
Copyright (c) 2025 Oracle and/or its affiliates.
3137

3238
Licensed under the Universal Permissive License (UPL), Version 1.0.
3339

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
Copyright (c) 2025 Oracle and/or its affiliates.
2+
3+
The Universal Permissive License (UPL), Version 1.0
4+
5+
Subject to the condition set forth below, permission is hereby granted to any
6+
person obtaining a copy of this software, associated documentation and/or data
7+
(collectively the "Software"), free of charge and under any and all copyright
8+
rights in the Software, and any and all patent rights owned or freely
9+
licensable by each licensor hereunder covering either (i) the unmodified
10+
Software as contributed to or provided by such licensor, or (ii) the Larger
11+
Works (as defined below), to deal in both
12+
13+
(a) the Software, and
14+
(b) any piece of software and/or hardware listed in the lrgrwrks.txt file if
15+
one is included with the Software (each a "Larger Work" to which the Software
16+
is contributed by such licensors),
17+
18+
without restriction, including without limitation the rights to copy, create
19+
derivative works of, display, perform, and distribute the Software and make,
20+
use, sell, offer for sale, import, export, have made, and have sold the
21+
Software and the Larger Work(s), and to sublicense the foregoing rights on
22+
either these or other terms.
23+
24+
This license is subject to the following condition:
25+
The above copyright notice and either this complete permission notice or at
26+
a minimum a reference to the UPL must be included in all copies or
27+
substantial portions of the Software.
28+
29+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
30+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
31+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
32+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
33+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
34+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
35+
SOFTWARE.
Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,108 @@
1+
# DBAT OS Accounts Sample
2+
3+
This asset contains the code and deployment steps required to integrate an Oracle Access Governance system with an Oracle Database for the purposes of trusted/target recon which simulates the granting of OS level access to POSIX hosts.
4+
5+
At the time of writing, this capability is not offered natively in OAG.
6+
7+
The described integration and data can be used for all supported user/account lifecycle operations in OAG, including use in access certification. Note that this simulates a connected system, therefore changes to OS level user access will be reflected in the targeted database tables.
8+
9+
Review Date: 10.02.2025
10+
11+
# When to use this asset?
12+
13+
Whenever a system that needs to be integrated with OAG does not have a natively supported connector, but can be easily modeled as data stored inside of database tables.
14+
15+
# How to use this asset?
16+
17+
## Pre-requisites and dependencies
18+
19+
The following components are required and assumed to already be available in this guide:
20+
- A Premium license Oracle Access Governance instance.
21+
- An Oracle Database installation or Oracle Autonomous Database instance (for supported database types and versions, please consult [the OAG integration documentation](https://docs.oracle.com/en/cloud/paas/access-governance/tatoi/index.html#GUID-8C827C87-8D8F-4FCB-9895-F370F25FEB00)).
22+
- A podman/docker installation for the OAG DBAT agent deployment. This installation can be performed on the same host as the Oracle Database, if preferred. Note that otherwise this system must have network access to the above Oracle Database deployment, for a direct DB connection.
23+
24+
## Deployment steps
25+
26+
Please ensure the requirements listed above have been satisfied.
27+
28+
**Once a database installation/instance is available** follow the below steps to deploy the provided sample SQL schema:
29+
30+
1. Connect to the database as dba (with sysdba role) and create a schema user for the purposes of the integration, by running:
31+
32+
```
33+
CREATE USER OAG IDENTIFIED BY <your_secure_password>
34+
DEFAULT TABLESPACE oagts
35+
TEMPORARY TABLESPACE temp QUOTA UNLIMITED ON oagts;
36+
37+
GRANT SELECT on dba_role_privs TO OAG;
38+
GRANT SELECT on dba_sys_privs TO OAG;
39+
GRANT SELECT on dba_ts_quotas TO OAG;
40+
GRANT SELECT on dba_tablespaces TO OAG;
41+
GRANT SELECT on dba_users TO OAG;
42+
GRANT CREATE USER TO OAG;
43+
GRANT ALTER ANY TABLE TO OAG;
44+
GRANT GRANT ANY PRIVILEGE TO OAG;
45+
GRANT GRANT ANY ROLE TO OAG;
46+
GRANT DROP USER TO OAG;
47+
GRANT SELECT on dba_roles TO OAG;
48+
GRANT SELECT ON dba_profiles TO OAG;
49+
GRANT ALTER USER TO OAG;
50+
GRANT CREATE ANY TABLE TO OAG;
51+
GRANT DROP ANY TABLE TO OAG;
52+
GRANT CREATE ANY PROCEDURE TO OAG;
53+
GRANT DROP ANY PROCEDURE TO OAG;
54+
```
55+
56+
2. Connect to the database as the newly create OAG user (using the password you've set with the above command), and execute the `OS_Account.sql` file. This will create all the quired table schema and populate it with sample data.
