> For the complete documentation index, see [llms.txt](https://docs.openiam.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.openiam.com/connector-configuration/oracle-idcs.md).

# Oracle IDCS connector

Configure the Oracle IDCS connector to provision users to Oracle Identity Cloud Service using OAuth2 client credentials.

The **Oracle IDCS connector** (`oracle-idcs-connector-rabbitmq`) provisions users to **Oracle Identity Cloud Service (IDCS)** — Oracle's cloud identity service — over its REST API. It authenticates with **OAuth2 client credentials**: the connector requests a token from the IDCS `/oauth2/v1/token` endpoint (scope `urn:opc:idm:__myscopes__`) and sends it as a bearer token on every call.

| Operation                                | Supported                                                                                           |
| ---------------------------------------- | --------------------------------------------------------------------------------------------------- |
| Create / update user (Save)              | ✅                                                                                                   |
| Delete user                              | ✅                                                                                                   |
| Suspend / resume user                    | ✅                                                                                                   |
| Reset password                           | ✅                                                                                                   |
| Search users                             | ✅                                                                                                   |
| Test connection                          | ✅                                                                                                   |
| Login                                    | ❌ Not implemented in the current connector                                                          |
| Group provisioning (as separate objects) | ❌ Not implemented — the connector reads IDCS groups for membership, but does not create/delete them |

{% hint style="info" %}
**Which Oracle connector do I need?** OpenIAM ships three: **Oracle RDBMS** (database accounts — see [Oracle connector](/connector-configuration/oracle.md)), **Oracle EBS** (E-Business Suite — see [Oracle EBS connector](/connector-configuration/oracleebs.md)), and **Oracle IDCS** (this page — the cloud identity service).
{% endhint %}

## Use cases

* Full **user-lifecycle provisioning to Oracle IDCS** — create, update, suspend/resume, password reset, and removal.
* **Importing IDCS users** (with group memberships) into OpenIAM via synchronization.
* **Not** a fit for managing IDCS groups as objects — group create/delete is not implemented.

## Versions and compatibility

The end application is **Oracle Identity Cloud Service**, reached over its SCIM-based administration API. The connector targets **version 1** of that API and authenticates with OAuth 2.0.

<table><thead><tr><th width="169">Property</th><th>Value</th></tr></thead><tbody><tr><td><strong>Platform</strong></td><td>Oracle Identity Cloud Service (IDCS)</td></tr><tr><td><strong>Interface</strong></td><td>IDCS administration API <code>/admin/v1</code>, SCIM-shaped, over HTTPS</td></tr><tr><td><strong>Host</strong></td><td>The managed system's URL, your IDCS tenant</td></tr><tr><td><strong>Authentication</strong></td><td>OAuth 2.0, <code>/oauth2/v1/token</code></td></tr><tr><td><strong>Resources</strong></td><td><code>/admin/v1/Users</code> and <code>/admin/v1/Groups</code>, with SCIM <code>.search</code> for queries</td></tr></tbody></table>

{% hint style="info" %}
Because the API is SCIM-shaped, searches are POSTed to a `.search` sub-resource rather than passed as query parameters. This matters when you are reading IDCS logs to debug a synchronization: the connector's lookups appear as POSTs, not GETs.
{% endhint %}

## Prerequisites

* An IDCS **confidential application** registered in the IDCS admin console with the **client credentials** grant, granted the Identity Domain Administrator (or equivalent user-management) role. Note its **client ID** and **client secret**.
* Network access from the connector host to your IDCS instance (`https://idcs-<tenant>.identity.oraclecloud.com`, HTTPS).

## Installing the connector

### Kubernetes

In Kubernetes deployments, the connector is deployed as part of OpenIAM — enable it in your deployment configuration; no separate installation is required.

### RPM

Run the connector JAR directly:

{% code overflow="wrap" %}

```bash
java -Dlogging.level.root=INFO -Dconfpath=/data/openiam/ -jar oracle-idcs-connector-rabbitmq.jar > oracle-idcs.out &
```

{% endcode %}

Or, when managed by systemd, use the connector service unit (`openiam-connector@oracle-idcs-connector-rabbitmq`). To deploy on a separate host, see [Connectors via RPM](/installation/rpm/rpm-single-node/add-a-connector.md).

