Overview of Virtual User SSO via SAML

Configuring Identity Federation

The following describes how to configure your enterprise IdP and Huawei Cloud to trust each other.

Figure 1 Configuration of virtual user SSO via SAML

1. Create an IdP entity and establish a trust relationship: Create an IdP entity for your enterprise on Huawei Cloud. Then, upload the Huawei Cloud metadata file to the enterprise IdP, and upload the metadata file of the enterprise IdP to Huawei Cloud.
   Figure 2 Exchanging metadata files
   
2. Configure the enterprise IdP: Configure enterprise IdP parameters to determine what information can be sent to Huawei Cloud.
3. Configure identity conversion rules: Configure identity conversion rules to determine the IdP user identities and permissions on Huawei Cloud.
   Figure 3 Mapping external identities to virtual users
   
4. Verify the federated login: Check whether the enterprise user can log in to Huawei Cloud through SSO.
5. (Optional) Configure a federated login entry: Configure the login link (see Figure 4) in the enterprise IdP to allow enterprise users to be redirected to Huawei Cloud from your enterprise management system.
   Figure 4 SSO login model
   

How Identity Federation Works

Figure 5 shows the identity federation process between an enterprise management system and Huawei Cloud.

Figure 5 How identity federation works

NOTE:

To view interactive requests and assertions with a better experience, you are advised to use Google Chrome and install SAML Message Decoder.

As shown in Figure 5, the process of identity federation is as follows:

1. A user opens the login link generated after the IdP creation in the browser. The browser sends an SSO request to Huawei Cloud.
2. Huawei Cloud authenticates the user against the metadata file of the enterprise IdP and constructs a SAML request to the browser.
3. The browser forwards the SAML request to the enterprise IdP.
4. The user enters their username and password on the login page. After the enterprise IdP authenticates the user's identity, it constructs a SAML assertion containing the user details and sends the assertion to the browser as a SAML response.
5. The browser responds and forwards the SAML response to Huawei Cloud.
6. Huawei Cloud parses the assertion in the SAML response, identifies the IAM user group mapping to the user based on the identity conversion rules, and issues a token to the user.
7. The SSO login is successful.
   NOTE:

   The assertion must carry a signature; otherwise, the login will fail.