---
title: "Fortanix DSM with Oracle Cloud Infrastructure EKM"
slug: "using-fortanix-dsm-with-oracle-cloud-infrastructure-ekm"
updated: 2026-08-08T10:06:08Z
published: 2026-08-08T10:06:08Z
canonical: "support.fortanix.com/using-fortanix-dsm-with-oracle-cloud-infrastructure-ekm"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.fortanix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Fortanix DSM with Oracle Cloud Infrastructure EKM

## 1.0 Introduction

This article describes how to integrate **Oracle Cloud Infrastructure (OCI) Vault** with **Fortanix-Data-Security-Manager (DSM)** using **OCI External Key Management (EKM)**.

OCI EKM enables OCI Vault to perform cryptographic operations using encryption keys that are created and managed outside of OCI. In this integration, key material remains in Fortanix DSM while OCI Vault invokes Fortanix DSM to perform supported encryption and decryption operations.

This article provides the configuration steps required to enable this integration and describes how OCI authenticates to Fortanix DSM and accesses externally managed keys.

In this integration, **OCI EKM** uses a private endpoint within a Virtual Cloud Network (VCN) to securely send cryptographic operation requests to the external key manager (Fortanix DSM). The private endpoint routes traffic through a private API Gateway, which forwards requests to Fortanix DSM over Hypertext Transfer Protocol Secure (HTTPS). OCI Identity Domains issue OAuth2 access tokens in the form of JSON Web Tokens (JWTs). Fortanix DSM verifies these tokens using OCI’s JSON Web Key Set (JWKS) endpoint to authenticate OCI before performing any cryptographic operations.

## 2.0 Why Use Fortanix DSM With OCI EKM?

OCI EKM enables OCI services to use encryption keys that are externally managed, allowing customers to retain full custody and control over cryptographic material.

By integrating OCI Vault with Fortanix DSM, customers retain full control over their key material while continuing to use OCI-native services. Keys are created, stored, and managed in Fortanix DSM, and all supported cryptographic operations are executed within Fortanix DSM. OCI authenticates to Fortanix DSM using JWT-based authentication, ensuring secure and controlled access to externally managed keys.

This approach allows organizations to centralize key management across environments while meeting regulatory, compliance, and security requirements.

## 3.0 Prerequisites

Ensure the following OCI components are configured before proceeding:

- OCI tenancy with administrative privileges
- Configured OCI Identity Domain
- Access to OCI API Gateway service
- Access to OCI Certificates service
- Networking permissions to create VCN and subnet
- An active Fortanix DSM account

*For more information on how to configure the OCI components, refer to the* [*Oracle official documentation*](https://docs.oracle.com/en-us/iaas/Content/KeyManagement/Tasks/external_key_management.htm)*.*

## 4.0 Set Up Networking Prerequisites in OCI

Before integrating OCI EKM with Fortanix DSM, configure the required networking components within your OCI tenancy to enable private, secure communication between OCI services and Fortanix DSM.

### 4.1 Creating a Virtual Cloud Network (VCN)

Create a VCN to establish isolated network boundaries for the OCI API Gateway and its private endpoint used in the OCI EKM integration. The VCN provides the foundation for routing, private connectivity, and security controls required for cryptographic operations.

*For more information on how to create a VCN, refer to the* [*Oracle official documentation*](https://docs.oracle.com/en-us/iaas/Content/KeyManagement/Tasks/ekms_setting_up_network_components.htm#ekms_configuring_vcn)*.*

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/using-fortanix-data-security-manager-with-oracle-cloud-infrastructure-ekm-image-5rp7xq0h.png)

**Figure 1: Create VCN in OCI console**

### 4.2 Creating a Subnet

After creating the VCN, configure a private subnet within the VCN. The subnet hosts the OCI API Gateway and the private endpoint used by OCI EKM to securely route cryptographic operation requests to Fortanix DSM. The VCN provides the foundation for routing, private connectivity, and security controls required for cryptographic operations. Ensure the subnet has appropriate route tables and security lists or network security groups (NSGs) to allow HTTPS traffic between OCI EKM, the OCI API Gateway, and Fortanix DSM.