## Starting, stopping, and restarting

<table><thead><tr><th width="158">Deployment</th><th>Commands</th></tr></thead><tbody><tr><td>RPM (systemd)</td><td><code>systemctl start|stop|restart openiam-connector@oracle-idcs-connector-rabbitmq</code></td></tr><tr><td>RPM (manual)</td><td>Start with the <code>java -jar</code> command above; stop by killing the process.</td></tr><tr><td>Kubernetes</td><td><code>kubectl rollout restart</code> the connector deployment.</td></tr></tbody></table>

## Command-line parameters and properties

The connector is a Spring Boot application. Its defaults ship inside the jar, and you override them in either of two places:

* **An external property file**, read at `${confpath}/conf/properties/oracle-idcs-connector-rabbitmq.properties`. The file is optional, and `confpath` is itself a system property, set with `-Dconfpath=/data/openiam/`.
* **Directly on the command line**, as `-D` arguments, which win over the file.

{% code overflow="wrap" %}

```bash
java -Dconfpath=/data/openiam/ -Dlogging.level.root=INFO -Dorg.openiam.connector.queue=ORACLE_IDCS_Connector_1_Request -jar oracle-idcs-connector-rabbitmq.jar
```

{% endcode %}

| Property                                  | Default                                 |
| ----------------------------------------- | --------------------------------------- |
| `org.openiam.connector.queue`             | `ORACLE_IDCS_Connector_1_Request`       |
| `org.openiam.connector.queueResponseName` | `ORACLE_IDCS_Connector_1_Response`      |
| `org.openiam.connector.name` / `.type`    | `Oracle IDCS` / `Oracle IDCS Connector` |

The connection details themselves are **not** set here — they are managed system parameters, covered under [Configuring the managed system](#configuring-the-managed-system).

## Verifying the connector is running

{% stepper %}
{% step %}
In the Webconsole, open the managed system — the **Running connector status** indicator must be green.
{% endstep %}

{% step %}
Click **Test Connection** — it must return success.
{% endstep %}

{% step %}
In the RabbitMQ management console, confirm the `ORACLE_IDCS_Connector_1_Request` queue exists and has a consumer.
{% endstep %}

{% step %}
Check the connector log for startup errors.
{% endstep %}
{% endstepper %}

## Troubleshooting

| Symptom                              | Likely cause                                                          | Resolution                                                                           |
| ------------------------------------ | --------------------------------------------------------------------- | ------------------------------------------------------------------------------------ |
| Connector never receives messages    | Queue-name mismatch                                                   | The connector record's queue must equal `ORACLE_IDCS_Connector_1_Request` exactly.   |
| Token request fails                  | Wrong client ID/secret, or the app lacks the client-credentials grant | Verify the confidential application's configuration and the Login/Password fields.   |
| Operations fail with `403` from IDCS | The application lacks the user-management role                        | Grant the Identity Domain Administrator (or equivalent) role to the app.             |
| Group create/delete does nothing     | Group-object operations are not implemented                           | Expected — manage IDCS groups in IDCS; the connector reads them for membership only. |

See also: [general connector troubleshooting](/connector-configuration/4-troubleshootingconnector.md) and the [connector error-code reference](/connector-configuration/4-troubleshootingconnector.md#connector-error-codes).

## Registering the connector in OpenIAM

Register the connector under **Provisioning → Connectors** and attach it to the managed system — see [Registering the connector](/administration-guide/lifecycle/connectors-and-managed-systems.md).

## Configuring the managed system

<table><thead><tr><th width="187">Managed-system field</th><th>Value</th></tr></thead><tbody><tr><td><strong>URL</strong></td><td>Your IDCS instance base URL, e.g. <code>https://idcs-&#x3C;tenant>.identity.oraclecloud.com</code>.</td></tr><tr><td><strong>Login</strong></td><td>The OAuth2 <strong>client ID</strong>.</td></tr><tr><td><strong>Password</strong></td><td>The OAuth2 <strong>client secret</strong>.</td></tr></tbody></table>

The connector caches the token per managed system and refreshes it as needed.

## Attribute mapping and policy map

Map OpenIAM user attributes to the IDCS user schema (name, email, status) in the managed system's [policy map](/administration-guide/lifecycle/policy-map.md).

## Reconciliation and synchronization

The user search supplies IDCS users (with their group memberships) as source records. Configure a sync against the managed system as described in [Configuring synchronization](/administration-guide/lifecycle/synchronize-and-import-data.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.openiam.com/connector-configuration/oracle-idcs.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.