57+
58+
**In order to achieve the DBAT integration in Oracle Access Governance**, follow the below steps to create a new orchestrated system:
59+
60+
**Note:** The Connect URL format provided below is meant for pluggable databases using DB service names. Please adjust it as needed. All types of jdbc URL formats are supported, including basic SID-based URLs such as: `jdbc:oracle:thin:@hostname:port:SID`.
61+
62+
1. Go to **Service Administration -> Manage orchestrated systems**.
63+
2. Click on **+ Add an Orchestrated system**.
64+
3. In the **Select System** step, pick `Database Application Table (Oracle DB)`, and click on Next.
65+
4. In the **Enter Details** step, enter the details provided below. Optionally untick `This is the authoritative source for my identities.` should you want to create the identities through other means, otherwise, for the purposes of this example, the identities will be imported using data from the **OS_ACCOUNT** table. Click on Next.
66+
67+
```
68+
What do you want to call this system?: OS Account
69+
How do you want to describe this system: OS level user account
70+
```
71+
72+
5. Click on Confirm if you are using both authoritative and manager permission integration modes.
73+
6. In the **Add Owners** step, use the default values and click on Next.
74+
7. In the **Account Settings** step, use the default values and click on Next.
75+
8. In the **Integration** step, enter the following details, adjusted to your particular deployment settings. Leave the rest of the fields on their default values, and click on Add.
76+
77+
```
78+
Easy Connect URL for Oracle Database: jdbc:oracle:thin:@//hostname:port/dbservicename
79+
User Name: OAG
80+
Password: <your_secure_password>
81+
Confirm password: <your_secure_password>
82+
User account table name: OS_ACCOUNT
83+
Permissions tables: OS_HOST
84+
Account permission tables: OS_ACCOUNT_HOST
85+
Lookup tables: OS_COUNTRY
86+
Key column mappings: OS_ACCOUNT:USERID,OS_HOST:HOSTID,OS_COUNTRY:COUNTRYCODE
87+
Name column mappings: OS_ACCOUNT:USERNAME,OS_HOST:HOSTNAME,OS_COUNTRY:COUNTRYNAME
88+
User account table password column mapping: OS_ACCOUNT:PASSWORD
89+
User account table status column mapping: OS_ACCOUNT:STATUS
90+
```
91+
92+
9. On the **Finish up** step, first click on the `Download` link and save the agent package, then select `Activate and prepare the data load with the provided defaults` and click on I'm done.
93+
10. Use the downloaded `OS_Account.zip` archive to deploy the OAG agent as per the steps covered in [this guide](https://docs.oracle.com/en/cloud/paas/access-governance/lllho/index.html#GUID-67A8B48F-9358-4B95-A36C-5871E3726FAB). Once the agent is deployed and started, it will automatically validate the configurations and import the data into OAG, and you can start using the integration.
94+
95+
Please also see the useful link below for more detailed deployment steps.
96+
97+
# Useful Links
98+
99+
[Identity Orchestration: Unifying Diverse Systems for Seamless Identity Governance and Management](https://docs.oracle.com/en/cloud/paas/access-governance/seihs/#articletitle)
100+
[Integrate with Database Application Tables (Oracle)](https://docs.oracle.com/en/cloud/paas/access-governance/bdato/#articletitle)
101+
102+
# License
103+
104+
Copyright (c) 2025 Oracle and/or its affiliates.
105+
106+
Licensed under the Universal Permissive License (UPL), Version 1.0.
107+
108+
See [LICENSE](https://github.com/oracle-devrel/technology-engineering/blob/main/LICENSE) for more details.
