Getting Started

Overview

This guide walks you through connecting an OCI tenancy to Britive and granting your first just-in-time access session to an OCI IAM role — with no standing policy grants and full audit logging on every checkout.

What you’ll accomplish:

Create a Britive integration user and group in OCI IAM
Onboard the OCI application in the Britive console
Create an access profile for an OCI IAM role
Check out and verify JIT access end-to-end

Prerequisites

Before you begin, make sure you have:

A Britive tenant with administrator access
OCI tenancy administrator access to create users, groups, and policies
OCI CLI configured, or access to the OCI web console

Never hardcode credentials. Use environment variables, your secret manager, or the Britive Secrets Store.

How It Works

Britive uses OCI’s REST APIs and IAM policy management to grant and revoke access. At checkout, Britive adds the user to the appropriate OCI group or updates compartment-scoped IAM policies. At checkin, group membership or the policy statement is removed.

User → Britive Console → OCI IAM API → Group membership / Policy statement (timed)

Onboarding the Application

Connect your OCI tenancy to your Britive tenant. This is a one-time setup performed by an administrator.

For detailed onboarding reference, see the Britive documentation.

Using the Britive Console

Create the Britive integration user

In the OCI console, navigate to Identity & Security → Users → Create User. Name it britive-integration.

Create an API signing key

Generate an RSA key pair and upload the public key to the Britive integration user. Copy the fingerprint.

Create a group and policy

Create a group named britive-integration-group and assign the integration user to it. Create a policy granting the group the permissions Britive needs to manage IAM at the required scope.

Add the application in Britive

In the Britive console, navigate to Applications → Add Application → Oracle Cloud Infrastructure. Enter your tenancy OCID, user OCID, fingerprint, region, and private key.

Verify the connection

The application status should show Connected. Britive will scan and import your compartments and available IAM groups.

Using Python / Shell

Set required environment variables:

export OCI_TENANCY_OCID=ocid1.tenancy.oc1..xxx
export OCI_USER_OCID=ocid1.user.oc1..xxx
export OCI_FINGERPRINT=xx:xx:xx:...
export OCI_PRIVATE_KEY_PATH=~/.oci/oci_api_key.pem
export OCI_REGION=us-ashburn-1
export BRITIVE_TENANT=your-tenant
export BRITIVE_API_TOKEN=your-token

BRITIVE_TENANT takes just the subdomain — see Finding Your Tenant Name.

Refer to the britive/onboarding repository for available automation scripts.

Using Terraform

Refer to the britive/onboarding repository for Terraform templates.

git clone https://github.com/britive/onboarding.git
# Navigate to the OCI terraform directory when available
terraform init
terraform apply

Create Your First Access Profile

Using the Britive Console

Open the OCI application

Navigate to Applications → select your OCI application → Profiles → Add Profile.

Configure the profile

Field	Value
Name	A descriptive name (e.g., `Ops-CompartmentAdmin`)
Environment	Select the OCI compartment
Expiration	Set a max session duration (e.g., `1h0m0s`)

Add permissions

Under Permissions, add the OCI IAM groups or policy statements to include.

Add a policy

Under Policies, assign members and configure conditions.

Save and activate

Click Save.

Using Terraform

data "britive_application" "oci" {
  name = "OCI"
}

resource "britive_profile" "ops" {
  app_container_id    = data.britive_application.oci.id
  name                = "Ops-CompartmentAdmin"
  expiration_duration = "1h0m0s"

  associations {
    type  = "Environment"
    value = "production-compartment"
  }
}

Verify

Check out the profile

Navigate to My Access → find your profile → click Check Out.

Confirm OCI access

Use the OCI CLI to verify group membership or list your effective policies:

oci iam user list-groups --user-id <your-user-ocid>

Check in

Return to My Access → click Check In. Verify the group membership or policy statement has been removed.

Troubleshoot

Symptom	Likely Cause	Fix
Application shows “Disconnected”	Private key or fingerprint mismatch	Re-upload the API key and verify the fingerprint in Britive
Compartments not visible	Integration user lacks list permissions	Update the OCI policy to grant list access to the integration user
Checkout fails	Britive group lacks the required OCI policy	Update the OCI IAM policy for the target compartment

Next Steps

Britive documentation

Last updated on July 8, 2026