Identity as a Service:Create a federated credential

Procedure

1. Log on to the IDaaS console. In the left-side navigation pane, choose EIAM. Select your IDaaS instance and click Console in the Actions column.

2. Click Application Management > M2M Application > Add Application.

3. Create a federated credential on the General tab. Go to the Certificate Management section and view the three federated Authentication Type options: PCA, OIDC, and PKCS#7.

   Note

   For details about the features and use cases of each federated credential provider, see Federated credential providers overview.

   1. Select the PCA credential and click Add Application Federated Credential. Configure the following parameters, and then click Confirm.

      Parameter	Description
      Federated Credential Provider	Select an existing PCA federated credential provider. If you have not created one, see Create a PCA federated credential provider.
      Application Federated Credential Type	PCA
      Application Federated Credential Name	The name of the federated credential cannot be changed once saved. Please enter it carefully. Supported characters: lowercase letters, digits, underscores (_), and hyphens (-)..
      Verification	The verification mode determines how IDaaS generates the verification condition of this federated credential. Two modes are supported: certificate mode and expression verification mode for client certificate fields. Certificate: a shortcut mode. If you need to verify only the common name (CN) of the client certificate, select this mode. Enter the CN value of the client certificate, and IDaaS automatically generates an expression and populates the verification condition field. Expression Verification for Client Certificate Field : an advanced mode. You can customize an expression to verify multiple client certificate fields.
      Client Certificate Common Name (CN)	Required if you select Certificate.
      Verification Expression	Required if you select Expression Verification for Client Certificate Field . This field verifies the request parameters that a client submits when it calls the token endpoint of the M2M authorization server. Only the specific request parameters that meet the verification condition can obtain an access token issued by IDaaS. For PCA federated credentials, it primarily verifies the client certificate content. The trust condition supports up to 10,240 characters. Note During verification, IDaaS first validates the trust condition configured for the PCA federated credential provider. After the trust condition passes, IDaaS validates the verification condition configured for the PCA federated credential.
      Description	The description field specifies the purpose of this federated credential. The maximum length is 128 characters.
      Attribute Mapping	Attribute mapping is an advanced federated credential feature that customizes the sub field in the access token. After the resource server enables a custom principal ID, the system replaces the original sub field content with the field value expression (the unique client identity) configured in attribute mapping. The format changes from <clientId> to <clientId>:<client:activeSubjectUrn>, where <client:activeSubjectUrn> is the result of the attribute mapping expression.

   2. Select the OIDC credential and click Add Application Federated Credential. Configure the following parameters, and then click Confirm.

      Parameter	Description
      Federated Credential Provider	Select an existing OIDC federated credential provider. If you have not created one, see Create an OIDC federated credential provider.
      Application Federated Credential Type	OIDC
      Application Federated Credential Name	The name of the federated credential cannot be changed once saved. Please enter it carefully. Supported characters: lowercase letters, digits, underscores (_), and hyphens (-)..
      Verification	The verification mode determines how IDaaS generates the verification condition of this federated credential. Kubernetes: enter the Namespace, Service Account, and Principal ID fields of your Kubernetes cluster. IDaaS automatically generates the principal ID field in the system:serviceaccount:<namespace>:<serviceaccount> format. Principal ID: enter the value of the sub field in the service account token obtained from your Kubernetes cluster. Expression Verification for Claims Field: an advanced mode. You can customize an expression to verify multiple claims in the service account token.
      Verification Expression	This field verifies the request parameters that a client submits when it calls the token endpoint of the M2M authorization server. Only the specific request parameters that pass verification can obtain the access token issued by IDaaS. For OIDC federated credentials, the verification condition primarily validates the claims in the service account token passed to the token endpoint. The trust condition supports up to 10,240 characters.
      Description	The description field specifies the purpose of this federated credential. The maximum length is 128 characters.
      Attribute Mapping	Attribute mapping is an advanced federated credential feature that customizes the sub field in the access token. After the resource server enables a custom principal ID, the system replaces the original sub field content with the field value expression (the unique client identity) configured in attribute mapping. The format changes from <clientId> to <clientId>:<client:activeSubjectUrn>, where <client:activeSubjectUrn> is the result of the attribute mapping expression.

   3. Select the PKCS#7 credential and click Add Application Federated Credential. Configure the following parameters, and then click Confirm.

      Parameter	Description
      Federated Credential Provider	Select an existing PKCS#7 federated credential provider. If you have not created one, see Create a PKCS#7 federated credential provider.
      Application Federated Credential Type	PKCS#7
      Application Federated Credential Name	The name of the federated credential cannot be changed once saved. Please enter it carefully. Supported characters: lowercase letters, digits, underscores (_), and hyphens (-)..
      Verification	The verification mode determines how IDaaS generates the verification condition of this federated credential. Cloud Server: enter only the instance ID of an Alibaba Cloud ECS or ECI instance, or of an Amazon EC2 instance. IDaaS automatically generates the related expression. Expression Verification for Signature Value Field: an advanced mode. You can customize an expression to verify the fields in the PKCS#7 signature.
      Instance ID	If you select the cloud server instance mode, enter the ID of the cloud server instance to verify.
      Verification Expression	This field verifies the request parameters that a client submits when it calls the token endpoint of the M2M authorization server. Only the specific parameters that meet the verification condition can obtain the access token issued by IDaaS. For PKCS#7 federated credentials, it primarily verifies the signature fields. The trust condition cannot exceed 10,240 characters.
      Description	The description field specifies the purpose of this federated credential. The maximum length is 128 characters.
      Attribute Mapping	Attribute mapping is an advanced federated credential feature that customizes the sub field in the access token. After the resource server enables a custom principal ID, the system replaces the original sub field content with the field value expression (the unique client identity) configured in attribute mapping. The format changes from <clientId> to <clientId>:<client:activeSubjectUrn>, where <client:activeSubjectUrn> is the result of the attribute mapping expression.

Next steps

• M2M client token call examples

• Federated credential providers overview

• Manage federated credential provider

• Use federated credential expressions