*For more information on how to create a subnet, refer to the* [*Oracle official documentation*](https://docs.oracle.com/en-us/iaas/Content/KeyManagement/Tasks/ekms_setting_up_network_components.htm#ekms_set_up_subnet)*.*

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/using-fortanix-data-security-manager-with-oracle-cloud-infrastructure-ekm-image-ezvadx35.png)

**Figure 2: Subnet Configuration within VCN**

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/using-fortanix-data-security-manager-with-oracle-cloud-infrastructure-ekm-image-e4mo9oqx.png)

**Figure 3: Create Subnet**

## 5.0 Set up TLS Connectivity

TLS must be configured to ensure encrypted communication between OCI Vault (using EKM), the OCI API Gateway, and Fortanix DSM.

In setup, a Fully Qualified Domain Name (FQDN) is used for TLS certificate binding and API Gateway configuration, while OCI Vault communicates with the API Gateway using its private IP address for authentication and authorization.

### 5.1 Generating a TLS Certificate

Generate or obtain a TLS certificate that will be bound to the custom domain of the OCI API Gateway.

The following example illustrates how to generate a self-signed certificate and private key using OpenSSL:

```bash
openssl genpkey -algorithm RSA -out key.pem
openssl req -new -x509 -key key.pem -out cert.pem -days 365
```

After generating the certificate, import this certificate into OCI Certificates service and associate it with the API Gateway custom domain during deployment.

*For more information on how to upload and manage the TLS certificates, refer to the* [*Oracle official documentation*](https://docs.oracle.com/en-us/iaas/Content/APIGateway/Tasks/apigatewaysettingupcustomdomainscerts.htm#apigatewaysettingupcustomdomainscerts_topic_using_an_apigw_certificate_resource)*.*

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/using-fortanix-data-security-manager-with-oracle-cloud-infrastructure-ekm-image-nvfxuu3g.png)

**Figure 4: Create TLS Certificate in OCI**

### 5.2 Creating an API Gateway

Create an OCI API Gateway to act as the secure entry point for OCI EKM requests. The API Gateway validates incoming requests and forwards them to Fortanix DSM over HTTPS.

*For more information on how to create an API Gateway, refer to the* [*Oracle official documentation*](https://docs.oracle.com/en-us/iaas/Content/APIGateway/Tasks/apigatewaycreatinggateway.htm)*.*

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/using-fortanix-data-security-manager-with-oracle-cloud-infrastructure-ekm-image-xp73j8qx.png)

**Figure 5: API Gateway creation in OCI console**

### 5.3 Deploying the API Gateway Using the Fortanix DSM FQDN

You must deploy an API on the API Gateway and configure it to forward requests to Fortanix DSM using the Fortanix DSM FQDN as the service endpoint.

You can configure the route as follows:

- Use `/` as the path prefix.
- Configure the route path as: `/{path*}`
- Set the HTTP URL (HTTPS) as: `https://<DSM_HOST>/${request.path[path]}`

Where, `<DSM_HOST>` is the Fortanix DSM fully qualified domain name. For example, **amer.smartkey.io**.

This configuration forwards all OCI EKM API requests to Fortanix DSM while preserving the original request path.

*For more information on how to deploy APIs and configure routes, refer to the* [*Oracle official documentation*](https://docs.oracle.com/en-us/iaas/Content/KeyManagement/Tasks/ekms_deploy_api_gateway.htm)*.*

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/using-fortanix-data-security-manager-with-oracle-cloud-infrastructure-ekm-image-0e9l02x8.png)

**Figure 6: Create API deployment for EKM**

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/using-fortanix-data-security-manager-with-oracle-cloud-infrastructure-ekm-image-tqwgpszv.png)

**Figure 7: Configure route path for request forwarding**

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/using-fortanix-data-security-manager-with-oracle-cloud-infrastructure-ekm-image-c6mrthgl.png)

**Figure 8: Configure HTTP backend**

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/using-fortanix-data-security-manager-with-oracle-cloud-infrastructure-ekm-image-yyy91p3l.png)

**Figure 9: API deployment summary and configuration review**

## 6.0 Set up Authentication and Authorization

OCI Identity Domains issues a JWT using `client_credentials` authentication flow. This token contains the configured scope and audience (aud) claims.

Fortanix DSM validates the JWT by verifying the token signature using OCI JWKS endpoint. It validates that the token contains the appropriate scope (`oci_ekms`), verifies the issuer (`iss`) claim to ensure the token was issued by OCI Identity Domains, and confirms that the audience (`aud`) claim matches the DSM URL. Fortanix DSM also checks the token validity period before authorizing access.