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
/*******************************************************************************
2+
* Copyright (c) 2025 Oracle and/or its affiliates. All rights reserved. DO NOT
3+
* ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+
*
5+
* The Universal Permissive License (UPL), Version 1.0
6+
*
7+
* Subject to the condition set forth below, permission is hereby granted to any
8+
* person obtaining a copy of this software, associated documentation and/or
9+
* data (collectively the "Software"), free of charge and under any and all
10+
* copyright rights in the Software, and any and all patent rights owned or
11+
* freely licensable by each licensor hereunder covering either (i) the
12+
* unmodified Software as contributed to or provided by such licensor, or (ii)
13+
* the Larger Works (as defined below), to deal in both
14+
*
15+
* (a) the Software, and
16+
*
17+
* (b) any piece of software and/or hardware listed in the lrgrwrks.txt file if
18+
* one is included with the Software each a "Larger Work" to which the Software
19+
* is contributed by such licensors),
20+
*
21+
* without restriction, including without limitation the rights to copy, create
22+
* derivative works of, display, perform, and distribute the Software and make,
23+
* use, sell, offer for sale, import, export, have made, and have sold the
24+
* Software and the Larger Work(s), and to sublicense the foregoing rights on
25+
* either these or other terms.
26+
*
27+
* This license is subject to the following condition:
28+
*
29+
* The above copyright notice and either this complete permission notice or at a
30+
* minimum a reference to the UPL must be included in all copies or substantial
31+
* portions of the Software.
32+
*
33+
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
34+
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
35+
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
36+
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
37+
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
38+
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
39+
* SOFTWARE.
40+
*******************************************************************************/
41+
42+
CREATE TABLE OS_COUNTRY
43+
(COUNTRYCODE VARCHAR2(32 BYTE) NOT NULL ENABLE,
44+
COUNTRYNAME VARCHAR2(255 BYTE) NOT NULL ENABLE,
45+
CONSTRAINT OSCOUNTRY_PK PRIMARY KEY (COUNTRYCODE));
46+
47+
CREATE TABLE OS_ACCOUNT
48+
(USERID VARCHAR2(255 BYTE) NOT NULL ENABLE,
49+
USERNAME VARCHAR2(255 BYTE) NOT NULL ENABLE,
50+
FIRSTNAME VARCHAR2(255 BYTE),
51+
LASTNAME VARCHAR2(255 BYTE),
52+
PASSWORD VARCHAR2(255 BYTE),
53+
EMAIL VARCHAR2(255 BYTE) NOT NULL ENABLE,
54+
PROVISIONDATE DATE,
55+
STATUS VARCHAR2(32 BYTE),
56+
COUNTRYCODE VARCHAR2(32 BYTE),
57+
CONSTRAINT OSACCOUNT_PK PRIMARY KEY (USERID),
58+
CONSTRAINT OSCOUNTRY_FK FOREIGN KEY(COUNTRYCODE) REFERENCES OS_COUNTRY(COUNTRYCODE) ON DELETE CASCADE);
59+
60+
CREATE TABLE OS_HOST
61+
(HOSTID VARCHAR2(255 BYTE) NOT NULL ENABLE,
62+
HOSTNAME VARCHAR2(255 BYTE) NOT NULL ENABLE,
63+
CONSTRAINT OSHOSTS_PK PRIMARY KEY (HOSTID));
64+
65+
CREATE TABLE OS_ACCOUNT_HOST
66+
(USERID VARCHAR2(255 BYTE) NOT NULL ENABLE,
67+
HOSTID VARCHAR2(255 BYTE) NOT NULL ENABLE,
68+
CONSTRAINT OSACCOUNTHOST_PK PRIMARY KEY (USERID, HOSTID),
69+
CONSTRAINT OSACCOUNT_FK FOREIGN KEY(USERID) REFERENCES OS_ACCOUNT(USERID) ON DELETE CASCADE,
70+
CONSTRAINT OSHOST_FK FOREIGN KEY(HOSTID) REFERENCES OS_HOST(HOSTID) ON DELETE CASCADE);
71+
72+
/* NOTE: Below entries are provided as sample/reference only.
73+
Included names and dates are randomly generated and used fictitiously.
