Obtaining an Unscoped Token (IdP Initiated)

Function

This API is used to obtain an unscoped token through IdP-initiated federated identity authentication.

Unscoped tokens cannot be used for authentication. You need to use an unscoped token in your call to Obtaining Temporary Access Keys and Security Tokens of a Federated User to obtain the temporary access key and security token for accessing cloud services.

The API can be called using both the global endpoint and region-specific endpoints.

• This API can be called using the CLI. The client can call this API to obtain a SAML response in IdP-initiated authentication mode and obtain an unscoped token through a browser.

Authorization Information

You do not need to obtain permissions to call this API.

URI

POST /v3.0/OS-FEDERATION/tokens

Request Parameters

Perform the following procedure to obtain a SAML response:

1. Visit https://idp.example.org/idp/profile/SAML2/Unsolicited/SSO?providerId=iam.example.com using a browser.

   idp.example.org: Entity ID in the IdP metadata

   iam.example.com: Entity ID in the SP metadata

2. On the displayed identity provider login page, enter a username and then click Login (password-free login is supported). On the new page that is displayed, press F12 and click Accept. Obtain the SAML response from POST as shown in the following figure.
   Figure 1 Obtaining a SAML response
   

Response Parameters

Example Request

Request for obtaining an unscoped token (IdP initiated)

POST https://iam.myhuaweicloud.eu/v3.0/OS-FEDERATION/tokens

SAMLResponse=PD94b...

Example Response

Status code: 201

The request is successful.

Parameters in the response header
X-Subject-Token:MIIatAYJKoZIhvcNAQcCoIIapTCCGqECAQExDTALB...

Parameters in the response body
{
    "token": {
        "expires_at": "2020-02-13T14:21:34.042000Z",
        "methods": [
            "mapped"
        ],
        "issued_at": "2020-02-12T14:21:34.042000Z",
        "user": {
            "OS-FEDERATION": {
                "identity_provider": {
                    "id": "ACME"
                },
                "protocol": {
                    "id": "saml"
                },
                "groups": [
                    {
                        "id": "06aa22601502cec4a23ac0084a74038f",
                        "name": "admin"
                    }
                ]
            },
            "domain": {
                "name": "IAMDomain",
                "id": "06ba0970a097acc0f36c0086bb6cfe0"
            },
            "name": "FederationUser",
            "id": "LdUTYSC7zmJVIic3yaCbLBXDxPAdDxLg"
        }
    }
}

Status Codes

Error Codes

None