### 6.1 Creating a Confidential Resource Application

A resource application represents the API or service you want to protect. It defines who can access it (audiences) and what operations are allowed (scopes). It corresponds to the OCI API Gateway and Fortanix DSM integration and is created so that the OCI Identity Domains can issue access tokens with the appropriate audience and scope for this API.

Perform the following steps to create a confidential resource application:

1. Navigate to **Identity & Security → Domains → Integrated Applications → Add application.**
2. Select **Confidential Application**.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/using-fortanix-data-security-manager-with-oracle-cloud-infrastructure-ekm-image-hlhdrtxd.png)

**Figure 10: Select confidential resource application**
3. In the **Add Confidential Application** form:
  1. **Name**
  2. **Description**
  3. **Primary audience:** Enter the base URL corresponding to the private IP address of the OCI API Gateway used by OCI Vault for token audience validation. For example, https://<api-gateway-private-ip>.

> [!NOTE]
> NOTE
> 
> The primary audience must match the base URL of the OCI API Gateway private IP address and include the HTTPS scheme and correct IP address.
  4. **Secondary audience**: Enter the Fortanix DSM URL. For example, **https://amer.smartkey.io**.

> [!NOTE]
> NOTE
> 
> The secondary audience allows Fortanix DSM to validate the `aud` claim during token verification. An audience mismatch will result in authentication failure.
  5. **Scope**: Enter `oci_ekms` as the scope value.
  6. **Client credentials**: Select the check box to enable the client credentials grant type.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/using-fortanix-data-security-manager-with-oracle-cloud-infrastructure-ekm-image-4iixx99k.png)

**Figure 11: Configure mandatory fields for resource application**

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/using-fortanix-data-security-manager-with-oracle-cloud-infrastructure-ekm-image-ot1c2y3c.png)

**Figure 12: Activate confidential resource application**
4. Click **SUBMIT**.
5. At the top of the page, to the right of the application name, click **Activate** to activate the resource application to enable token issuance and validation.

This application defines the resource server configuration for OCI EKM access, specifying the audience and scope values that will appear in issued JWT.

*For more information on how to create a confidential resource application, refer to the* [*Oracle official documentation*](https://docs.oracle.com/en-us/iaas/Content/KeyManagement/Tasks/ekms_creating_confidential_resource_app.htm)*.*

### 6.2 Retrieving OCI Identity Domain Metadata (JWKS URI)

OCI issues JWT that are signed by your Identity Domain. Fortanix DSM validates these tokens using OCI’s public signing keys, which are exposed through the Identity Domain’s OpenID Connect Metadata Endpoint. You must retrieve the JWKS URI from this metadata to configure Fortanix DSM.

Perform the following steps to obtain the JWKS URI:

1. In OCI, navigate to **Identity & Security → Domains** and select your Identity Domain. Locate and note the URL of your Identity Domain as described [*here*](https://docs.oracle.com/en-us/iaas/Content/Identity/api-getstarted/locate-identity-domain-url.htm).

The URL will be in the following format:

`https://idcs-&lt;some_id&gt;.identity.oraclecloud.com/`
2. Go to **Settings → Edit Domain Settings**.
3. If the signing keys are not publicly accessible, enable **Configure client access** under the **Access Signing Certificate** section to allow retrieval of the public signing keys.
4. Open the Identity Domain metadata endpoint in a browser using the following format:

`https://idcs-&lt;some_id&gt;.identity.oraclecloud.com/.well-known/openid-configuration`
  - In the metadata, locate and copy the `jwks_uri` value. This URL will be used in [*Section 9.4: Creating an Application*](/v1/docs/using-fortanix-data-security-manager-with-oracle-cloud-infrastructure-ekm#94-creating-an-application) when configuring the Signed JWT application in Fortanix DSM to validate tokens issued by OCI Identity Domains.

*For more information on how to configure OCI Identity Domain, refer to the* [*Oracle official documentation*](https://docs.oracle.com/en-us/iaas/Content/KeyManagement/Tasks/ekms_registering_identity_provider.htm)*.*

### 6.3 Creating and Associating a Confidential Client Application

A client application represents the service that calls the protected API and authenticates using its client credentials to obtain access tokens from the OCI Identity Domains. In this integration, it represents OCI Vault (External Key Management service) and is used to obtain access tokens for calling the OCI API Gateway that fronts Fortanix DSM.

