Creating a SAML Provider

Function

This API is used to create an IdP that supports SAML 2.0.

The SAML provider you create can be used as the principal in the trust policy of a trust agency to establish a trust relationship between Huawei Cloud and the SAML provider. This trust policy allows federated users who log in using SAML IdP to switch to the trust agency. You can create an IAM trust agency that uses web single sign-on (SSO) to access the Huawei Cloud console or an IAM trust agency that supports API access to Huawei Cloud.

When creating a SAML provider, you need to upload the SAML metadata file obtained from the IdP. The document contains the issuer's name, expiration information, and a key that can be used to verify the SAML authentication response (assertion) sent by the IdP.

Authorization Information

Each account root user has all the permissions required to call all APIs, but IAM users must be assigned the following required identity policy-based permissions. For details about the required permissions, see Permissions Policies and Supported Actions.

Action	Access Level	Resource Type (*: required)	Condition Key	Alias	Dependencies
iam:samlProviders:createV5	Write	samlProvider *	-	-	-

URI

POST /v5/saml-providers

Request Parameters

**Table 1** Request body parameters
Parameter	Mandatory	Type	Description
name	Yes	String	Definition Name of the SAML provider. Constraints The value must contain 1 to 64 characters, including only letters, digits, underscores (_), and hyphens (-). Range N/A Default Value N/A
saml_metadata_document	Yes	String	Definition XML document generated by an identity provider (IdP) that supports SAML 2.0. The document contains the issuer's name, expiration information, and a key that can be used to verify the SAML authentication response (assertion) received from the IdP. Constraints Length range: 1,000 to 512,000. Range N/A Default Value N/A
assertion_encryption_mode	No	String	Definition Encryption settings of the SAML provider. Constraints N/A Range The value can be "Required" or "Allowed". Default Value N/A
add_private_key	No	String	Definition Private key for decrypting SAML assertions. The private key must be an RSA private key in PEM format. When receiving an encrypted SAML assertion, IAM uses the private key to decrypt the symmetric key used to encrypt the SAML assertion, based on the RSA-OAEP algorithm. Then, IAM uses the symmetric key to decrypt the SAML assertion into plaintext based on the AES-GCM or AES-CBC encryption algorithm. Constraints Length range: 1 to 16,384 Range A string must consist of one or more of the following characters: spaces, visible ASCII characters, Latin-1 extended characters, tabs, newlines, and carriage returns. Default Value N/A
description	No	String	Definition Description of an identity provider. Constraints Length range: 0 to 255. Range The value cannot contain the following special characters: @#%&<>$^. Default Value* N/A

Response Parameters

Status code: 201

**Table 2** Response body parameters
Parameter	Type	Description
saml_provider	saml_provider object	Definition SAML provider. Range N/A

**Table 3** saml_provider
Parameter	Type	Description
provider_id	String	Definition ID of the SAML identity provider. Range The value must contain 1 to 64 characters, including only letters, digits, and hyphens (-).
name	String	Definition Name of the SAML identity provider. Range The value must contain 1 to 64 characters, including only letters, digits, underscores (_), and hyphens (-).
description	String	Definition Description of an identity provider. Range The value can contain 0 to 255 characters and cannot contain the following special characters: @#%&<>$^*.
urn	String	Definition Uniform resource name. Range The value must contain 16 to 1,500 characters, including letters, digits, slashes (/), equal signs (=), underscores (_), colons (:), and hyphens (-).
saml_metadata_document	String	Definition XML document of an IdP that supports SAML 2.0. Range Length range: 1,000 to 512,000.
assertion_encryption_mode	String	Definition Encryption settings of the SAML identity provider. Range The value can be "Required" or "Allowed".
private_keys	Array of private_keys objects	Definition Private key used to decrypt SAML assertions. Range N/A
created_at	String	Definition Time when the SAML identity provider was created. Range N/A
expires_at	String	Definition Time when the SAML identity provider expires. Range N/A

**Table 4** private_keys
Parameter	Type	Description
key_id	String	Definition ID of the private key for decrypting SAML assertions. Range N/A
timestamp	String	Definition Time when the private key for decrypting SAML assertions was uploaded. The value must comply with the ISO 8601 format. Range N/A

Status code: 400

**Table 5** Response body parameters
Parameter	Type	Description
error_code	String	Definition : Error code. For details, see Error Code. Range: The format is PAP5.XXXX, for example, PAP5.0012.
error_msg	String	Definition : Error message. For details, see Error Message. Range: N/A.
request_id	String	Definition: Unique identifier of an API request, which is used to locate API calling exceptions. Range: N/A

Status code: 403

**Table 6** Response body parameters
Parameter	Type	Description
error_code	String	Definition : Error code. For details, see Error Code. Range: The format is PAP5.XXXX, for example, PAP5.0012.
error_msg	String	Definition : Error message. For details, see Error Message. Range: N/A.
request_id	String	Definition: Unique identifier of an API request, which is used to locate API calling exceptions. Range: N/A
encoded_authorization_message	String	Definition : Encrypted details returned when the authentication fails, which are used to locate authentication problems. The STS5 decryption API can be used for decryption. For details, see API link. Range: N/A.

