How to set up SSO for Tencent Cloud with Okta

• Prerequisites
• Add Tencent Cloud app to your Okta instance
• Set up SSO settings on Tencent Cloud
• Test and confirm that it is working

Before you can start setting up Single Sign On (SSO) for Tencent Cloud and Okta, we need to check the following:

1. Add Tencent Cloud app to your Okta instance

Log in to your Okta account as an administrator (with administrator access).

Under Applications> Applications, click Create App Integration.

Select SAML 2.0.

On the "Create SAML Integration" page, fill in the options. 

• Application name - Name your app (any name is fine), click Next.

On the next page, fill in more details, you can put in these placeholder details for now. Use the Tencent Cloud International or Tencent Cloud China details depending on which one you are using:

Tencent Cloud International users

• Single sign on URL - https://intl.cloud.tencent.com/login/saml
• Audience URI (SP Entity ID) -intl.cloud.tencent.com
• Default RelayState - You can leave blank, this is optional.
• Name ID format - Email Address
• Application username - Okta username
• Update application username on - Create and update

Tencent Cloud China users

• Single sign on URL -  https://cloud.tencent.com/login/saml
• Audience URI (SP Entity ID) - cloud.tencent.com
• Default RelayState - You can leave blank, this is optional.
• Name ID format - Email Address
• Application username - Okta username
• Update application username on - Create and update

Configure role attributes

We will also configure some role attributes, as this is something that Tencent Cloud needs to operate.

Attribute one - Role

• Name - https://cloud.tencent.com/SAML/Attributes/Role
• Name format - Unspecified
• Value - qcs::cam::uin/{AccountID}:roleName/{RoleName},qcs::cam::uin/{AccountID}:saml-provider/{ProviderName}

Where you will put your details in the "value" field.

• {AccountID}: Replace this with your Tencent Cloud account ID. You can view this at Account Information - Console.
• {RoleName}: Replace this with the role name you have created in Tencent Cloud for the identity provider. For more information, see Creating a Role. Role names can be viewed in Role - Console.
  • You can also add more roles, using this format . Separate them using semicolons (;):
    • qcs::cam::uin/{AccountID}:roleName/{RoleName} 
• {ProviderName}: Replace this with the SAML identity provider name that you created on Tencent Cloud. You can view this at Identity Providers - Console.

For example:

• AccountID 1000200000'
• RoleName Enduser
• ProviderName Okta

This will then look like the following format for Tencent Cloud will digest it. 

• Value -qcs::cam::uin/1000200000:roleName/Enduser,qcs::cam::uin/1000200000:saml-provider/Okta
  
  

This is screenshots of the Tencent Cloud settings for where you can find your AccountID and RoleName in Tencent Cloud.

AccountID (Account ID)

Located at: Tencent Cloud> Account Center> Account Information> Account ID

RoleName (Role Name)

Located at Tencent Cloud> Access Management> Role > Role > click on one of your roles

Attribute two - RoleSessionName

• Name - https://cloud.tencent.com/SAML/Attributes/RoleSessionName
• Name format - Unspecified
• Value - Okta

Leave the rest default settings and click Next.

On the next page, select "I'm an Okta customer adding an internal app", and then click Next.

Then click on the "Sign On" tab.  

Scroll down and look for "Identity Provider metadata".

Right click on "Identity Provider metadata".

Click "Save Link As..." from the right click menu.

Save this to your computer. 

Give it a name, for example "metadata.xml". Please make sure you save it as .xml file extension. 

We will now be able to proceed to Tencent Cloud to configure settings there. 

Later we will be uploading this metadata.xml file in Tencent Cloud via an option that looks like this. 

2. Set up SSO settings on Tencent Cloud

Log into your Tencent Cloud account

In a new browser tab, log in to your Tencent Cloud account as an administrator (with administrator access).

Open Single Sign-On Settings

In Tencent Cloud, open your Single Sign-On (SSO) settings. 

Tencent Cloud Access Management > Identity provider > New Provider

If you have trouble finding it, you can try this direct link to SAML settings, https://console.cloud.tencent.com/cam/idp

Click "New Identity Provider" button. 

Configure your Identity Provider settings and click "Next Steps" when you are done. 

• Provider type - SAML
  
• Provider name - Okta
• Remark - Leave blank
• Metadata document - Upload the metafile.xml file we downloaded earlier from Okta. 
  

Upload the metafile.xml file.

When you are ready, click on Next Step.

You will then see a summary of the settings just configured.

(Optional) If you click on it, it will look like this.