Perform the following steps to create a confidential client application for OCI EKM authentication:

1. Navigate to **Identity & Security → Domains → Integrated Applications → Add Application.**
2. Select **Confidential Application**.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/using-fortanix-data-security-manager-with-oracle-cloud-infrastructure-ekm-image-37rh7kfi.png)

**Figure 13: Create confidential client application**
3. In the **Add Confidential Application** form:

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/using-fortanix-data-security-manager-with-oracle-cloud-infrastructure-ekm-image-5la93ov4.png)

**Figure 14: Configure client credentials grant type**

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/using-fortanix-data-security-manager-with-oracle-cloud-infrastructure-ekm-image-4ud5uhp4.png)

**Figure 15: Add scope under resources**

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/using-fortanix-data-security-manager-with-oracle-cloud-infrastructure-ekm-image-6no6cn8b.png)

**Figure 16: Add scope under Resources**
  1. **Name**
  2. **Description**
  3. **Select Configure this application as a client now.**
  4. Select the **Client credentials check box.**
  5. Under the **Resources section**, enable the **Add resource** toggle button. Add the scope "**oci_ekms**" created in [*Section 6.1: Creating Confidential Resource Application*](/v1/docs/using-fortanix-data-security-manager-with-oracle-cloud-infrastructure-ekm#61-create-a-confidential-resource-application). The scope includes **oci_ekms**. The full scope will be the **Primary audience** followed by the Scope from [*Section 6.1: Creating a Confidential Resource Application*](/v1/docs/using-fortanix-data-security-manager-with-oracle-cloud-infrastructure-ekm#61-create-a-confidential-resource-application)*, Steps 3c* and *3e* as seen in the screenshot below.
4. Click **SUBMIT**.
5. Copy the **Client ID** and **Client Secret** of the client application. This can be found in the **Oauth configuration** tab of the OCI client application. These credentials will be used by Fortanix DSM (through the OCI Vault / EKM integration) to request access tokens when calling the OCI API Gateway.
6. After submission, activate the application to enable the client configuration.

This confidential client application obtains JWT access tokens using the `client_credentials` grant flow.

*For more information on how to associate confidential client application, refer to the* [*Oracle official documentation*](https://docs.oracle.com/en-us/iaas/Content/KeyManagement/Tasks/ekms_creating_associate_client_app.htm)*.*

## 7.0 Configure Private Endpoints for EKM Access

OCI Vault (External Key Management service) communicates with external key manager through a private endpoint, which provides private network connectivity within the OCI VCN.

In this setup, the private endpoint terminates at the OCI API Gateway private IP, and the API Gateway securely forwards requests to Fortanix DSM.

Perform the following steps to create a private endpoint for EKM access:

1. Navigate to **Identity & Security → Key Management & Secret Management → Private Endpoints**.
2. Click **Create Private Endpoint**.
3. In the **Create Private Endpoint** form:
  - **External Key Manager Private IP**: Enter the private IP address of the OCI API Gateway. Ensure that the private endpoint is created within the same VCN as the API Gateway.
  - **Certificate**: Use the same TLS certificate that was uploaded to the OCI API Gateway in [*Section 5.1: Generating a TLS Certificate*](/v1/docs/using-fortanix-data-security-manager-with-oracle-cloud-infrastructure-ekm#51-generate-a-tls-certificate).
4. Click **Create**.

Note down the private endpoint IP address to use when creating an OCI vault *in* [*Section 8.0: Create an EKM Vault in OCI*](/v1/docs/using-fortanix-data-security-manager-with-oracle-cloud-infrastructure-ekm#80-create-an-ekm-vault-in-oci)*.*

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/using-fortanix-data-security-manager-with-oracle-cloud-infrastructure-ekm-image-yki7dabg.png)

**Figure 17: Create private endpoint for EKM access**

The private endpoint now establishes secure, private connectivity between OCI Vault and the OCI API Gateway, which forwards EKM requests to Fortanix DSM.

*For more information on how to create a private endpoint for EKM, refer to the* [*Oracle official documentation*](https://docs.oracle.com/en-us/iaas/Content/KeyManagement/Tasks/ekms_creating_ekms_private_endpoint.htm)*.*

## 8.0 Create an EKM Vault in OCI

An External Vault represents an external key manager used by OCI Vault when operating in EKM mode. It defines the endpoint through which OCI Vault communicates with Fortanix DSM through the configured private endpoint.