74+
Any resemblance to locales or persons, living or dead, is entirely coincidental. */
75+
76+
INSERT INTO OS_COUNTRY (COUNTRYCODE,COUNTRYNAME) values ('DE', 'Germany');
77+
INSERT INTO OS_COUNTRY (COUNTRYCODE,COUNTRYNAME) values ('AT', 'Austria');
78+
INSERT INTO OS_COUNTRY (COUNTRYCODE,COUNTRYNAME) values ('CH', 'Switzerland');
79+
80+
INSERT INTO OS_ACCOUNT (USERID,USERNAME,FIRSTNAME,LASTNAME,PASSWORD,EMAIL,PROVISIONDATE,STATUS,COUNTRYCODE) values ('BFRANK','BFRANK','Bernd','Frank',,'[email protected]',to_date('24-OCT-24','DD-MON-RR'),'ACTIVE','DE');
81+
INSERT INTO OS_ACCOUNT (USERID,USERNAME,FIRSTNAME,LASTNAME,PASSWORD,EMAIL,PROVISIONDATE,STATUS,COUNTRYCODE) values ('DSTAUSS','DSTAUSS','Dirk','Stauss',,'[email protected]',to_date('24-OCT-24','DD-MON-RR'),'ACTIVE','AT');
82+
INSERT INTO OS_ACCOUNT (USERID,USERNAME,FIRSTNAME,LASTNAME,PASSWORD,EMAIL,PROVISIONDATE,STATUS,COUNTRYCODE) values ('DJONES','DJONES','Dora','Jones',,'[email protected]',to_date('24-OCT-24','DD-MON-RR'),'ACTIVE','DE');
83+
INSERT INTO OS_ACCOUNT (USERID,USERNAME,FIRSTNAME,LASTNAME,PASSWORD,EMAIL,PROVISIONDATE,STATUS,COUNTRYCODE) values ('EBRANDT','EBRANDT','Ewald','Brandt',,'[email protected]',to_date('24-OCT-24','DD-MON-RR'),'ACTIVE','CH');
84+
INSERT INTO OS_ACCOUNT (USERID,USERNAME,FIRSTNAME,LASTNAME,PASSWORD,EMAIL,PROVISIONDATE,STATUS,COUNTRYCODE) values ('GKLEIN','GKLEIN','Gerrit','Klein',,'[email protected]',to_date('24-OCT-24','DD-MON-RR'),'ACTIVE','DE');
85+
INSERT INTO OS_ACCOUNT (USERID,USERNAME,FIRSTNAME,LASTNAME,PASSWORD,EMAIL,PROVISIONDATE,STATUS,COUNTRYCODE) values ('GVOGT','GVOGT','Gitta','Vogt',,'[email protected]',to_date('24-OCT-24','DD-MON-RR'),'ACTIVE','CH');
86+
INSERT INTO OS_ACCOUNT (USERID,USERNAME,FIRSTNAME,LASTNAME,PASSWORD,EMAIL,PROVISIONDATE,STATUS,COUNTRYCODE) values ('HSCHUMACHER','HSCHUMACHER','Helene','Schumacher',,'[email protected]',to_date('24-OCT-24','DD-MON-RR'),'ACTIVE','DE');
87+
INSERT INTO OS_ACCOUNT (USERID,USERNAME,FIRSTNAME,LASTNAME,PASSWORD,EMAIL,PROVISIONDATE,STATUS,COUNTRYCODE) values ('LSCHULTE','LSCHULTE','Lothur','Schulte',,'[email protected]',to_date('24-OCT-24','DD-MON-RR'),'ACTIVE','AT');
88+
INSERT INTO OS_ACCOUNT (USERID,USERNAME,FIRSTNAME,LASTNAME,PASSWORD,EMAIL,PROVISIONDATE,STATUS,COUNTRYCODE) values ('LDERICHS','LDERICHS','Lutz','Derichs',,'[email protected]',to_date('24-OCT-24','DD-MON-RR'),'ACTIVE','AT');
89+
INSERT INTO OS_ACCOUNT (USERID,USERNAME,FIRSTNAME,LASTNAME,PASSWORD,EMAIL,PROVISIONDATE,STATUS,COUNTRYCODE) values ('RPROTZ','RPROTZ','Rosemarie','Protz',,'[email protected]',to_date('24-OCT-24','DD-MON-RR'),'ACTIVE','DE');
90+
