Help Center/ Identity and Access Management/ User Guide (Paris Regions) / User Guide/ Identity Providers/ IAM User SSO via SAML/ Overview of IAM User SSO via SAML
Updated on 2024-04-08 GMT+08:00
View PDF
Share

Overview of IAM User SSO via SAML

supports identity federation with Security Assertion Markup Language (SAML), which is an open standard that many identity providers (IdPs) use. During identity federation, functions as a service provider (SP) and enterprises function as IdPs. SAML-based federation enables single sign-on (SSO), so employees in your enterprise can log in to as IAM users.

This section describes how to configure identity federation and how identity federation works.

Ensure that your enterprise IdP supports SAML 2.0.

Configuring Identity Federation

The following describes how to configure your enterprise IdP and to trust each other.

  1. Create an IdP entity and establish a trust relationship: Create an IdP entity for your enterprise on . Then, upload the metadata file to the enterprise IdP, and upload the metadata file of the enterprise IdP to .
  2. Configure the enterprise IdP: Configure enterprise IdP parameters to determine what information can be sent to .
  3. Configure an external identity ID: Establish a mapping between an IAM user and an enterprise user. When your enterprise IdP establishes SSO access to , the enterprise user can log in to as the IAM user with the specified external identity ID. For example, if an enterprise user IdP_Test_User is mapped to the IAM user Alice, the enterprise user IdP_Test_User will log in to as the IAM user Alice.
  4. Verify the federated login: Check whether the enterprise user can log in to through SSO.
  5. (Optional) Configure a federated login entry: Configure the login link (see ) in the enterprise IdP to allow enterprise users to be redirected to from your enterprise management system.

How Identity Federation Works

shows the identity federation process between an enterprise management system and .

To view interactive requests and assertions with a better experience, you are advised to use Google Chrome and install SAML Message Decoder.

As shown in , the process of identity federation is as follows:
  1. A user opens the login link generated after the IdP creation in the browser. The browser sends an SSO request to .
  2. authenticates the user against the metadata file of the enterprise IdP and constructs a SAML request to the browser.
  3. The browser forwards the SAML request to the enterprise IdP.
  4. The user enters their username and password on the login page. After the enterprise IdP authenticates the user's identity, it constructs a SAML assertion containing the user details and sends the assertion to the browser as a SAML response.
  5. The browser responds and forwards the SAML response to .
  6. parses the assertion in the SAML response, identifies the IAM user group mapping to the user based on the identity conversion rules, and issues a token to the user.
  7. The SSO login is successful.

The assertion must carry a signature; otherwise, the login will fail.

Parent topic: IAM User SSO via SAML