DocsICP FilingConsole
Documentation
Home Page Identity as a Service EIAM User Guide Application Management Standard Applications Common application configurations Huawei Cloud SSO

Huawei Cloud SSO

Updated at:
Copy as MD
Product
My Favorites

Configure single sign-on (SSO) for Huawei Cloud users in IDaaS. With SSO, your enterprise members can log in to Huawei Cloud with their enterprise accounts. In Huawei Cloud, this process is called federated identity authentication.

Procedure

Step 1: Create an application

  1. Log on to the IDaaS management console.

  2. Select an IDaaS instance and click Console in the Actions column.

  3. Go to Applications > Add Application > Marketplace, search for Huawei Cloud SSO. Click Add Application.

  4. Confirm the application name and click Add.

Step 2: Configure single sign-on for the application

  1. After you add the application, you are automatically redirected to the application's SSO configuration page, where you complete the configuration.

  2. Enter the Logon URL address (you get this address in Step 3 below).

    Select an application account name attribute. When a user performs single sign-on, this attribute is used as the primary key to map the user to an IAM user in Huawei Cloud. This enables the user to log in to Huawei Cloud.

    For testing only, set Scope to All Users so that you can skip assigning permissions to IDaaS accounts.

  3. In the Application Settings section, click Download IdP Metadata and save the file to your computer. This file is used to establish the trust relationship between Huawei Cloud and IDaaS.

Step 3: Configure user SSO in Huawei Cloud

  1. Log in to the Huawei Cloud IAM console.

  2. In the left-side navigation pane, click Identity Provider.

  3. Click Create IdP.

  4. Enter a name and click OK.

  5. Click Modify Identity Provider, or click Modify on the identity provider list page.

  6. In the Metadata Configuration section, click Add File and select the file that you downloaded from IDaaS in Step 2 (the IdP Metadata). Click Upload File and confirm the metadata configuration. Usually, no modification is required.

  7. Copy the Logon URL and, as instructed in Step 2 above, paste it into the Logon URL address on the Huawei Cloud SSO application details page. Click OK to complete identity provider creation.

Step 4: Verify SSO

You can now log in to Huawei Cloud SSO. Choose either of the following methods to initiate SSO.

  1. With an IDaaS account that has permissions on the Huawei Cloud SSO application, log on to the IDaaS application portal and click the Huawei Cloud SSO icon on the page to initiate single sign-on. You are then logged in to Huawei Cloud as a federated user.

  2. In a private or incognito browser window, open the Huawei Cloud login page, click More Login Options, and select Corporate Federation User.

  3. Enter your original Huawei Cloud account name or tenant name, select the identity provider, and click Go to Sign In.

  4. After you click, if you are already logged on to the IDaaS application portal, you are logged in directly to Huawei Cloud as a federated user. Otherwise, you are redirected to the IDaaS login page. After you log on to IDaaS, you are automatically logged in to Huawei Cloud.

Step 5: Configure identity conversion rules

After a user performs single sign-on to Huawei Cloud as a federated user, the username in Huawei Cloud is "FederationUser" by default. The federated user can access Huawei Cloud but has no permissions. You can configure identity conversion rules in the Huawei Cloud IAM console to achieve the following goals:

  • Display different usernames in Huawei Cloud for the users of your enterprise management system.

  • Grant the users of your enterprise management system permissions to use Huawei Cloud resources.

For details, see the official Huawei Cloud documentation: Configure identity conversion rules.

Previous：Tencent Cloud role-based SSONext：Baidu AI Cloud Single Sign-On for Users