With identity federation provided by Huawei Cloud Identity and Access Management (IAM), you do not need to create IAM users for your workforce users in Huawei Cloud. Instead, they can use their existing usernames and passwords to log in to Huawei Cloud. You can use identity provider (IdP) to assign permissions to your workforce.

Huawei Cloud supports federated identity authentication based on Web SSO and API calling. Here we use Okta as an enterprise IdP to describe the process of Web SSO–based identity federation. To learn about API-based identity federation, see Federated Identity Authentication Management.

Prerequisites

You have completed real-name authentication and configured user information on Okta.

You have registered an account in Huawei Cloud and the account is enabled.

Process Flow

The following figure shows the identity federation process between Okta and Huawei Cloud.

As shown in the preceding figure, the identity federation is as follows:

1.A user enters the Huawei Cloud login link in the address bar of a browser to send a single sign-on (SSO) request to Huawei Cloud.

2.Huawei Cloud searches for the IdP metadata file based on the login link and sends a SAML request to the browser.

3.The browser responds and forwards the SAML request to Okta.

4.he user enters its username and password on the Okta login page. Okta authenticates the user, constructs a SAML assertion containing the user information, and sends the assertion to the browser as a SAML response.

5.The browser responds and forwards the SAML response to Huawei Cloud.

6.Huawei Cloud parses the assertion in the SAML response, and issues a token to the user after identifying the group the user is mapped to based on the configured identity conversion rules.

7.The user logs in to Huawei Cloud using SSO and accesses resources based on assigned permissions.

Step 1     Log in to the Okta official website as an enterprise administrator.

Step 2     In the left navigation pane on the Okta homepage, choose Applications > Applications and click Create App Integration.

Step 3     Select SAML 2.0 and click Next.

Step 4     Enter basic information about the application (HuaweiCloud) and click Next.

Step 5     Download the metadata file of the Huawei Cloud system, specify the following parameters, and click Next.

• Single sign on URL: Enter https://auth.huaweicloud.com/authui/saml/SAMLAssertionConsumer (the value of Location in AssertionConsumerService in the Huawei Cloud system metadata file).
• Audience URI (SP Entity ID): Enter https://auth.huaweicloud.com/ (the value of entityID in the Huawei Cloud system metadata file).

Step 6     Configure user attribute statements. In the following figure, the first statement indicates that the user.email value is included in the email field in the assertion. The second statement indicates that the appuser.approle value is included in the approle field in the assertion for user group mapping in Huawei Cloud.

Note that approle is a custom attribute statement and can be modified. For details, see 4 Mapping User Group Attributes to Huawei Cloud User Groups. The appuser attribute cannot be modified.

Step 7     Configure feedback information and click Finish.

Step 8     Download the metadata file of the Okta system, which needs to be uploaded to Huawei Cloud later.

----End

Step 1     Log in to the IAM console and choose Identity Providers in the left navigation pane.

Step 2     On the Identity Providers page, click Create Identity Provider.

Step 3     Specify parameters in the displayed dialog box. For example, enter Okta_IdP in the Name text box.

Step 4     Click OK. The following message indicates that the IdP is created successfully.

Step 5     Locate the created IdP and click Modify in the Operation column.

Step 6     Click Select File and select the Okta system metadata file downloaded in Step 8.

Step 7     Click Upload. After the metadata extracted from the uploaded file is displayed, click OK.

Step 8     Create an identity conversion rule with the same settings as the user attribute statements in Okta. You can create a maximum of 10 identity conversion rules. For details, see Identity Providers.

In the Identity Conversion Rules area, click Edit Rule and copy the following to the edit box. This rule maps the user emails in Okta to the usernames in the admin group of Huawei Cloud. Then users in Okta inherit the permissions of the admin group.

[{
 "remote": [{
           "type": "email"
 }],
 "local": [{
            "user": {
                    "name": "{0}"
                    }
           },
           {
                    "group": {
                             "name": "admin"
                    }
           }]
}]

Step 9     Click OK.

Step 10     Locate the IdP and click View in the Operation column. On the View Identity Provider Information page, copy the login link and open it in a browser.

Step 11     Enter your username and password in Okta to log in to Huawei Cloud. If you have logged in to Okta, you will be automatically redirected to Huawei Cloud.

----End

4 Mapping User Group Attributes to Huawei Cloud User Groups

5 Verifying the Login Result