# 企业管理华为云上多租户的联邦认证
#### 场景描述
部分企业级用户在公有云上存在多账号，并且通过企业级IDP系统联邦登录至公有云对不同账号进行操作，需要提前通过API自动配置联邦认证。
本章节指导用户如何使用API调用的方式自动配置联邦认证。
#### 前提条件
账号进行注册或导入操作需要拥有Security Administrator权限。
#### 总体思路
进行华为云上多租户的联邦认证，步骤如下：
1. 注册身份提供商；
2. 注册映射；
3. 注册协议；
4. 导入Metadata文件；
5. 联邦登录。
涉及的接口如下：
- [注册身份提供商](https://support.huaweicloud.com/api-iam/iam_13_0204.html)
- [注册映射](https://support.huaweicloud.com/api-iam/iam_13_0304.html)
- [注册协议](https://support.huaweicloud.com/api-iam/iam_13_0404.html)
- [导入Metadata文件](https://support.huaweicloud.com/api-iam/iam_13_0504.html)
#### 步骤1：注册身份提供商
URI：PUT /v3/OS-FEDERATION/identity_providers/{id}
API文档详情请参见： [创建身份提供商 - KeystoneCreateIdentityProvider](https://support.huaweicloud.com/api-iam/iam_13_0204.html)
API Explorer在线调试请参见：[注册身份提供商](https://apiexplorer.developer.huaweicloud.com/apiexplorer/debug?product=IAM&api=KeystoneCreateIdentityProvider)
- 请求示例
  ```
  PUT https://iam.myhuaweicloud.com/v3/OS-FEDERATION/identity_providers/{id}
  ```
  
  ```
  {
       "identity_provider":{
           "description":"Stores ACME identities.",
           "enabled":true
       }
   }
  ```
  
- 响应示例
  ```
  {
      "identity_provider": {
          "remote_ids": [],
          "enabled": true,
          "id": "ACME",
          "links": {
              "self": "https://iam.myhuaweicloud.com/v3/OS-FEDERATION/identity_providers/ACME",
              "protocols": "https://iam.myhuaweicloud.com/v3/OS-FEDERATION/identity_providers/ACME/protocols"
          },
          "description": "Stores ACME identities."
      }
  }
  ```
  
 
#### 步骤2：注册映射
URI： PUT /v3/OS-FEDERATION/mappings/{id}
API文档详情请参见：[注册映射 - KeystoneCreateMapping](https://support.huaweicloud.com/api-iam/iam_13_0304.html)
API Explorer在线调试请参见：[注册映射](https://apiexplorer.developer.huaweicloud.com/apiexplorer/debug?product=IAM&api=KeystoneCreateMapping)
- 请求示例
  ```
  PUT https://iam.myhuaweicloud.com/v3/OS-FEDERATION/mappings/{id}
  ```
  ```
  {
       "mapping":{
           "rules":[
               {
                   "local":[
                       {
                           "user":{
                               "name":"LocalUser"
                           }
                       },
                       {
                           "group":{
                               "name":"LocalGroup"
                           }
                       }
                   ],
                   "remote":[
                       {
                           "type":"UserName"
                       },
                       {
                           "not_any_of":[
                               "Contractor",
                               "Guest"
                           ],
                           "type":"orgPersonType"
                       }
                   ]
               }
           ]
       }
   }
  ```
  
- 响应示例
  ```
  {
       "mapping":{
           "id":"ACME",
           "links":{
               "self":"https://iam.myhuaweicloud.com/v3/OS-FEDERATION/mappings/ACME"
           },
           "rules":[
               {
                   "local":[
                       {
                           "user":{
                               "name":"LocalUser"
                           }
                       },
                       {
                           "group":{
                               "name":"LocalGroup"
                           }
                       }
                   ],
                   "remote":[
                       {
                           "type":"UserName"
                       },
                       {
                           "not_any_of":[
                               "Contractor",
                               "Guest"
                           ],
                           "type":"orgPersonType"
                       }
                   ]
               }
           ]
       }
   }
  ```
  
#### 步骤3：注册协议
URI：PUT /v3/OS-FEDERATION/identity_providers/{idp_id}/protocols/{protocol_id}
API文档详情请参见：[注册协议 - KeystoneCreateProtocol](https://support.huaweicloud.com/api-iam/iam_13_0404.html)
API Explorer在线调试请参见：[注册协议](https://apiexplorer.developer.huaweicloud.com/apiexplorer/debug?product=IAM&api=KeystoneCreateProtocol)
- 请求示例
  ```
  PUT https://iam.myhuaweicloud.com/v3/OS-FEDERATION/identity_providers/{idp_id}/protocols/{protocol_id}
  ```
  ```
  {
       "protocol":{
           "mapping_id":"ACME"
       }
   }
  ```
  
- 响应示例
  ```
  {
       "protocol":{
           "id":"saml",
           "links":{
               "identity_provider":"https://iam.myhuaweicloud.com/v3/OS-FEDERATION/identity_providers/ACME",
               "self":"https://iam.myhuaweicloud.com/v3/OS-FEDERATION/identity_providers/ACME/protocols/saml"
           },
           "mapping_id":"ACME"
       }
   }
  ```
  
#### 步骤4：导入metadata文件
URI：POST /v3-ext/OS-FEDERATION/identity_providers/{idp_id}/protocols/{protocol_id}/metadata
API文档详情请参见：[导入Metadata文件 - CreateMetadata](https://support.huaweicloud.com/api-iam/iam_13_0504.html)
API Explorer在线调试请参见：[导入Metadata文件](https://apiexplorer.developer.huaweicloud.com/apiexplorer/debug?product=IAM&api=ImportMetadataFile)
- 请求示例
  ```
  POST https://iam.myhuaweicloud.com/v3-ext/OS-FEDERATION/identity_providers/{idp_id}/protocols/{protocol_id}/metadata
  ```
  ```
  {
       "domain_id":"d78cbac186b744899480f25bd022....",
       "metadata":"$metadataContent",
       "xaccount_type":""
   }
  ```
  
- 响应示例
  ```
  {
       "message":"Import metadata successful"
   }
  ```
  
 
#### 步骤5：联邦登录
完成云上多租户联邦认证配置。联邦登录详情参考：[身份提供商](https://support.huaweicloud.com/usermanual-iam/iam_08_0001.html)。