Identity as a Service:Manage federated credential provider

Procedure

1. Log on to the IDaaS Management Console. In the left-side navigation pane, select EIAM. Select the target IDaaS instance and, in the Actions column, click Manage.

2. Click Sign-In > Authentication Configuration > Federated Credential Provider Management > Add Federated Credential Provider.

3. On the Add Federated Credential Provider page Select provider type, select the federated credential provider type based on your needs, such as PCA, OIDC, or PKCS#7.

   Note

   For more information about the features and application scenarios of each federated credential provider, see Federated credential providers overview.

4. After you make the selection, click Next and fill in the following configuration parameters. After you complete the configuration, click Confirm.

   1. PCA: A Private CA (Private Certificate Authority) is a certificate authority (CA) that an organization or enterprise runs internally. It issues and manages digital certificates that are valid only within an internal network or a specific trust domain. The PCA federated credential provider is mainly applicable to personal development computers or entities equipped with a Trusted Platform Module (TPM).

      Field	Description
      Federated Credential Provider	The name can contain lowercase letters, digits, underscores (_), and hyphens (-), and cannot exceed 64 characters in length.
      Provider Type	PCA
      Network Access Endpoint	IDaaS uses the network endpoint capability to access the certificate revocation list of the PCA root certificate and ensure the validity of the root certificate. The shared endpoint is a shared public network egress. If you have purchased the dedicated endpoint capability, you can use the dedicated endpoint.
      Fill in Verification Certificate	The root certificate must be in PEM format, starting with "-----BEGIN CERTIFICATE-----" and ending with "-----END CERTIFICATE-----". You can upload up to two root certificates for later root certificate rotation.
      Trust Condition	The trust condition validates the input parameters when a client calls the token endpoint of the M2M authorization server. This ensures that only requests that meet the requirements can obtain an access token issued by IDaaS. In the PCA scenario, this condition validates the client certificate content. The maximum length is 10,240 characters.
      Description	The description field explains the purpose of the federated credential provider and cannot exceed 128 characters in length.

   2. OIDC: OIDC (OpenID Connect) is an authentication protocol based on OAuth 2.0. It is widely used in scenarios that require federated identity authentication with an identity provider. It is especially suitable for services deployed in environments such as Kubernetes pods, GitHub Actions, CI/CD pipelines, Azure virtual machines, and Google Cloud Compute Engine.

      Field	Description
      Federated Credential Provider	The name can contain lowercase letters, digits, underscores (_), and hyphens (-), and cannot exceed 64 characters in length.
      Provider Type	OIDC
      Network Access Endpoint	IDaaS uses the network endpoint capability to access the issuer address or the JWKs address, and dynamically resolves the address to obtain the verification public key. The shared endpoint is a shared public network egress. If you have purchased the dedicated endpoint capability, you can use the dedicated endpoint.
      Trust Source	The trust source refers to how the OIDC federated credential provider obtains the verification public key when it parses the OIDC token passed in by the user. There are three ways to obtain the verification public key: static configuration, issuer address parsing, and public key address parsing. When you select Issuer Address Parsing, enter only the issuer address. When you select Public Key Address Parsing, enter the address from which the verification public key is obtained. When you select Static Configuration, manually enter the public key information in the verification public key field.
      Issuer	Enter the issuer of the OIDC token that the client passes in when it calls the token endpoint of the IDaaS authorization server. The issuer must use the HTTPS protocol and can be up to 1024 characters in length. Important After the issuer is entered, it cannot be updated. Check it carefully.
      ResourceServer Identifier	Enter the audience of the OIDC token that the client passes in when it calls the token endpoint of the IDaaS authorization server. You can specify up to 5 audience identifiers, each up to 256 characters in length. The default value of the audience identifier is the domain name of the current IDaaS instance, which indicates that the audience of the OIDC token issued by the client is the IDaaS instance. If needed, you can delete or modify it. Note If the audience claim passed to the OIDC token endpoint is not the IDaaS instance domain name, modify this value. Otherwise, calls to the token endpoint fail.
      Verification Key	This value is required when the trust source is set to static configuration.
      Trust Condition	The trust condition validates the input parameters, such as the OIDC token content, when a client calls the token endpoint of the M2M authorization server. This ensures that only requests that meet the conditions can obtain an access token issued by IDaaS. The issuer and audience identifier are required baseline fields. The maximum length is 10,240 characters.
      Description	The description field explains the purpose of the federated credential provider and cannot exceed 128 characters in length.

   3. PKCS#7: PKCS#7 is a fundamental standard in the Public Key Infrastructure (PKI). It is widely used in scenarios that require data integrity and confidentiality. It is especially suitable for services deployed in cloud vendor environments such as Alibaba Cloud Elastic Compute Service (ECS), Alibaba Cloud Elastic Container Instance (ECI), and AWS EC2.

      Field	Description
      Federated Credential Provider	The name can contain lowercase letters, digits, underscores (_), and hyphens (-), and cannot exceed 64 characters in length.
      Provider Type	PKCS#7
      Trust Source	Select the Alibaba Cloud type when the client service is deployed on Alibaba Cloud ECS. Select the AWS type when the client service is deployed on AWS EC2.
      Signature Validity Period	The signature validity period field specifies the validity period of the PKCS#7 signature that the client passes in when it calls the token endpoint of the IDaaS authorization server. The default validity period for Alibaba Cloud is 3600 seconds. The validity period for AWS is 30 days.
      Signature Timestamp Expression	This field shows how IDaaS parses the signing time of the incoming PKCS#7 signature. This field cannot be modified. Alibaba Cloud: pkcs7.payload.jsonData.audience.signingTime AWS: pkcs7.signingTime
      Enter the root certificate	Upload the root certificate used for the PKCS#7 signature. Alibaba Cloud: Alibaba Cloud currently uses the same certificate globally, and IDaaS has filled in the Alibaba Cloud root certificate by default. AWS: You must use an RSA-2048 root certificate. Other types, such as PKCS#7, fail verification. The root certificate differs for each AWS region. Select the root certificate for the region where the client service is deployed. If the service is deployed in multiple regions, you can upload multiple root certificates. For details, see AWS public certificates for instance identity document signatures.
      Account ID	Enter the ID of the cloud account that owns the cloud server on which the client service is deployed. The maximum length is 128 characters.
      Instance ID Signature	Default value: the IDaaS instance ID.
      Description	The description field explains the purpose of the federated credential provider and cannot exceed 128 characters in length.

5. After you create a federated credential provider, you can manage it. For example, you can use Status to enable or disable the provider, view Details, or Modify.

References

• Federated credential providers overview

• Create a federated credential

• Use federated credential expressions