Overview of Virtual User SSO via SAML¶
The cloud platform supports identity federation with Security Assertion Markup Language (SAML), which is an open standard that many identity providers (IdPs) use. During identity federation, the cloud platform functions as a service provider (SP) and enterprises function as IdPs. This section describes how to configure identity federation and how identity federation works.
Caution
Ensure that your enterprise IdP supports SAML 2.0.
Configuring Identity Federation¶
The following describes how to configure your enterprise IdP and the cloud platform to trust each other.
Figure 1 Configuration of virtual user SSO via SAML¶
Create an IdP entity and establish a trust relationship: Create an IdP entity for your enterprise on the cloud platform. Then, upload the cloud platform metadata file to the enterprise IdP, and upload the metadata file of the enterprise IdP to the cloud platform.
Figure 2 Exchanging metadata files¶
Configure the enterprise IdP: Configure enterprise IdP parameters to determine what information can be sent to the cloud platform.
Configure identity conversion rules: Configure identity conversion rules to determine the IdP user identities and permissions on the cloud platform.
Figure 3 Mapping external identities to virtual users¶
Verify the federated login: Check whether the enterprise user can log in to the cloud platform through SSO.
(Optional) Configure a federated login entry: Configure the login link (see Figure 4) in the enterprise IdP to allow enterprise users to be redirected to the cloud platform from your enterprise management system.
Figure 4 SSO login model¶
How Identity Federation Works¶
Figure 5 shows the identity federation process between an enterprise management system and the cloud platform.
Figure 5 How identity federation works¶
Note
To view interactive requests and assertions with a better experience, you are advised to use Google Chrome and install SAML Message Decoder.
As shown in Figure 5, the process of identity federation is as follows:
A user opens the login link generated after the IdP creation in the browser. The browser sends an SSO request to the cloud platform.
The cloud platform authenticates the user against the metadata file of the enterprise IdP and constructs a SAML request to the browser.
The browser forwards the SAML request to the enterprise IdP.
The user enters their username and password on the login page. After the enterprise IdP authenticates the user's identity, it constructs a SAML assertion containing the user details and sends the assertion to the browser as a SAML response.
The browser responds and forwards the SAML response to the cloud platform.
The cloud platform parses the assertion in the SAML response, identifies the IAM user group mapping to the user based on the identity conversion rules, and issues a token to the user.
The SSO login is successful.
Note
The assertion must carry a signature; otherwise, the login will fail.