tencent cloud

PrevNext

피드백

키워드를 검색하세요

Recent Pages

문서
Cloud Access Management
    문서
    Download PDF

    Overview of SAML Role-Based SSO

    마지막 업데이트 시간:2024-01-23 17:46:25
    PDF 다운로드
      During role-based SSO with Tencent Cloud, Tencent Cloud acts as the SP, while the enterprise's own identity management system serves as the IdP. With role-based SSO, enterprises can manage employee information in their local IdP, eliminating the need for user synchronization between Tencent Cloud and the enterprise IdP. Enterprise employees will log in to Tencent Cloud using the specified CAM roles.

      Fundamental Procedure

      Enterprise employees can access Tencent Cloud via the console or program.

      Accessing Tencent Cloud via the Console

      Once the administrator has completed the necessary role-based SSO configurations, enterprise employees can log in to Tencent Cloud using the following method. The fundamental procedure is as follows:
      1. Access the IdP's login page through a browser and select Tencent Cloud as the target service.
      2. The IdP generates a SAML response and returns it to the browser.
      3. The browser is redirected to the SSO service page and forwards the SAML response to the SSO service.
      4. The SSO service uses the SAML response to request temporary security credentials from Tencent Cloud's STS service, and generates a URL that can be used to log in to the Tencent Cloud console with these temporary security credentials.
      5. The SSO service returns the URL to the browser.
      6. The browser redirects to this URL. Then log in to the Tencent Cloud console with the specified CAM role.

      Accessing Tencent Cloud Through a Program

      Enterprise employees can access Tencent Cloud by writing a program. The fundamental procedure is as follows:
      1. Initiate a login request to the enterprise IdP through a program.
      2. The IdP generates a SAML response containing a SAML assertion about the logged-in user and returns this response to the program.
      3. The program invokes the APIAssumeRoleWithSAML provided by Tencent Cloud STS service and passes the following information: the ARN of the IdP in Tencent Cloud, the ARN of the role to be assumed, and the SAML assertion from the enterprise IdP.
      4. The STS service verifies the SAML assertion and returns a temporary security credential to the program.
      5. The program uses the temporary security credentials to call Tencent Cloud APIs.

      Configuration Steps

      To establish a trust relationship between Tencent Cloud and the enterprise IdP, it is necessary to configure SAML for Tencent Cloud as the SP and for the enterprise IdP. Role-based SSO can only be performed after these configurations are completed.
      1. To establish a trust relationship between Tencent Cloud and the enterprise IdP, it is necessary to configure the enterprise IdP in Tencent Cloud. For more information, please refer to Creating a SAML IdP.
      2. Enterprises need to create a CAM role for SSO in the Cloud Access Management Console or through programs and grant the necessary permissions. For more information, see Creating Role.
      3. To establish a trust relationship between the enterprise IdP and Tencent Cloud, it is necessary to configure Tencent Cloud as a trusted SAML SP in the enterprise IdP and set the SAML assertion attributes.

      Parameter Configuration Sample Code

      
      문의하기

      고객의 업무에 전용 서비스를 제공해드립니다.

      문의하기
      기술 지원

      더 많은 도움이 필요하시면, 티켓을 통해 연락 바랍니다. 티켓 서비스는 연중무휴 24시간 제공됩니다.

      티켓 제출
      연중무휴 24시간 전화 지원
      Copyright © 2013-2024 Tencent Cloud. All Rights Reserved.
      개인정보 처리방침서비스 약관쿠키 정책