Help Center/ Identity and Access Management_Identity and Access Management (New Edition)/ User Guide/ Identity/ Identity Providers/ Overview
Updated on 2026-07-24 GMT+08:00
View PDF
Share

Overview

IAM supports single sign-on (SSO) based on SAML 2.0 and OIDC protocols. If you operate an enterprise identity system and your users require access to the cloud resources within your account, you can use the IAM identity provider feature to establish federated identity authentication. This configuration enables seamless SSO, allowing users to log in to the cloud platform directly through your enterprise identity system. As a best practice, you are advised to manage resource access via federated identity authentication with an external IdP, rather than creating individual, long-term IAM users for each person inside your Huawei Cloud account. By using an external IdP, you can centrally manage user identities outside Huawei Cloud and grant them permissions to access Huawei Cloud resources. By utilizing an external IdP, you can centrally manage user identities outside the cloud environment and map permissions to these users dynamically. This architecture is ideal for organizations with existing directory services, as well as for mobile or web applications that must programmatically interact with Huawei Cloud infrastructure.

Access permissions obtained through identity federation rely on short-lived temporary security credentials. Because these credentials possess a limited validity window, the security risks associated with long-term credential leakage are drastically minimized. However, you must still adhere to the principle of least privilege when defining your IAM trust agency policies and enforce rigorous access controls and security audit on your configured IdPs.

If you are managing a standalone Huawei Cloud account without deploying IAM Identity Center, you can integrate IAM directly with an external IdP to pass identity claims via SAML 2.0 or OIDC. Common enterprise SAML IdPs include Shibboleth and Active Directory Federation Services (AD FS), while common OIDC IdPs include Google, Microsoft Entra ID, and GitHub Actions.

Once an IdP integration is active, authentication flows are handled entirely by your external identity management platform. After external users successfully authenticate through your IdP, they can securely access specific Huawei Cloud resources according to their configured authorization scopes. This model eliminates the need to distribute or embed long-term access keys within applications, leveraging instead the time-bound security of ephemeral credentials.

Basic Concepts

The following table outlines the core terminology used when implementing identity federation within the platform.
Table 1 Basic concepts

Concept

Description

Identity provider (IdP)

The external system responsible for collecting, storing, and validating user credentials (such as usernames and passwords). In a federated login architecture, the IdP refers to your enterprise's own directory service. Common enterprise IdP platforms include Microsoft Active Directory Federation Services (AD FS) and Shibboleth.

Service provider (SP)

The entity that leverages identity assertions from a trusted IdP to grant users secure access to specific cloud platforms or applications. In this federation context, Huawei Cloud acts as the SP.

Federated identity authentication

The comprehensive structural mechanism where an IdP and an SP exchange metadata configurations to establish mutual trust, enabling secure single SSO workflows.

Single sign-on (SSO)

A session authentication mechanism that permits users to log in once to their enterprise IdP and subsequently gain access to trusted SP applications without re-entering credentials. For instance, once federation is active, an enterprise employee logs in via a dedicated Huawei Cloud entry point using their corporate credentials and is securely redirected to the cloud console.

SAML 2.0

Security Assertion Markup Language 2.0 is an XML-based open standard ratified by Organization for the Advancement of Structured Information Standards (OASIS) for exchanging authentication and authorization data securely between an IdP and an SP. For more information about this standard, see SAML 2.0 Technical Overview. IAM natively supports SAML 2.0-based identity federation; your enterprise IdP must support this protocol version to connect.

SAML assertion

The core element in the SAML protocol used to describe authentication requests and authentication responses. For example, specific user attributes are contained within the assertion of the authentication response.

Trust

The trust relationship established between an SP and an IdP, typically implemented via public/private key pairs. The SP consumes the IdP's metadata file, which contains the public signing key, to verify the integrity and origin of incoming assertions.

OIDC

OpenID Connect is a standard identity authentication protocol that runs on top of the OAuth 2.0 protocol. IAM natively supports OIDC1.0-based identity federation; your enterprise IdP must support this protocol version to connect. For more information about OpenID Connect, see OpenID Connect Introduction.

OIDC token

OIDC can issue an identity token representing the logged-in user to the application, which is known as the ID Token. It is used to obtain the basic information of the logged-in user.

Client ID

A unique identifier generated when an application is registered within an external IdP. When you request the IdP to issue an OIDC token, this Client ID must be used, and the aud (Audience) field in the OIDC token will carry this value. When creating an OIDC IdP in Huawei Cloud, you need to configure this Client ID; when using the OIDC token to call STS to obtain temporary security credentials, Huawei Cloud will verify whether the value of the aud field in the token is consistent with the configured Client ID. Only if the verification passes is it allowed to switch to the corresponding trust agency.

Verification fingerprint

A verification fingerprint generated based on the HTTPS CA certificate that you need to configure for the external IdP to prevent the issuer URL from being maliciously hijacked or tampered with. In Huawei Cloud, the system automatically calculates this fingerprint, but you are advised to calculate the certificate fingerprint of the OIDC IdP locally using a tool (such as OpenSSL) and compare it with the platform's calculation result. If the two are inconsistent, there may be a risk of man-in-the-middle attacks or certificate tampering, and you should stop the configuration immediately and re-verify the authenticity of the issuer URL to ensure that the entered fingerprint is accurate and error-free.

Issuer URL

The URL provided by the external IdP that uniformly issues OIDC tokens. The issuer URL must start with https and comply with the standard URL format, but it is not allowed to contain query parameters (identified by ?), fragments (identified by #), or login information (identified by @).

Temporary security credentials

Ephemeral access credentials with customizable validity periods and access permissions obtained through STS (Security Token Service), which is a temporary access permission management service provided by Huawei Cloud.

Trust Agency SSO

IAM supports two types of trust agency SSO based on SAML 2.0 and OIDC protocols:

  • SAML trust agency SSO: Huawei Cloud uses the SAML assertions issued by your IdP to determine which IAM trust agencies are available to enterprise users. Once logged in, these users can access authorized Huawei Cloud resources using the specific IAM trust agency defined in their SAML assertion. For details, see SAML-based Trust Agency SSO.
  • OIDC trust agency SSO: Enterprise users authenticate via an OIDC token (ID Token) issued by the IdP to call Huawei Cloud APIs. This workflow allows them to switch to a specified trust agency, exchange the token for temporary security credentials (STS security tokens), and safely access authorized cloud resources. For more information, see OIDC-based Trust Agency SSO.
Parent topic: Identity Providers