Identity Provider
The OneCloud platform supports integrating multiple identity providers such as LDAP, DingTalk, Feishu, and WeCom, and supports logging in to the OneCloud platform via third-party app QR codes and other methods.
Authentication System
The authentication system mainly includes identity providers, domains, projects, groups, users, roles, and policies.
The authentication system manages identity authentication and authorization on the OneCloud platform. The console menu path is “Authentication & Security/Authentication/Authentication System”, and it mainly includes:
| Menu | Description |
|---|---|
| Identity Provider | Configure local SQL, LDAP, CAS, SAML, OIDC, OAuth2, and other identity providers, and sync users/groups. |
| Organization | Manage domains or projects hierarchically and bind resources to organization nodes (visible in Admin Console). |
| Domain | Multi-tenant logical boundary; within a domain you can autonomously manage users, groups, projects, roles, and policies. |
| Project | Unit of resource ownership; users gain access by joining a project and binding a role. |
| Group | Group users together for bulk project membership and authorization. |
| User | Manage local or identity-provider-synced user accounts; details allow managing cloud users and passwordless login users. |
| Role | Associate a set of policies and bind them to a user or group identity in a project. |
| Policy | Define operable resources and actions via visual selection or YAML policies. |
Domain, project, and user relationship diagram:
- The platform supports multiple domains; the default is the
defaultdomain. - A domain contains multiple projects and users; users usually join projects in their own domain (except the
systemproject). - Projects own resources; users consume them. A user can join multiple projects and switch projects to use different resources.
Organization
Organization is used to manage domains or projects hierarchically and filter lists by organization tree.
Domain
A domain is a logical concept on the cloud management platform based on multi-tenancy. A domain contains a complete, logically autonomous system.
Project
A project owns resources; resources on the OneCloud platform are provided to users by project.
Group
A group is a collection of users.
User
Users manage and directly use resources.
Role
A role is a collection of policies; the role assigned when a user joins a project determines the user’s permissions in that project.
Policy
Policies define operation permissions on platform resources.