How can I retrieve Idp Group Users using, oci python SDK?

Question

When I call list_users method for IdentityClient, It enlists the users (Including IDP users.) I have created the IDP Group Mapping in OCI Console. Now I want something where I can identify every specific IDP user's, IDP Group or the Permissions they have without using Identity Console or IDCS API.

Do we have any Provision, where I can enlist IDP group users, or any way to identify, this IDP user, belongs to this IDP group so that on the basis of IDP group mapping I can say this IDP user has these permissions.

score 1 · Answer 1 · answered Jul 24 '20 at 16:02

1

You can get an IdP User's OCI group membership and then map the OCI group names to IdP group names. This only works if your OCI groups are mapped 1:1 with your IdP groups. Permissions can then be applied to OCI groups via Policies. Will this work for you?

ListUserGroupMemberships API will tell you all the OCI groups that a user belongs to.

If you need the IdP group name and can ensure that group mappings are created 1:1 you can also use ListIdPGroupMappings API to convert OCI group names to IdP group names.

ListUserGroupMemberships API: https://oracle-cloud-infrastructure-python-sdk.readthedocs.io/en/latest/api/identity/client/oci.identity.IdentityClient.html#oci.identity.IdentityClient.list_user_group_memberships

ListIdpGroupMappings API: https://oracle-cloud-infrastructure-python-sdk.readthedocs.io/en/latest/api/identity/client/oci.identity.IdentityClient.html#oci.identity.IdentityClient.list_idp_group_mappings

answered Jul 24 '20 at 16:02

Vanja Oljaca

11
1

My IDp group may contain some groups as well. – Amrish Mishra Jul 24 '20 at 16:07
Which IdP are you using? How can groups contain groups? – Vanja Oljaca Jul 24 '20 at 16:50
I am sorry for this delayed response. – Amrish Mishra Jul 26 '20 at 06:56
The IDP groups may contain some other group apart from the one whic i use for OCI users. 1:1 mapping is not possible from my side. I just wanted to see the user permission of IDP group users using sdk, i.e from whic Local group my IDP users belongs too. – Amrish Mishra Jul 26 '20 at 07:00

score 0 · Answer 2 · answered Apr 11 '22 at 20:48

I have been running into the same problem.

You need the OCI SDK to get IDP groups, and IDP groupmappings, but to get the IDP users and IDP groups, you need to create use the IDP APIs. To do so you need to create an app that has the right credentials, autheticate as the app and then use the IDP API endpoint to get the info.

With IDCS, you need to use the API documented here:

https://docs.oracle.com/en/cloud/paas/identity-cloud/rest-api/api-identity-groups.html

and

https://docs.oracle.com/en/cloud/paas/identity-cloud/rest-api/api-identity-users.html

How can I retrieve Idp Group Users using, oci python SDK?

2 Answers2