Help Center/ Identity and Access Management/ User Guide (Paris Regions) / User Guide/ Identity Providers/ Virtual User SSO via SAML/ Overview of Virtual User SSO via SAML
Updated on 2024-04-08 GMT+08:00
View PDF
Share

Overview of Virtual User SSO via SAML

supports identity federation with Security Assertion Markup Language (SAML), which is an open standard that many identity providers (IdPs) use. During identity federation, functions as a service provider (SP) and enterprises function as IdPs. This section describes how to configure identity federation and how identity federation works.

Ensure that your enterprise IdP supports SAML 2.0.

Configuring Identity Federation

The following describes how to configure your enterprise IdP and to trust each other.

  1. Create an IdP entity and establish a trust relationship: Create an IdP entity for your enterprise on . Then, upload the metadata file to the enterprise IdP, and upload the metadata file of the enterprise IdP to .
  2. Configure the enterprise IdP: Configure enterprise IdP parameters to determine what information can be sent to .
  3. Configure identity conversion rules: Configure identity conversion rules to determine the IdP user identities and permissions on .
  4. Verify the federated login: Check whether the enterprise user can log in to through SSO.
  5. (Optional) Configure a federated login entry: Configure the login link (see ) in the enterprise IdP to allow enterprise users to be redirected to from your enterprise management system.

How Identity Federation Works

shows the identity federation process between an enterprise management system and .

To view interactive requests and assertions with a better experience, you are advised to use Google Chrome and install SAML Message Decoder.

As shown in , the process of identity federation is as follows:

  1. A user opens the login link generated after the IdP creation in the browser. The browser sends an SSO request to .
  2. authenticates the user against the metadata file of the enterprise IdP and constructs a SAML request to the browser.
  3. The browser forwards the SAML request to the enterprise IdP.
  4. The user enters their username and password on the login page. After the enterprise IdP authenticates the user's identity, it constructs a SAML assertion containing the user details and sends the assertion to the browser as a SAML response.
  5. The browser responds and forwards the SAML response to .
  6. parses the assertion in the SAML response, identifies the IAM user group mapping to the user based on the identity conversion rules, and issues a token to the user.
  7. The SSO login is successful.

    The assertion must carry a signature; otherwise, the login will fail.