Identity as a Service:Tencent Cloud identity management

Applicable scope

You must activate the Machine Identity Management capability.

Add a cloud account

By adding a cloud account, you bring a Tencent Cloud primary account under IDaaS management and complete the identity provider and system role configuration in the Tencent Cloud CAM console. This enables IDaaS to automatically discover and synchronize the cloud roles under the account.

1. Log on to the IDaaS management console and select the target Instance List.

2. Add the cloud account information.

   a. In the left-side navigation pane, choose Asset Management > Asset Management > Cloud Identity.

   b. Click Add Cloud Account.

   c. In the Cloud Provider field, select Tencent Cloud, and then configure the following parameters:

   Parameter	Description
   Site	Select China Site or International Site based on the site of your Tencent Cloud account. The default value is China Site.
   Account ID	The primary account ID of the Tencent Cloud account that you want to add. The ID must be exactly 12 digits.
   Identity Provider Name	The name of the OIDC identity provider that will be created in Tencent Cloud CAM. The prefix idaas-eiam- is fixed by the system. You need to enter only the suffix. The suffix can contain only letters, digits, periods (.), underscores (_), and hyphens (-), and must start and end with a letter or digit. Make sure that the name does not conflict with the name of an existing identity provider in CAM. To view the existing names, go to the CAM console of the target cloud account and click Identity Provider > Role SSO.

   d. Click Next.

3. Configure the unified identity.

   Follow the on-screen instructions in IDaaS and complete the following configurations in the CAM console of the target Tencent Cloud account:

   a. Configure the identity provider.

   IDaaS displays the following parameters. Enter these parameters in the corresponding fields in Tencent Cloud CAM to create an OIDC identity provider:

   Parameter	Description
   Identity Provider Name	The name that you entered in the previous step, including the idaas-eiam- prefix. Use this name to create an identity provider with the same name in CAM.
   Identity Provider URL	The OIDC Issuer URL issued by IDaaS. Enter this value in the Provider URL field of the CAM identity provider.
   Client ID	The Audience identifier of IDaaS. Enter this value in the Audience field of the CAM identity provider.
   Signature Public Key	The JWKS-format signing public key that IDaaS automatically obtains. The value is masked on the page. Click the copy button to obtain the full content, and then enter it in the Signing Key field of the CAM identity provider.

   Note

   The identity provider URL is in the following format: https://<portal_address>/api/v2/iauths_system/oauth2. The value of <portal_address> can be found in the User Portal column of the IDaaS management console.

   b. Create a role.

   In the CAM console, create a role. Select the identity provider that you created in the previous step and set the usage condition. Enter the Audience value from the IDaaS page in the condition field. For the role name, use the fixed name idaas-eiam-system-role provided on the IDaaS page.

   Important

   The system role name idaas-eiam-system-role cannot be changed. IDaaS validates the role configuration based on this name.

   c. Create a custom policy.

   IDaaS displays the system-generated policy content. Copy the policy content and use the policy generator in the CAM console to create a custom policy.

   d. Authorize role permissions.

   In the CAM console, associate the custom policy created in step c with the role created in step b.

4. Click Start Detection. IDaaS verifies whether the system role configurations are correct.

   • Verification passed: A success message is displayed. Click Confirm to complete the cloud account addition.

   • Verification failed: An error message is displayed. Check and correct the configurations based on the error information, and then click Re-check.

After the configuration is complete, you can go to the Asset Management > Asset Management page to view the cloud account that you added. In the Actions column of the target cloud account, click Cloud Role Management to view the system role.

Add cloud roles

Bring the CAM roles under the target cloud account into IDaaS for unified role management and access control.

1. On the Asset Management > Asset Management > Cloud Identity page, select the cloud account that is already under management, and click Cloud Role Management in the Actions column.

   Note

   If the target cloud account is not under management, complete Add a cloud account first.

2. Click Add Cloud Role.

   a. Role Name: Select the CAM role that you want to bring into IDaaS from the drop-down list. The drop-down list automatically retrieves the available CAM roles under the Tencent Cloud account.

   b. Trust Policy: Follow the on-screen instructions in IDaaS to complete the trust policy configuration for the role in the CAM console of the cloud account.

3. Click Confirm to complete the cloud role addition.

After the configuration is complete, you can go to the Asset Management > Asset Management > Cloud Identity page to view the cloud account that you added. In the Actions column of the target cloud account, click Cloud Role Management to view the cloud roles that you added.

Delete cloud roles

Remove a CAM role under the target cloud account from IDaaS management.

1. On the Asset Management > Asset Management > Cloud Identity page, select the cloud account that is already under management, and click Cloud Role Management in the Actions column.

2. In the cloud role list, find the target cloud role and click the toggle switch in the Cloud Role Status column to disable the cloud role.

   Important

   Disabling a cloud role prevents applications and users from using that role. Make sure that you understand the business impact before you proceed.

3. In the Actions column, click Delete.

Delete a cloud account

Remove a Tencent Cloud account from IDaaS management.

On the Asset Management > Asset Management > Cloud Identity page, find the target cloud account and click Delete in the Actions column.