Identity as a Service:HUAWEI CLOUD IAM Identity Center and Alibaba Cloud IDaaS single sign-on

1. Configure in IDaaS

1. Log on to the IDaaS console. In the navigation pane on the left, click EIAM. Find the target IDaaS instance and click Manage in the Actions column.

2. Click Application Management > Applications > Add Application. Search for HUAWEI CLOUD-IAM Identity Center and click Add Application.

3. Confirm the application name, and then click Add.

4. On the Sign-In > SSO tab, configure the HUAWEI CLOUD IAM Identity Center application.

   1. SSO: Enable single sign-on.

   2. IAM Identity Center ACS URL: Enter the Assertion Consumer Service (ACS) URL obtained from HUAWEI CLOUD IAM Identity Center.

   3. IAM Identity Center Entity ID: Enter the Entity ID obtained from HUAWEI CLOUD IAM Identity Center. This is the publisher URL for IAM Identity Center.

   4. Application User: Select an application account.

   5. Authorize: Select Manually or All Users as needed.

5. In the Application Settings section, download the IdP Metadata file. This file is required for configuring the identity provider in HUAWEI CLOUD IAM Identity Center.

6. Under Application User, add the user accounts that require access.

   Important

   Ensure that the username in the IDaaS application matches the username in HUAWEI CLOUD IAM Identity Center.

2. Configure in IAM Identity Center

1. Log on to the HUAWEI CLOUD IAM Identity Center. In the navigation pane on the left, click Settings.

2. On the Identity Source tab, click Change To External Identity Provider to open the Change Identity Source page.

3. Obtain the service provider (SP) information: the IAM Identity Center Assertion Consumer Service (ACS) URL and the IAM Identity Center Publisher URL (Entity ID). Enter this information into the HUAWEI IAM Identity Center application in IDaaS.

4. In the Identity Provider (IdP) Information section, upload the IdP Metadata file that you downloaded from IDaaS, and then click Next.

5. Confirm the identity source information. Type CONFIRM and click OK in the lower-right corner.

6. Create and authorize a user.

   1. In the navigation pane on the left, choose User Management, and then click the Create User button in the upper-right corner. Enter the user information and assign the user to a user group.

   2. In the navigation pane on the left, click Multi-account Permissions > Account Permission Management to grant permissions to the user.

      1. Click the target account name to open its basic information page, and then click Assign Users/Groups.

      2. Select the checkbox next to the account that requires SSO, and then click Next.

      3. Select the checkbox next to the permission set, and then click Next.

      4. Confirm the user permission set and click OK. The permission is configured successfully.

3. Verify SSO

After the SSO configuration is complete, you can initiate an SSO logon from the IDaaS user portal.

1. Log on to the IDaaS user portal.

2. Click the HUAWEI CLOUD IAM Identity Center application.

3. The system automatically redirects you to the HUAWEI CLOUD IAM Identity Center without requiring you to authenticate again.

1. Configure in IAM Identity Center

1. On the Settings > Identity Source page, click the Automatic SCIM button.

2. The system automatically generates an SCIM Endpoint and an Access Token.

   Important

   This key is displayed only once. Copy and save it in a secure location. This key is required for the Bearer Token field during the IDaaS configuration.

2. Configure in IDaaS

1. In the HUAWEI CLOUD IAM Identity Center application, switch to the Provisioning tab. Enable Provision IDaaS Accounts to Application and set the Scope.

   Note

   Ensure that every account within the synchronization scope has an associated email address.

2. In the Basic Configuration, enter the SCIM Endpoint and Bearer Token that you obtained from the IAM Identity Center.

3. Operation Calls. You can subscribe to specific change events to receive instant push notifications. When a user within the IDaaS synchronization scope is modified, the system automatically triggers a synchronization to update the application in real time.

   Note

   The application's System for Cross-domain Identity Management (SCIM) protocol interface is not fully compliant with the standard. Because the group details interface cannot return member information, removing a user from a group cannot be synchronized automatically.

4. Field Mapping. This section displays the field mapping relationships for the SCIM synchronization process. You can edit these mappings as needed.

5. Mapping Identifiers. Mapping identifiers are the list of fields available for SCIM filter queries. They typically correspond to standard protocol and business fields and usually do not require modification.

6. Test Connection. After you save the configuration, you can use the Test Connectivity feature to verify that the configuration is correct.

7. One-Click Push. Administrators can use the Push Now feature to push all accounts within the synchronization scope to HUAWEI CLOUD IAM Identity Center.

3. Verify synchronization

1. Verification in IDaaS.

   After you click One-Click Push, accounts within the synchronization scope are synchronized to HUAWEI CLOUD IAM Identity Center. If the push is successful, the system reports that the task succeeded. You can view the logs on the Log > Provisioning > Tasks page.

2. Verification in HUAWEI CLOUD IAM Identity Center.

   In the navigation pane on the left of the IAM Identity Center, go to User Management to view the accounts that were synchronized from IDaaS. The Creation Method column shows Automatic for these accounts.