In Oracle Cloud Infrastructure (OCI), Identity and Access Management
(IAM) is not just about users and policies. One of the most important building
blocks is the Identity Domain
Over the years, while working on OCI infrastructure, PaaS migrations, hybrid
environments, and security operations, I’ve seen teams treat Identity Domains
as a checkbox during setup. That usually works for a while until scale,
compliance, or external users enter the picture.
This article explains OCI Identity Domains, the different domain types, and
most importantly when and why to choose each domains.
What Is an Identity Domain in OCI?
It's a logical security boundary within OCI IAM. Each domain has its own:
• Users and groups
• Authentication policies (password rules, MFA, sign-on policies)
• Identity providers (OCI IAM, AD, Azure Entra ID, social IdPs)
• Application integrations and SSO configurations
This isolation is intentional. It allows you to separate:
• Internal employees vs external users
• Production vs nonproduction access
• Environment specific access
OCI Identity Domain Types
When creating a domain, OCI asks you to choose a domain type. Each type exists
for a reason.
1. Free Domain
A basic IAM domain with limited features and usage caps, primarily intended for
OCI access.
When to Choose Free Domain:
• Small teams
• Learning, sandbox, or POC environments
• OCI administrators accessing console and APIs
• Minimal integration requirements
Why Choose It:
• No additional cost
• Simple IAM needs
• Quick setup
Advantages:
• Free of cost
• Suitable for OCI resource access
• Easy to manage
• Good for nonproduction environments
Limitations / Disadvantages:
• User limit (~2000 users)
• 2 third-party non-oracle apps
• 3 external identity providers
• Not suitable for enterprise workforce IAM
My View:
Free domain is fine only when IAM complexity is low. Avoid using it as the main
domain for production or large teams.
2. Oracle Apps Premium Domain
An IAM domain optimized for environments heavily using Oracle applications.
When to Choose Oracle Apps Premium:
• Organizations using Oracle ERP, HCM, EBS, OIC, or Oracle autonomous databases
• Hybrid Oracle environments (on-prem + OCI)
• Limited non-Oracle SaaS usage
Why Choose It:
• Strong alignment with Oracle application ecosystem
• Supports hybrid IAM scenarios
Advantages:
• Better Oracle app integration
• Hybrid IAM support
• More capable than Free domain
Limitations / Disadvantages:
• 6 non-Oracle apps
• Less flexible than full Premium domain
• Unlimited external identity providers
• Unlimited support for Oracle Apps including hybrid IAM
• Not ideal for diverse SaaS ecosystems
My View:
This domain works well if your ecosystem is Oracle ecosystem. If you expect
expansion into multiple third-party apps, Premium is a safer long-term choice.
3. Premium Domain
OCI’s full-featured enterprise workforce IAM domain.
When to Choose Premium Domain:
• Medium to large enterprises
• Employees accessing multiple Oracle and non-Oracle applications
• Hybrid IT environments
• Compliance driven organizations
Why Choose It:
• Designed for scale and flexibility
• Covers most enterprise IAM use cases
Advantages:
• Unlimited Oracle and non-Oracle app integrations
• Hybrid IAM (on-prem + cloud)
• Advanced authentication and MFA
• Best suited for production workloads
Limitations / Disadvantages:
• Paid offering
• Overkill for small or short-term setups
My View:
Premium domain is my default recommendation for workforce IAM in production. It
futureproofs identity architecture and avoids redesign later.
4. External User
Domain
A domain designed specifically for nonemployee users customers, partners,
vendors, or consumers.
When to Choose External User Domain:
• Customer portals
• Partner onboarding platforms
• Public-facing applications
• B2B or B2C scenarios
Why Choose It:
• Keeps external users isolated from internal IAM
• Designed for largescale user populations
Advantages:
• Supports self-registration and social login
• Scales to millions of users
• Clean separation from workforce identities
Limitations / Disadvantages:
• Not suitable for employee IAM
• Limited workforce governance features
My View:
Never mix employees and customers in the same domain. External User domain
exists to protect internal IAM boundaries.
Last but important, How I decide which domain to choose?
- The selection depends upon the number of users?
- Customer and Partners
- Which Applications being used
- Production vs Non Production
- Hybrid access required
No comments:
Post a Comment