Identity as a Service:Enable automatic group-based role SSO with IDaaS EIAM and Tencent Cloud CAM

1. Basic configuration

1. In IDaaS, create a SAML application.

   1. Log on to the IDaaS console. Select the IDaaS instance and click Manage in the Actions column.

   2. Go to Applications > Standard Protocols > Add Application and add a SAML 2.0 application.

   3. Enter an application name and click Add.

2. Obtain the Tencent Cloud SAML metadata.

   1. Download and save the Tencent Cloud federated metadata XML document, or copy this link: http://cloud.tencent.com/saml.xml.

   2. On the SAML 2.0 application configuration page, paste the Tencent Cloud federated metadata URL into the Enter the URL of the metadata field. Click Parse to complete the configuration.

      

   3. Download the IdP Metadata file. You will upload this file to the identity provider page in Tencent Cloud CAM.

2. Role configuration

1. In Tencent Cloud, create a SAML identity provider.

   1. Log on to the Tencent Cloud CAM console and go to Identity Provider > Role SSO.

   2. Click Create Identity Provider, select SAML as the provider type, and enter an Identity Provider Name, such as idaas-saml-standard.

   3. Upload the IdP Metadata file that you downloaded from IDaaS. Click Next to create the provider.

2. Create a role.

   1. In the CAM console, go to Role > Create Role and select Identity Provider.

   2. Set Identity Provider Type to SAML. Select the identity provider that you created in the previous step, idaas-saml-standard. Select Allow Current Role To Access Console.

   3. Select a role policy and configure role tags as needed. Then, click Next.

   4. Enter a role name, such as role1, and click Complete.

3. User group configuration

1. In IDaaS, create a user. Log on to the IDaaS console and go to Accounts and Orgs > Accounts > Create Account. Create a user, such as emp001.

2. In IDaaS, Create Group. Go to Account > Group > Create Group.

   1. Enter a Group Name, such as group01. Enter an External ID, such as role1.

      Important

      The External ID must be the same as the role name that you created in Tencent Cloud CAM.

      

   2. Add the user you created (emp001) to the group you created (group01).

3. Grant application authorization.

   1. On the SAML 2.0 application details page in IDaaS, go to Sign-In > Authorize.

   2. Grant the SAML application authorization to the group (group01).

4. Advanced SAML configuration

On the SAML 2.0 application details page, click Show Advanced Settings and add the following Attribute Statements:

• Attribute Statements 1: Role mapping

  • Key: https://cloud.tencent.com/SAML/Attributes/Role

  • Value: SamlArray(ArrayMap(user.groups, StringReplace("qcs::cam::uin/{AccountID}:roleName/{RoleName},qcs::cam::uin/{AccountID}:saml-provider/{ProviderName} ", "$roleName", __item.groupExternalId)))

    Note

    • Replace {AccountID} with your Tencent Cloud account ID.

    • Replace {RoleName} with the name of the role you created for the identity provider in Tencent Cloud.

    • Replace {ProviderName} with the name of the SAML identity provider you created in Tencent Cloud.

• Attribute Statements 2: Session name

  • Key: https://cloud.tencent.com/SAML/Attributes/RoleSessionName

  • Value: user.username

5. Verify the configuration

1. Log on to the IDaaS EIAM portal. Use the user you created (emp001) to access the SAML 2.0 application.

2. The system automatically redirects you to the role selection page in the Tencent Cloud console. Select the role (role1) to complete the logon.