Skip to main content
This integration applies to the OCI infrastructure used to manage Oracle services. Each Oracle Cloud instance requires a separate integration.

​
After this article

You will be able to connect Oracle Cloud Fusion (OCI) to Lumos to sync users, groups, applications, and application roles, and to provision and deprovision user access.

​
Capabilities

​
Required plan and roles

  • OCI access: you need access to the OCI Console with permission to create Confidential Applications in your Identity Domain (Identity & Security → Domains).
  • App Roles granted to the OAuth client (both required):
    • User Administrator: list, create, update, and delete Users and Groups. Required to sync user information into Lumos and provision accounts.
    • Application Administrator: read AppRoles and manage Grants (assigning users to applications and app roles).
  • Permission scoping: this is a read/write integration. The App Roles above are the baseline. Lumos manages user access (create, deactivate, delete, group and grant assignment) and requires the corresponding write permissions.

​
Read-only access vs provisioning

Is read-only possible? No. The OAuth client needs both the User Administrator and Application Administrator App Roles to sync data at all, and Oracle’s setup explicitly skips any scopes step, since App Roles are the only permission lever and both required roles carry create, update, and delete access. What full provisioning requires. A Confidential Application in your OCI Identity Domain, configured for Client Credentials, with the App Roles User Administrator and Application Administrator granted under “Grant the client access to Identity Cloud Service Admin APIs,” then its Client ID and Client Secret entered as described below. Watch out for. Missing either App Role causes partial data instead of an obvious error, for example users sync but application roles and grants don’t.

​
Instructions

Phase 1: Create a Confidential Application in OCI
  1. In the OCI Console, go to Identity & Security → Domains → [Your Domain] → Integrated Applications.
  2. Click Add application → Confidential Application, name it (for example Lumos Integration), and click Next.
  3. Select Configure this application as a client now.
  4. Under Allowed Grant Types, check Client Credentials.
  5. Skip the Resources / Add scopes section. No specific API scopes are needed here.
  6. Scroll to Grant the client access to Identity Cloud Service Admin APIs, click Add, and select the App Roles User Administrator and Application Administrator.
  7. Finish the wizard and activate the application.
  8. Copy the Client ID and Client Secret.
Phase 2: Connect in Lumos
  1. Find the Oracle Cloud Fusion OCI card in your Lumos integrations (reconnect an existing card or add a new one).
  2. Instance Identifier: the identifier of your Oracle Cloud Fusion instance / Identity Domain (for example idcs-12345), the host portion of https://{instance_identifier}.identity.oraclecloud.com.
  3. Client ID and Client Secret: from the Confidential Application created above.
  4. Click Connect.

​
API Endpoints Used

​
Troubleshooting

OAuth authentication failed / invalid credentials. Verify the Client ID and Client Secret are correct. Make sure the Confidential Application is active (not disabled). Confirm the allowed grant type is Client Credentials. Check that your Oracle Cloud instance is accessible and not in maintenance. If in doubt, regenerate the client credentials and reconnect. Connection fails or times out. Check the Instance Identifier. It must be the Identity Domain identifier (for example idcs-12345) such that https://{instance_identifier}.identity.oraclecloud.com resolves, not a Fusion Applications URL. Users, groups, or roles missing after sync. Confirm the OAuth client was granted both the User Administrator and Application Administrator App Roles under Grant the client access to Identity Cloud Service Admin APIs. A missing App Role causes partial data (for example, users sync but app roles and grants do not). Provisioning actions fail. Grant and group changes require the Application Administrator and User Administrator App Roles respectively. Verify neither was removed from the application after setup. Slow initial sync. Large organizations may take 30 or more minutes for the first sync due to Oracle API throttling and concurrent request limits.