Cloudpods – Authentication System

Docs: Identity Provider

Mon, 01 Jan 0001 00:00:00 +0000

OneCloud supports integrating LDAP, CAS, SAML, OIDC, OAuth2, and other identity providers for third-party identity authentication login. Local users (SQL source) are built into the platform and do not need to be configured under Identity Provider; create or import them directly in Users.

Note

Primary identity provider: Defines the user source. SQL and LDAP are primary identity providers by default; other protocols can become primary identity providers when Auto-create users is selected, and a local user with the same name is created automatically on first login.
Secondary identity provider: Used only as a login method. When Auto-create users is not selected, you must first associate this identity provider in the user information; after association succeeds, the corresponding login method can be used.

Entry: In the cloud management platform, click the navigation menu in the upper left corner, then click “Authentication & Security/Authentication/Authentication System/Identity Provider” in the left menu to open the Identity Provider page.

View Identity Provider List

Column	Description
Name	Identity provider name; click to open the details side panel.
Status	Identity provider running status.
Enabled	Enabled or disabled status.
Sync Status	Sync progress for syncable identity providers such as LDAP.
Auto-create Users	Whether local users are created automatically via this identity provider.
Auth Protocol	LDAP, CAS, SAML, OIDC, OAuth2, or SQL.
Auth Type	Specific template under each protocol, such as Microsoft AD single-domain import, Feishu, or generic SAML.
Owner	System or a specific domain; domain identity providers are available only to users in that domain.
Time	Creation/update time.

Above the list you can Create; after selecting records you can Enable, Disable, and Delete in bulk.

Create Identity Provider

Click “Create” above the list to open the create identity provider page.
Fill in parameters by protocol and click “OK”.

Common Parameters

Parameter	Description
Identity Provider Owner	In Admin Console, choose System or Domain; in Domain Admin Console, fixed to the current domain.
Owner Domain	When owner is Domain, select the target domain.
Name	Identity provider name.
Notes	Optional description.
Auth Protocol	LDAP, CAS, SAML, OIDC, OAuth2.
Auth Type	Varies by protocol; see protocol sections below; the page can jump to the corresponding appendix for third-party parameters.

LDAP

Auth types: Microsoft AD single-domain import, Microsoft AD multi-domain import (only when owner is System), OpenLDAP/FreeIPA single-domain import.

Parameter	Description
User Target Domain	Optional; domain of LDAP users on the platform; if empty, a domain with the same name as the identity provider is created automatically.
Server Address	LDAP server address; must start with `ldap://` or `ldaps://`, e.g. `ldap://192.168.1.1`.
Base DN	Directory tree root DN, e.g. `DC=example,DC=com`.
Username / Password	Credentials to connect to LDAP.
User DN	Root path for finding users, e.g. `CN=users,OU=xx,DC=example,DC=com`.
Group DN	Root path for finding groups (single-domain AD / OpenLDAP).
Domain DN	Root path for finding domains (multi-domain AD), e.g. `OU=xx,DC=example,DC=com`.
User Enabled Status	Initial enabled status of imported users; adjustable later in the user list.

LDAP Auto-create users is on by default; after creation, domains, groups, and users on LDAP are synced.

CAS

Auth type: Generic CAS.

Parameter	Description
CAS Service URL	CAS SSO service URL, e.g. `https://cas.example.io/cas`.
User ID / Username	Corresponding user ID and username fields in the CAS assertion; both default to `cas:user`.
Auto-create Users	See Advanced Configuration.

SAML

Auth types: Generic SAML, Azure AD SAML 2.0.

Generic SAML

Parameter	Description
SAML Input Method	Upload SAML IDP metadata XML, or manually enter EntityID and RedirectSSOURL.
User ID / Username	User identifier fields in the SAML assertion.
Auto-create Users	See Advanced Configuration.

Azure AD SAML 2.0

Parameter	Description
TenantId	Azure tenant ID.
Cloud Environment	Azure Global or China.
Auto-create Users	See Advanced Configuration.

OIDC

Auth types: Generic OIDC, Google, Github, Azure AD OAuth2.

Parameter	Description
ClientID / ClientSecret	Third-party application ID and secret.
Endpoint	After selecting I have Endpoint information, fill in directly; otherwise fill in Scopes, AuthUrl, TokenUrl, and UserinfoUrl separately.
User ID / Username	Corresponding fields in OIDC user info; Generic OIDC defaults to `name`.
TenantId	Required for Azure AD OAuth2.
Cloud Environment	For Azure AD OAuth2, choose Global or China.
Auto-create Users	See Advanced Configuration.

GitHub and Google types need only ClientID and ClientSecret; see Appendix for how to obtain parameters.

OAuth2

Auth types: Feishu, DingTalk, WeCom.

Parameter	Description
AppId / Secret	Feishu and DingTalk application credentials.
Corp ID / AgentId / Secret	WeCom application credentials.
Auto-create Users	See Advanced Configuration.

The OAuth2 callback URL is https://<domain>/api/v1/auth/ssologin; configure the same callback URL or domain on the third-party platform. The console access domain is maintained under Global Settings - Console Address.