Perform the following steps to create an External Vault:

1. Navigate to **Identity & Security → Key Management & Secret Management → External Vaults**.
2. Click **Create External Vault**.
3. In the **Create Vault** form, configure the required details, including the following:
  1. **IDCS Account Name URL**: Enter the OCI Identity Domain URL. This value can be found by navigating to **Identity & Security** → **Domains** → **Domain URL**.

**For example,**`https://idcs-&lt;domain-id&gt;.identity.oraclecloud.com:443`, where, `&lt;domain-id&gt;` represents the Identity Domain identifier assigned to your tenancy.
  2. **Client Application ID and Client Application Secret**: Enter the credentials of the confidential client application created for OCI EKM access copied in [*Section 6.3: Creating and Associating a Confidential Client Application*](/v1/docs/using-fortanix-data-security-manager-with-oracle-cloud-infrastructure-ekm#63-create-and-associate-confidential-client-application).
  3. For the **External Vault URL** field, use the following format:

`https://{api-gateway-ip}/oci/ekm/v1/vaults/{dsm-account-id}`

Where,
    - `{api-gateway-ip}`: Refers to the IP address of the API Gateway you created in [*Section 5.2: Creating an API Gateway*](/v1/docs/using-fortanix-data-security-manager-with-oracle-cloud-infrastructure-ekm#52-creating-an-api-gateway).
    - `{dsm-account-id}`: Refers to the UUID of your Fortanix DSM account. *For steps to copy the Fortanix DSM account UUID, refer to* [*Section 9.2: Creating an Account*](/v1/docs/using-fortanix-data-security-manager-with-oracle-cloud-infrastructure-ekm#92-creating-an-account).
4. Complete the remaining fields and create the External Vault.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/using-fortanix-data-security-manager-with-oracle-cloud-infrastructure-ekm-image-12lvp4kw.png)

**Figure 18: Create external vault in OCI using private endpoint**

The External Vault enables OCI Vault to route cryptographic operations to Fortanix DSM through the OCI API Gateway using private network connectivity.

## 9.0 Configure Fortanix DSM

A Fortanix DSM service must be configured, and the URL must be accessible. To create a Fortanix DSM account and group, refer to the following sections:

### 9.1 Signing Up

To get started with the Fortanix DSM cloud service, you must register an account at <Your_DSM_Service_URL>. For example, [https://amer.smartkey.io.](https://amer.smartkey.io.) On-premises customers use the KMS URL, and the SaaS customers can use the URLs as listed [*here*](https://support.fortanix.com/hc/en-us/articles/4406135346068-Fortanix-DSM-SaaS-Global-Availability-Map) based on the application region.

*For more information on how to set up the Fortanix DSM, refer to the* [*Sign Up for Fortanix Data Security Manager SaaS*](https://support.fortanix.com/docs/users-guide-sign-up-for-fortanix-data-security-manager-saas)*.*

### 9.2 Creating an Account

Access <Your_DSM_Service_URL> in a web browser and enter your credentials to log in to Fortanix DSM.

![A screenshot of a login screen  AI-generated content may be incorrect.](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/using-fortanix-data-security-manager-with-oracle-cloud-infrastructure-ekm-image-fgnh41ye.png)

**Figure 19: Logging in**

Copy the UUID of the Fortanix DSM account to use in [*Section 8.0: Create an EKM Vault in OCI*](/v1/docs/using-fortanix-data-security-manager-with-oracle-cloud-infrastructure-ekm#80-create-an-ekm-vault-in-oci).

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/using-fortanix-data-security-manager-with-oracle-cloud-infrastructure-ekm-image-ubh3smbq.png)

**Figure 20: Copy Account ID**

*For more information on how to set up an account in Fortanix DSM, refer to the* [*User's Guide: Getting Started with Fortanix Data Security Manager - UI*](https://support.fortanix.com/docs/users-guide-getting-started-with-fortanix-data-security-manager-ui#30-setting-up-an-account)*.*

### 9.3 Creating a Group

Perform the following steps to create a group in the Fortanix DSM:

1. In the DSM left navigation panel, click the **Groups** menu item, and then click **ADD GROUP** to create a new group.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Add-Group(79).png)

**Figure 21: Add groups**
2. On the **Adding new group** page:
  1. **Title**: Enter a name for your group.
  2. **Description** (optional): Enter a short description of the group.
3. Click **SAVE** to create the new group.