INSERT INTO OS_ACCOUNT (USERID,USERNAME,FIRSTNAME,LASTNAME,PASSWORD,EMAIL,PROVISIONDATE,STATUS,COUNTRYCODE) values ('WSCHUBERT','WSCHUBERT','Wolf','Schubert',,'[email protected]',to_date('24-OCT-24','DD-MON-RR'),'ACTIVE','DE');
91+
92+
INSERT INTO OS_HOST (HOSTID,HOSTNAME) values ('host001','unixhost1');
93+
INSERT INTO OS_HOST (HOSTID,HOSTNAME) values ('host002','unixhost2');
94+
INSERT INTO OS_HOST (HOSTID,HOSTNAME) values ('host003','linuxhost1');
95+
INSERT INTO OS_HOST (HOSTID,HOSTNAME) values ('host004','linuxhost2');
96+
97+
INSERT INTO OS_ACCOUNT_HOST (USERID,HOSTID) values ('BFRANK','host001');
98+
INSERT INTO OS_ACCOUNT_HOST (USERID,HOSTID) values ('BFRANK','host002');
99+
INSERT INTO OS_ACCOUNT_HOST (USERID,HOSTID) values ('BFRANK','host003');
100+
INSERT INTO OS_ACCOUNT_HOST (USERID,HOSTID) values ('DJONES','host001');
101+
INSERT INTO OS_ACCOUNT_HOST (USERID,HOSTID) values ('DJONES','host002');
102+
INSERT INTO OS_ACCOUNT_HOST (USERID,HOSTID) values ('DJONES','host003');
103+
INSERT INTO OS_ACCOUNT_HOST (USERID,HOSTID) values ('DSTAUSS','host001');
104+
INSERT INTO OS_ACCOUNT_HOST (USERID,HOSTID) values ('DSTAUSS','host003');
105+
INSERT INTO OS_ACCOUNT_HOST (USERID,HOSTID) values ('EBRANDT','host001');
106+
INSERT INTO OS_ACCOUNT_HOST (USERID,HOSTID) values ('EBRANDT','host003');
107+
INSERT INTO OS_ACCOUNT_HOST (USERID,HOSTID) values ('GKLEIN','host001');
108+
INSERT INTO OS_ACCOUNT_HOST (USERID,HOSTID) values ('GKLEIN','host003');
109+
INSERT INTO OS_ACCOUNT_HOST (USERID,HOSTID) values ('GKLEIN','host004');
110+
INSERT INTO OS_ACCOUNT_HOST (USERID,HOSTID) values ('GVOGT','host001');
111+
INSERT INTO OS_ACCOUNT_HOST (USERID,HOSTID) values ('GVOGT','host003');
112+
INSERT INTO OS_ACCOUNT_HOST (USERID,HOSTID) values ('HSCHUMACHER','host001');
113+
INSERT INTO OS_ACCOUNT_HOST (USERID,HOSTID) values ('HSCHUMACHER','host003');
114+
INSERT INTO OS_ACCOUNT_HOST (USERID,HOSTID) values ('LDERICHS','host001');
115+
INSERT INTO OS_ACCOUNT_HOST (USERID,HOSTID) values ('LDERICHS','host003');
116+
INSERT INTO OS_ACCOUNT_HOST (USERID,HOSTID) values ('LSCHULTE','host001');
117+
INSERT INTO OS_ACCOUNT_HOST (USERID,HOSTID) values ('LSCHULTE','host003');
118+
INSERT INTO OS_ACCOUNT_HOST (USERID,HOSTID) values ('RPROTZ','host001');
119+
INSERT INTO OS_ACCOUNT_HOST (USERID,HOSTID) values ('RPROTZ','host003');
120+
INSERT INTO OS_ACCOUNT_HOST (USERID,HOSTID) values ('RPROTZ','host004');
121+
INSERT INTO OS_ACCOUNT_HOST (USERID,HOSTID) values ('WSCHUBERT','host001');
122+
INSERT INTO OS_ACCOUNT_HOST (USERID,HOSTID) values ('WSCHUBERT','host003');

0 commit comments

Comments
 (0)