The IDaaS machine-to-machine (M2M) federated credential capability includes the PCA, OIDC, and PKCS#7 federated credential providers. The following sections describe the core features, use cases, and configuration procedures of each provider.
PCA federated credential provider
Private Certificate Authority (PCA) is a fully managed service designed to create and manage private digital certificates for internal enterprise use.
Core features
Internet of Things (IoT) and connected vehicle device security: pre-provisions a unique digital certificate for each device. The certificate enables device identity authentication and two-way secure communication, such as MQTT platform communication, and prevents unauthorized access and data tampering.
Software and firmware signing: issues signing certificates for software and firmware to verify legitimacy and prevent tampering (for example, firmware verification for Autel charging stations).
Internal resource protection: secures internal resources such as servers, applications, and containers to meet regulatory compliance requirements (for example, data security requirements in the finance and healthcare industries).
Cross-account and cross-region certificate management: supports cross-account sharing of root CAs and regional issuing CAs. This simplifies large-scale certificate deployment, such as the PKI architecture redesign during the StubHub cloud migration.
Use cases
In M2M use cases, PCA federated credentials resolve secure interoperability challenges between heterogeneous systems by using unified device identity management and cross-domain trust mechanisms. They are particularly suitable for:
Large-scale device connectivity
Cross-organization collaboration environments
Industries with strict compliance requirements
Configuration procedure
If your enterprise or organization has a self-managed PCA, you can create a federated credential provider. Use the PCA signing capability to sign a JSON Web Token (JWT). When you call the token endpoint of the IDaaS authorization server, select the PCA federated credential capability and provide the root certificate, intermediate certificate list, and client certificate. You then complete the call chain and get an Access Token issued by IDaaS.
OIDC federated credential provider
OIDC is short for the OpenID Connect protocol. It is widely used for single sign-on (SSO), cross-organization identity federation, third-party identity provider integration, and secure API calls.
Core features
The OIDC protocol provides an authentication layer based on OAuth 2.0 that lets client services securely verify user identities and get user information.
Use cases
In M2M use cases, if your client service is deployed in one of the following environments, use OIDC federated credentials:
Kubernetes pod
Alibaba Cloud Container Service for Kubernetes (ACK) cluster with RRSA support
GitHub workflow
CI/CD pipeline
Azure VM
Google Cloud Compute Engine
Configuration procedure
Get an OIDC token from the container or cloud server.
When you call the token endpoint of the IDaaS authorization server, select the OIDC federated credential capability.
Provide the public key for signature verification.
Complete the call chain to get an Access Token.
PKCS#7 federated credential provider
PKCS#7 is a fundamental standard in public key infrastructure (PKI) and is widely used where data integrity and confidentiality are required.
Core features
Financial transaction security: signs and encrypts bank transaction data to ensure the authenticity and integrity of transaction instructions. For example, banks use PKCS#7 to protect sensitive operations such as transfers and payments.
E-government document signing: government agencies use PKCS#7 to digitally sign electronic documents and give them legal effect equivalent to a physical seal. Examples include electronic official documents, legal contracts, and identity verification.
Data signing and encryption: PKCS#7 supports digital signatures and encryption for messages. It is widely used to verify data sources and prevent tampering, as in file exchange between enterprises and software distribution. PKCS#7 formats such as .p7b and .p7c can contain multiple signatures and certificates, which makes them suitable for complex trust chain management.
Use cases
PKCS#7 federated credentials apply to client services in the following cloud server environments:
Alibaba Cloud Elastic Compute Service (ECS) or Elastic Container Instance (ECI)
Amazon EC2
Configuration procedure
Get a PKCS#7 signature from the cloud server metadata signature endpoint.
When you call the token endpoint of the IDaaS authorization server, select the PKCS#7 federated credential capability.
Provide the root certificate for signature verification.
Complete the call chain to get an Access Token.
Summary
IDaaS provides three federated credential provider capabilities to meet M2M secure authentication requirements in different use cases. You can select the federated credential solution that best fits your business requirements and technical architecture.