Status code: 409

**Table 7** Response body parameters
Parameter	Type	Description
error_code	String	Definition : Error code. For details, see Error Code. Range: The format is PAP5.XXXX, for example, PAP5.0012.
error_msg	String	Definition : Error message. For details, see Error Message. Range: N/A.
request_id	String	Definition: Unique identifier of an API request, which is used to locate API calling exceptions. Range: N/A

Example Requests

Creating a SAML provider

POST https://{endpoint}/v5/saml-providers

{
  "saml_metadata_document" : "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<md:EntityDescriptor entityID=\"http://***.***.com/****************************\"\n                     xmlns:md=\"urn:oasis:names:tc:SAML:2.0:metadata\">\n\t<md:IDPSSODescriptor WantAuthnRequestsSigned=\"false\"\n\t                     protocolSupportEnumeration=\"urn:oasis:names:tc:SAML:2.0:protocol\">\n\t\t<md:KeyDescriptor use=\"signing\">\n\t\t\t<ds:KeyInfo xmlns:ds=\"http://www.w3.org/2000/09/xmldsig#\">\n\t\t\t\t<ds:X509Data>\n\t\t\t\t\t<ds:X509Certificate>example************************************************************************************************************************************************************************************************************************************************************************************************************************************************example</ds:X509Certificate>\n\t\t\t\t</ds:X509Data>\n\t\t\t</ds:KeyInfo>\n\t\t</md:KeyDescriptor>\n\t\t<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>\n\t\t<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>\n\t\t<md:SingleSignOnService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\"\n\t\t                        Location=\"https://***************.okta.com/app/***************_oktaaws_1/****************************/sso/saml\"/>\n\t\t<md:SingleSignOnService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect\"\n\t\t                        Location=\"https://***************.okta.com/app/***************_oktaaws_1/****************************/sso/saml\"/>\n\t</md:IDPSSODescriptor>\n</md:EntityDescriptor>",
  "name" : "string",
  "description" : "string"
}

Example Responses

Status code: 201

Request succeeded.

{
  "saml_provider" : {
    "provider_id" : "string",
    "name" : "string",
    "urn" : "iam::accountid:user:name",
    "description" : "string",
    "saml_metadata_document" : "<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<md:EntityDescriptor entityID=\"http://***.***.com/****************************\"\n                     xmlns:md=\"urn:oasis:names:tc:SAML:2.0:metadata\">\n\t<md:IDPSSODescriptor WantAuthnRequestsSigned=\"false\"\n\t                     protocolSupportEnumeration=\"urn:oasis:names:tc:SAML:2.0:protocol\">\n\t\t<md:KeyDescriptor use=\"signing\">\n\t\t\t<ds:KeyInfo xmlns:ds=\"http://www.w3.org/2000/09/xmldsig#\">\n\t\t\t\t<ds:X509Data>\n\t\t\t\t\t<ds:X509Certificate>example************************************************************************************************************************************************************************************************************************************************************************************************************************************************example</ds:X509Certificate>\n\t\t\t\t</ds:X509Data>\n\t\t\t</ds:KeyInfo>\n\t\t</md:KeyDescriptor>\n\t\t<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat>\n\t\t<md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress</md:NameIDFormat>\n\t\t<md:SingleSignOnService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST\"\n\t\t                        Location=\"https://***************.okta.com/app/***************_oktaaws_1/****************************/sso/saml\"/>\n\t\t<md:SingleSignOnService Binding=\"urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect\"\n\t\t                        Location=\"https://***************.okta.com/app/***************_oktaaws_1/****************************/sso/saml\"/>\n\t</md:IDPSSODescriptor>\n</md:EntityDescriptor>",
    "assertion_encryption_mode" : "Allowed",
    "private_keys" : [ ],
    "created_at" : "2026-06-22T12:01:57.989Z",
    "expires_at" : "2126-05-29T12:01:57.955Z"
  }
}