Authentication using Active Directory

If you don't have the Yandex.Cloud command line interface yet, install and initialize it.

The folder specified in the CLI profile is used by default. You can specify a different folder using the --folder-name or --folder-id parameter.

1. See the description of the create federation command:

   $ yc iam federation create --help
   

2. Create a federation:

   $ yc iam federation create --name my-federation \
     --auto-create-account-on-login \
     --cookie-max-age 12h \
     --issuer "http://example.com/adfs/services/trust" \
     --sso-binding POST \
     --sso-url "https://example.com/adfs/ls/"
   

   Where:

   • name: Federation name. The name must be unique within the folder.

   • auto-create-account-on-login: Flag for automatically creating new users in the cloud after authenticating on the IdP server. This option simplifies the user setup, but users created this way are only assigned the resource-manager.clouds.member role by default: they can't do anything with cloud resources. Exceptions are the resources that the allUsers or allAuthenticatedUsers system group roles are assigned to.

     If this option is disabled, users who aren't added to the cloud can't log in to the management console, even if they authenticate with your server. In this case, you can manage the white list of users who are allowed to use Yandex.Cloud.

   • cookie-max-age: Time before the browser asks the user to re-authenticate.

   • issuer: IdP server ID to be used for authentication.

     Enter the link in http://<ADFS>/adfs/services/trust format, where <ADFS> is the FQDN of your ADFS server.

   • sso-url: URL of the page that the browser redirects the user to for authentication.

     Enter the link in https://[ADFS]/adfs/ls/ format, where <ADFS> is the FQDN of your ADFS server.

   • sso-binding: Specify the Single Sign-on binding type. Most Identity Providers support the POST binding type.

1. Get the ID of the folder to create your federation in.

2. Create a file with the request body (for example, body.json):

   {
     "folderId": "<folder ID>",
     "name": "my-federation",
     "autocreateUsers": true,
     "cookieMaxAge":"43200s",
     "issuer": "http://example.com/adfs/services/trust",
     "ssoUrl": "https://example.com/adfs/ls/",
     "ssoBinding": "POST"
   }
   

   Where:

   • folderId: ID of the folder.

   • name: Federation name. The name must be unique within the folder.

   • autocreateUsers: Flag for automatically creating new users in the cloud after authenticating on the IdP server. This option simplifies the user setup, but users created this way are only assigned the resource-manager.clouds.member role by default: they can't do anything with cloud resources. Exceptions are the resources that the allUsers or allAuthenticatedUsers system group roles are assigned to.

     If this option is disabled, users who aren't added to the cloud can't log in to the management console, even if they authenticate with your server. In this case, you can manage the white list of users who are allowed to use Yandex.Cloud.

   • cookieMaxAge: Time before the browser asks the user to re-authenticate.

   • issuer: IdP server ID to be used for authentication.

     Enter the link in http://<ADFS>/adfs/services/trust format, where <ADFS> is the FQDN of your ADFS server.

   • ssoUrl: URL of the page that the browser redirects the user to for authentication.

     Enter the link in https://[ADFS]/adfs/ls/ format, where <ADFS> is the FQDN of your ADFS server.

   • ssoBinding: Specify the Single Sign-on binding type. Most Identity Providers support the POST binding type.

3. Create a federation using the create method:

   $ curl -X POST \
     -H "Content-Type: application/json" \
     -H "Authorization: Bearer <IAM token>" \
     -d '@body.json' \
     https://iam.api.cloud.yandex.net/iam/v1/saml/federations
   {
    "done": true,
    "metadata": {
     "@type": "type.googleapis.com/yandex.cloud.iam.v1.saml.CreateFederationMetadata",
     "federationId": "ajeobmje4dgj0belagb9"
    },
    ...
   

   The federationId property of the response contains the federation ID to save. You'll need this ID in the next steps.

If you don't have the Yandex.Cloud command line interface yet, install and initialize it.

The folder specified in the CLI profile is used by default. You can specify a different folder using the --folder-name or --folder-id parameter.

1. View a description of the add certificate command:

   $ yc iam certificate create --help
   

2. Add a federation certificate by specifying the certificate file path:

   $ yc iam certificate create --federation-name my-federation \
     --name "my-certificate" \
     --certificate-file test.pem
   

To add the certificate, use the create method for the Certificate resource:

1. Create a request body by specifying the contents of the certificate's data property:

   {
     "federationId": "<federation ID>",
     "name": "my-certificate",
     "data": "MII...=="
   }
   

2. Send the add certificate request:

   $ export IAM_TOKEN=CggaATEVAgA...
   $ curl -X POST \
       -H "Content-Type: application/json" \
       -H "Authorization: Bearer ${IAM_TOKEN}" \
       -d '@body.json' \
       "https://iam.api.cloud.yandex.net/iam/v1/saml/certificates"
   

If you don't have the Yandex.Cloud command line interface yet, install and initialize it.

The folder specified in the CLI profile is used by default. You can specify a different folder using the --folder-name or --folder-id parameter.

1. View a description of the add user command:

   $ yc iam federation add-user-accounts --help
   

2. Add users by listing their Name IDs separated by a comma:

   $ yc iam federation add-user-accounts --name my-federation \
     --name-ids=alice@example.com,bob@example.com,charlie@example.com
   

To add identity federation users to the cloud:

1. Create a file with the request body (for example, body.json). In the request body, specify the array of Name IDs of users you want to add:

   {
     "nameIds": [
       "alice@example.com",
       "bob@example.com",
       "charlie@example.com"
     ]
   }
   

2. Send the request by specifying the Federation ID in the parameters:

   $ curl -X POST \
     -H "Content-Type: application/json" \
     -H "Authorization: Bearer <IAM token>" \
     -d '@body.json' \
     https://iam.api.cloud.yandex.net/iam/v1/saml/federations/<federation ID>:addUserAccounts