Advanced Configuration

For CAS, SAML, OIDC, and OAuth2, after selecting Auto-create users you can expand advanced configuration:

Parameter	Description
User Target Domain	Domain for auto-created users; when the identity provider owner is a domain, this matches the identity provider domain and cannot be changed.
Default Project	Default project the user joins; for generic templates such as CAS, you can switch to Prefer project from protocol and specify a field name (e.g. `cas:proj`), and support Auto-create project.
Default Role	Default role when the user joins a project; you can switch to Prefer role from protocol and specify a field name (e.g. `cas:role`).
Display Name / Email / Mobile	In generic CAS, SAML, and OIDC templates, map extended fields from the assertion or UserInfo.

Modify Configuration

Modify identity provider connection parameters; an Enabled identity provider must be Disabled before modification. SQL identity providers cannot be modified.

Note

Modifying LDAP import-related settings affects only subsequently imported users; already imported users are unaffected.

In the Actions column of a Disabled identity provider, click “Modify Configuration”.
Modify connection parameters and click “OK”.

Enable

Enable a Disabled identity provider. SQL identity providers cannot be enabled.

Enable Individually: Actions column “More” → “Enable”, then confirm.

Enable in Bulk: Select one or more disabled identity providers, click “Enable” above the list, then confirm.

Disable

Disable an Enabled identity provider; after disabling, users under that identity provider cannot log in. SQL identity providers cannot be disabled.

Disable Individually: Actions column “More” → “Disable”, then confirm.

Disable in Bulk: Select one or more enabled identity providers, click “Disable” above the list, then confirm.

Sync

Immediately sync domains, groups, and users from the identity provider; automatic sync runs every 15 minutes by default. Only Enabled identity providers can sync; SQL is not supported.

Actions column “More” → “Sync”.

Delete

Delete a Disabled identity provider. SQL cannot be deleted.

Note

Secondary identity providers (Auto-create users not selected) can be deleted after disabling.
Primary identity providers (Auto-create users): after disabling, if users belong to an existing domain, you can delete the identity provider and its users and groups; if the user target domain is empty (auto-created domain), the domain must have no projects and the identity provider must be disabled before deletion.

Delete Individually: Actions column “Delete”, then confirm.

Delete in Bulk: Select disabled identity providers, click “Delete” above the list, then confirm.

View Identity Provider Details

Click an identity provider name in the list to open the details side panel.

Details

Shows owner, enabled status, sync status, auto-create users, user target domain, auth protocol, auth type, sync time, configuration information, and resource statistics (counts of domains, projects, groups, users, roles, and policies).

Generic SAML: Details show IDP Source Data, which you can preview and Download IDP Source Data XML for third-party IdP configuration.
SAML / OIDC / OAuth2 / CAS: Details Configuration show AssertionURI or RedirectURI and other callback information, with copy support.

Operation Logs

In the details side panel, click the “Operation Logs” tab.
Supports filtering by time, loading more, viewing details, and exporting logs on this page (click in the upper right).

Appendix

The following explains how to obtain identity provider configuration parameters on common third-party platforms. The callback URL for OAuth2/OIDC protocols is always https://<domain>/api/v1/auth/ssologin; configure the platform access domain under Global Settings - Console Address first.

Generic SAML (AWS SSO Example)

Currently only AWS international regions support AWS SSO.

In the AWS Console, search for and open AWS Single Sign-On.
Under Applications, add a custom SAML 2.0 application and download the AWS SSO SAML metadata XML.
In OneCloud, create a Generic SAML identity provider, upload the metadata, configure User ID and Username attributes, and preferably select Auto-create users.
After creation, Download IDP Source Data from identity provider details and fill it back into the AWS application metadata; obtain Assertion URI, Entity ID, and related information from details Configuration.
In AWS application Attribute mappings, configure user attributes consistent with the platform, and add authorized users under Assigned users.

Azure AD SAML 2.0

Only Azure Global accounts are supported.

Sign in to the Azure portal, and under Azure Active Directory → Enterprise applications, Create your own application.
Under Single sign-on, choose SAML, and configure Identifier (Entity ID) and Reply URL (Assertion Consumer Service URL) using values from OneCloud identity provider details.
Under Users and groups, add users who need SAML login.
Under Azure Active Directory → Overview, obtain TenantId and enter it in the OneCloud identity provider.

Github OIDC

Sign in to Github, go to Settings → Developer settings → OAuth Apps, and create an OAuth app.
Set Authorization callback URL to https://<domain>/api/v1/auth/ssologin.
After creation, obtain ClientID and ClientSecret, and enter them in the OneCloud Github OIDC identity provider.

Azure AD OAuth2

Sign in to Azure China or Azure Global, and create an application under App registrations.
Configure Redirect URI as Web type with address https://<domain>/api/v1/auth/ssologin.
Obtain ClientID (Application ID) and TenantId (Directory/Tenant ID); under Certificates & secrets, create a client secret to obtain ClientSecret.
In OneCloud, select the corresponding Cloud Environment and enter the parameters above.