*For more information about groups, refer to* [*Definitions*](/v1/docs/dsm-definitions#40-groups)*.*

> [!NOTE]
> TIP
> 
> It is recommended to configure a **Key undo policy** for groups for the cryptographic keys used by the application before creating or using the keys. Without a configured **Key undo policy**, key deletion is permanent and the deleted key cannot be recovered. Deleting an encryption key may result in permanent loss of access to the protected data and service disruption for applications that depend on the deleted key. *For detailed steps, refer to* [*Key Undo Policy*](/v1/docs/fortanix-dsm-key-undo-policy)*.*

### 9.4 Creating an Application

Perform the following steps to create an application (app) in the Fortanix DSM:

1. In the DSM left navigation panel, click the **Apps** menu item, and then click **ADD APP** to create a new app.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/using-fortanix-data-security-manager-with-oracle-cloud-infrastructure-ekm-image-sw0cwvok.png)

**Figure 22: Add Application**
2. On the **Adding new app** page:
  1. **App name:** Enter the Client ID of the confidential client application created in OCI.

> [!NOTE]
> NOTE
> 
> The Client ID is available in the **OAuth configuration** tab of the OCI confidential client application in [*Section 6.3: Creating and Associating a Confidential Client Application*](/v1/docs/using-fortanix-data-security-manager-with-oracle-cloud-infrastructure-ekm#63-create-and-associate-confidential-client-application).
  2. **ADD DESCRIPTION** (optional): Enter a short description of the application.
  3. **Authentication method:** Select **JSON Web Token** as the authentication method from the drop down menu. *For more information on these authentication methods, refer to* [*Authentication*](https://support.fortanix.com/hc/en-us/articles/360033272171-User-s-Guide-Authentication)*.*
  4. **Valid Issuer**: https://identity.oraclecloud.com/
  5. Under **Signing keys** section, select **FETCHED SIGNING KEY**.
    - **Key URL**: Enter the JWKS URI as copied in [*Section 6.2: Retrieving OCI Identity Domain Metadata (JWKS URI)*](/v1/docs/using-fortanix-data-security-manager-with-oracle-cloud-infrastructure-ekm#62-retrieve-oci-identity-domain-metadata-jwks-uri).

Fortanix DSM retrieves OCI’s public signing keys (JWKS) from the Identity Domain’s JWKS endpoint to validate JWTs. If signing keys are not publicly accessible, Fortanix DSM cannot fetch the keys. Perform the following steps in OCI to make the signing keys publicly accessible:

This allows external services, such as Fortanix DSM, to retrieve the public signing keys required for JWT verification.
      1. Navigate to **Identity & Security → Domains** and select your Identity Domain.
      2. Go to **Settings → Edit Domain Settings**.
      3. Under **Access signing certificate**, enable **Configure client access**.
  6. **Assigning the new app to groups:** Select the group created in [*Section 9.3: Creating a Group*](/v1/docs/using-fortanix-data-security-manager-with-oracle-cloud-infrastructure-ekm#93-creating-a-group) from the list.
3. Click **SAVE** to add the new application.

*For more information about applications, refer to* [*Definitions*](https://support.fortanix.com/docs/dsm-definitions#50-applications)*.*

### 9.5 Creating a Security Object

The security object created in Fortanix DSM represents the cryptographic key used for OCI EKM operations. When OCI Vault performs encrypt or decrypt operations, the request is routed to Fortanix DSM, where the operation is executed using this key. The key material remains within Fortanix DSM and is never exposed to OCI.

Perform the following steps to generate an AES key in the Fortanix DSM:

1. In the DSM left navigation panel, click the **Security Objects** menu item, and then click **ADD SECURITY OBJECT** to create a new security object.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/using-fortanix-data-security-manager-with-oracle-cloud-infrastructure-ekm-image-vgm8l1l1.png)

**Figure 23: Adding security object**
2. On the **Add new Security Object** page:
  1. **Security Object name**: Enter the name for your security object. For example, **test-aes-key**.
  2. **Group**: Select the group as created in [*Section 9.3: Creating a Group*](/v1/docs/using-fortanix-data-security-manager-with-oracle-cloud-infrastructure-ekm#93-creating-a-group).
  3. Select **GENERATE**.
  4. In the **Choose a type** section, select the **AES** key type.
  5. In the **Key Size** section, select the size of the key as **256** bits.
  6. In the **Key operations permitted** section, select the **Encrypt** and **Decrypt** permissions.
3. Click **GENERATE** to create the new security object.

