Configure user-based single sign-on (SSO) between Alibaba Cloud Identity as a Service (IDaaS) and Tencent Cloud so that enterprise users can access Tencent Cloud resources as Cloud Access Management (CAM) users without entering Tencent Cloud credentials.
How it works
IDaaS acts as the identity provider (IdP) and Tencent Cloud acts as the service provider (SP). When a user initiates SSO, IDaaS authenticates the user and Tencent Cloud maps them to an existing CAM user. An IdP metadata file establishes the trust relationship between the two systems.
There are two ways to initiate SSO:
-
IdP-initiated SSO: The user logs on to the IDaaS application portal and clicks the Tencent Cloud application icon.
-
SP-initiated SSO: The user opens the Tencent Cloud logon page, clicks CAM User, and then clicks User-based SSO. Tencent Cloud redirects the user to IDaaS for authentication.
Prerequisites
Before you begin, make sure you have:
-
An IDaaS instance with EIAM enabled
-
Your Tencent Cloud account ID (hover over your profile picture on the Tencent Cloud console
Procedure
Step 1: Add an application in the IDaaS console
-
Log on to the IDaaS console.IDaaS console
-
On the EIAM page, find your instance and click Manage in the Actions column.
-
In the left-side navigation pane, click Applications
-
Search for Tencent Cloud User-based SSO and click Add Application.
-
Confirm the application name and click Add.
Step 2: Configure SSO for the application
After the application is added, IDaaS redirects you to the SSO tab automatically.
-
Enter your Tencent Cloud account ID.
-
From the Application Username drop-down list, select the attribute to use as the primary key for SSO. You must set this attribute to the prefix of Tencent Cloud CAM users. If you selected Application Username, complete the following steps: Screenshots showing Case A (IDaaS Username selected): Screenshots showing Case B (Application Username with mapping):
-
Click the Application User tab.
-
Click Add Application User and search for the IDaaS account to use for SSO.
-
Enter the CAM username and click Save.
Scenario Selection Your IDaaS account name matches the CAM username Select IDaaS Username Your IDaaS account name differs from the CAM username Select Application Username, then configure the mapping on the Application User tab (see sub-steps below) 
-
-
Set the Authorize parameter to All Users for testing. This skips the step of granting permissions to individual IDaaS accounts.
-
In the Application Settings section, download the IdP metadata file to your computer. This file is required to configure the trust relationship in Tencent Cloud.
Step 3: Configure user-based SSO in Tencent Cloud
-
Log on to the Tencent Cloud CAM console.
-
In the left-side navigation pane, choose Identity Provider > User SSO.
-
On the User SSO page, turn on User SSO.
-
Upload the IdP metadata file you downloaded in step 2, and then click Save.
Step 4: Grant permissions to CAM users
Skip this step if you are only testing SSO.
For existing CAM users that need access to Tencent Cloud resources:
-
In the left-side navigation pane of the Tencent Cloud CAM console, choose user > User List.
-
On the User List page, find the CAM user and click Authorization in the operate column.
For details on syncing accounts from IDaaS to Tencent Cloud automatically, see Synchronize accounts - IDaaS event callback.
Step 5: Test SSO
IdP-initiated SSO
-
Log on to the IDaaS application portal using an IDaaS account authorized for Tencent Cloud SSO.
-
Click the Tencent Cloud User-based SSO icon.
SP-initiated SSO
-
Open the Tencent Cloud logon page in a private browser window.
-
Click CAM User at the bottom of the page, then click User-based SSO.
-
If you are already logged on to the IDaaS application portal, Tencent Cloud grants access immediately. Otherwise, you are redirected to the IDaaS application portal to log on first.
Troubleshooting
SSO fails immediately after setup
Check that the IdP metadata file you uploaded to Tencent Cloud is the one downloaded from the IDaaS console in step 2, not an older or modified version. Re-download the file and re-upload it if necessary.
The user is authenticated by IDaaS but cannot access Tencent Cloud resources
The CAM user likely has no permissions assigned. Complete step 4 to grant the appropriate permissions to the CAM user in the Tencent Cloud CAM console.
The user cannot be found on the Tencent Cloud side after SSO
The username mapping is incorrect. Verify that the Application Username attribute in the IDaaS SSO configuration matches the prefix of the target CAM user. If the names differ, use the Application Username option and configure the mapping on the Application User tab.
User SSO is not enabled
Confirm that the User SSO toggle is turned on in the Tencent Cloud CAM console under Identity Provider > User SSO.