password not synced

[jelhub]

password not synced

[jelhub]

Hi,
This is a OCI thing, when users are created in OCI they probably need a password to be able to logon?

You can't retrieve users password from AD (plugin-ldap) to be used in a sync to OCI.

Your sync logic needs to set a random password while creating user in OCI and then send this password by mail to user.

Or maybe better, you could enable OCI multifactor with some sms or mail options to let user reset forgotten password (e.g. first time logon)

Jarle

[shahidv3]

Thanks @jelhub for the quick response.

My understanding was SCIM GW (plugin-ldap) will help me to sync users, groups plus user credentials from on-prem AD
Also our objective is to have SSO to OCI using on prem AD credentials without resetting the password.
But looks like we can't sync the existing passwords from on-prem AD using plugin-ldap.

many thanks,

[jelhub]

AD and Azure store passwords as hash-values, both using the same algorithm, hence passwords (hash) can be synced between AD and Azure.

This password hash cannot be copied to OCI, because Oracle nor SCIM Gateway have accesses to Microsoft’s password algorithm.

It's not possible to convert from hash to clear text (apply to Microsoft also), that's why storing passwords as hash is the preferred way of handling passwords.

Jarle