*For more information about security objects, refer to* [*Definitions*](https://support.fortanix.com/docs/dsm-definitions#60-security-objects)*.*

## 10.0 Create a Key Reference in OCI External Key Management Vault

When configuring an External Key Management Vault in OCI, you must create a Key Reference that maps to an existing security object in Fortanix DSM. The Key Reference acts as a logical pointer in OCI to the actual cryptographic key stored and managed in Fortanix DSM.

### 10.1 Prerequisites

Ensure the following:

- A security object (AES-256 key) is created in Fortanix DSM as described in [*Section 9.5: Creating a Security Object*](/v1/docs/using-fortanix-data-security-manager-with-oracle-cloud-infrastructure-ekm#95-creating-a-security-object).

### 10.2 Creating a Key Reference

Perform the following steps to create a Key Reference in an OCI External Key Management Vault:

1. In the OCI Console, navigate to your External Key Management Vault.
2. Click **Create Key Reference** and specify the following details:
  1. **Name**: Enter a logical name for the Key Reference in OCI.

> [!NOTE]
> NOTE
> 
> This is the OCI-side label and does not need to match the Fortanix DSM security object name.
  2. **Compartment**: Select the target compartment.
  3. **Key Shape**:
    - **Algorithm**: **AES**
    - **Key Length**: **256 bits**
  4. **External Key ID**: Enter the **Security Object name** created in Fortanix DSM. To copy this value, go to the detailed view of security object created in [*Section 9.5: Creating a Security Object*](/v1/docs/using-fortanix-dsm-with-oracle-cloud-infrastructure-ekm#95-creating-a-security-object), click the **COPY ID** drop down, and select **COPY OCI VAULT EKM KEY ID**. For example, **test-aes-key**.

> [!NOTE]
> NOTE
> 
> - **COPY OCI VAULT EKM KEY ID**: This option copies the security object name, which is used as the **External Key ID** when creating an OCI Key Reference.
> - **COPY OCI VAULT EKM KEY VERSION ID**: This option copies the security object UUID, which can be used as the **External Key Version ID** when rotating an OCI Key Reference. *For more information, refer to* [*Section 11.0: Key Rotation*](/v1/docs/using-fortanix-dsm-with-oracle-cloud-infrastructure-ekm#110-how-oci-vault-ekm-uses-the-fortanix-dsm-key)*.*
3. Click **Create Key Reference**.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/using-fortanix-data-security-manager-with-oracle-cloud-infrastructure-ekm-image-4kbwhceg.png)

**Figure 24: Create OCI key reference**

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/using-fortanix-data-security-manager-with-oracle-cloud-infrastructure-ekm-image-q2bb3tww.png)

**Figure 25: OCI Key Reference**

*For more information on the steps to add a Key Reference to the OCI External Key Management Vault, refer to* [*Oracle official documentation*](https://docs.oracle.com/en-us/iaas/Content/KeyManagement/Tasks/ekms_create_key_references.htm)*.*

> [!WARNING]
> WARNING
> 
> Once a Key Reference is created in OCI External Key Management Vault, **do not rename the corresponding security object in Fortanix DSM**. OCI maps the Key Reference to the Fortanix DSM key using the security object name provided as the External Key ID.
> 
> If the security object name is changed after the Key Reference is created:
> 
> - Fortanix DSM will no longer be able to locate the referenced security object.
> - Cryptographic operations may fail.

### 

### 10.3 How the Mapping is Used During Cryptographic Operations

OCI stores the External Key ID (DSM security object name) as the identifier used for all subsequent cryptographic requests.

When an OCI service performs an encryption or decryption operation:

- OCI Vault (EKM) forwards the request, including the External Key ID (DSM security object name) stored in the Key Reference.
- Fortanix DSM receives the request and locates the corresponding security object using the value provided.
- The cryptographic operation is performed entirely within Fortanix DSM.

The key material never leaves Fortanix DSM.

## 11.0 Key Rotation

OCI EKM supports key rotation by allowing an existing Key Reference to reference a new version of the external key stored in Fortanix DSM. When you rotate a key in Fortanix DSM, a new key version is created while the previous key version remains available for existing encrypted data. After rotating the key in Fortanix DSM, update the OCI Key Reference to use the new key version.

### 11.1 Rotating the Key in Fortanix DSM

Perform the following steps to rotate the security object:

1. Go to the detailed view of the security object created in [*Section 9.5: Creating a Security Object*](/v1/docs/using-fortanix-dsm-with-oracle-cloud-infrastructure-ekm#95-creating-a-security-object).
2. Click **ROTATE KEY**.
3. In the **Key Rotation** window, select **Generate new key**.

*For detailed instructions for key rotation, refer to* [*Fortanix Data Security Manager Key Lifecycle Management*](https://support.fortanix.com/docs/fortanix-data-security-manager-key-lifecycle-management#29-key-rotation)*.*
4. Click **ROTATE KEY**.
5. On the next screen, select both the check boxes to confirm your understanding of the action. Click **PROCEED**.

A new key version is created. The security object retains its original name, while the previous key version remains available for data encrypted before the key rotation.

### 11.2 Updating the OCI Key Reference

After rotating the Fortanix DSM key, update the OCI Key Reference so that OCI Vault references the latest external key version.

Perform the following steps:

1. Go to the detailed view of the security object created in [*Section 9.5: Creating a Security Object*](/v1/docs/using-fortanix-dsm-with-oracle-cloud-infrastructure-ekm#95-creating-a-security-object).
2. Click **COPY ID** drop down, and then select **COPY OCI VAULT EKM KEY VERSION ID**.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/fortanix-data-security-manager-with-oci-ekm-vault-integration-guide-v1.0-image-7xu0lx50.png)

**Figure 26: Copy OCI Vault EKM Key Version ID**
3. In OCI, navigate to **Identity & Security** → **External Key Management** → **Key Reference Version** tab**,** and click **Rotate Key Reference**.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/fortanix-data-security-manager-with-oci-ekm-vault-integration-guide-v1.0-image-f9fyfvnn.png)

**Figure 27: Rotate Key Reference**
4. In the **Rotate Key Reference** form, paste the copied OCI Vault EKM Key Version ID in the **External Key Version ID** field, and click **Rotate Key Reference**.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/fortanix-data-security-manager-with-oci-ekm-vault-integration-guide-v1.0-image-8f1mrpww.png)

**Figure 28: Enter external key version ID**

OCI creates a new Key Reference version that points to the rotated Fortanix DSM key.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/fortanix-data-security-manager-with-oci-ekm-vault-integration-guide-v1.0-image-it22i04d.png)

**Figure 29: Updated Key Reference Version**

## 12.0 How OCI Vault (EKM) Uses The Fortanix DSM Key

In the OCI EKM Vault, cryptographic keys are not stored or managed within OCI. Instead, all cryptographic operations are performed by the external key manager, Fortanix DSM.

The following steps describe how OCI Vault uses the key created in Fortanix DSM to perform cryptographic operations:

1. An OCI service requests a cryptographic operation (encrypt or decrypt) through OCI Vault.
2. OCI Vault that is configured for External Key Management, does not perform the operation locally and does not hold the key material.
3. OCI Vault authenticates with OCI Identity Domains using the confidential client application credentials and obtains a JWT access token containing the required audience and scope.
4. OCI Vault sends the request, along with the token, to the OCI API Gateway through the configured private endpoint.
5. The API Gateway forwards the request to Fortanix DSM.
6. Fortanix DSM:
  - Validates the JWT using OCI Identity Domain public signing keys.
  - Validates the token issuer, audience, and scope.
  - Confirms that the request is authorized to use the target key.
7. Fortanix DSM locates the configured security object (AES-256 key) and performs the requested cryptographic operation internally.
8. Only the result of the operation is returned through the API Gateway to OCI Vault and then back to the requested OCI service; the key material remains securely within Fortanix DSM.

Fortanix Data Security Manager (DSM) is the world’s first cloud service secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as other secrets such as passwords, API keys, tokens, or any blob of data. Your business-critical applications and containers can integrate with Fortanix DSM using legacy cryptographic interfaces (PKCS#11, CNG, and JCE) or using the native Fortanix DSM RESTful interface.