Feishu

See the Feishu Open Platform documentation.

Sign in to the Feishu Open Platform and create an enterprise self-built application.
Under Credentials & Basic Info, obtain App ID and App Secret.
Under Security Settings → Redirect URL, configure https://<domain>/api/v1/auth/ssologin.
Under Permission Management, at least enable: obtain basic user info, email, mobile number, and user id.
Under Version Management & Release, create a version and publish; set availability to All employees or the applicable organization.

DingTalk

See the DingTalk Open Platform documentation.

As an administrator, sign in to the DingTalk Open Platform.
Under App Development → Mobile Access Apps → Login, create QR Login App Authorization.
Configure the callback domain as https://<domain>/api/v1/auth/ssologin.
After creation, obtain AppId and AppSecret.

WeCom

As an administrator, sign in to the WeCom Admin Console.
Under My Company, obtain Corp ID.
Under App Management, create a self-built app; set visibility preferably to All employees or the applicable organization.
Under WeCom Authorized Login → Web, set the authorized callback domain to the platform domain (domain only, no path).
In the app details, obtain AgentId and Secret.

Docs: Organization

Mon, 01 Jan 0001 00:00:00 +0000

Organization maintains domains or projects hierarchically and binds resources to organization nodes. After creation, you can manage nodes in the organization tree and bind/unbind domains or projects on the right.

Note

The “Organization” menu is visible only in the Admin Console (System) view.
The platform currently supports only one organization (either project-type or domain-type).
Do not grant more permissions than needed; for cross-project authorization, use Organization to manage project ownership and grants instead of stacking high-privilege roles for the user in each project.

Entry: In the cloud management platform, click the navigation menu in the upper left corner, then click “Authentication & Security/Authentication/Authentication System/Organization” in the left menu to open the Organization page.

Create Organization

When none exists, the page shows “Create Organization”.

Click “Create Organization”.
Configure the parameters and click “OK”.

Parameter	Description
Name	Organization name.
Organization Type	Project (default) or Domain. Cannot be changed after creation.
Notes	Optional.

Page Overview

After creation:

Left: Organization tree (supports search, sync, and root/node actions).
Upper right: Current node information (name, parent organization, weight, notes).
Lower right:
- For type Project, shows the list of bound projects;
- For type Domain, shows the list of bound domains.

The root node cannot bind resources directly; maintain hierarchy under child nodes first, then add projects or domains on the corresponding nodes.

Manage Organization Tree

In the left organization tree area:

Action	Description
Sync	Sync organization status.
Create	Create a child node under the selected parent.
Modify	Modify organization root or node information.
Enable / Disable	Available only for the root node.
Delete	Available only for the root node, and the organization must be disabled first.

Create Node

In the organization tree actions, click “Create”.
Configure the parameters and confirm.

Parameter	Description
Parent Organization	Parent node.
Level Description	Description of the current level tag key (editable at leaf levels).
Name	Node name.
Weight	Sibling sort weight; default 1.
Notes	Optional.

Modify

Root node: Name and notes can be changed.
Ordinary node: Name is read-only; weight and notes can be changed.

Bind Projects / Domains

Add projects under organization nodes (especially leaf nodes) in either of the following ways. For type Domain, the right-side actions are add/remove domain, with a similar flow.

Method 1: Add Directly in Organization

Open the “Organization” page and select the target leaf node in the left tree.
In the right list, click “Add Project” (or “Add Domain”).
Select one or more projects/domains and confirm.

The root node cannot bind resources directly.

Method 2: Tag Projects Then Sync

Open the “Authentication & Security/Authentication/Authentication System/Project” list.
Set organization tags on projects to join the organization that match the target organization node (tag keys/values must match the leaf node levels).
Return to the “Organization” page and click “Sync” in the upper left.
After sync, projects matching the tags appear under the corresponding leaf nodes.

Remove

Remove Individually: In the Actions column, click “Remove Project” / “Remove Domain”.
Remove in Bulk: Select items, then click the corresponding remove button above the list.

Relationship with the Project List

The Project list can filter projects by organization tree on the left; you can also maintain organization tags via “Set Tags”, then sync on the Organization page (see Method 2 above).

Docs: Domain

Mon, 01 Jan 0001 00:00:00 +0000

A domain is a logical unit based on multi-tenancy and includes a complete autonomous system for user authentication, permission management, project management, and more.

Entry: In the cloud management platform, click the navigation menu in the upper left corner, then click “Authentication & Security/Authentication/Authentication System/Domain” in the left menu to open the Domain page.

View Domain List

Field	Description
Name	Domain name; click to open the details drawer.
Tags	Domain tags.
Enabled	Whether the domain is enabled.
Identity Provider	Identity provider associated with the domain.
Time	Creation time.

Domain sources include: domains synced from an LDAP identity provider; after system deployment, a default domain based on the SQL identity provider is created by default, and you can also create local domains.

Create Domain

On the Domain page, click “Create” above the list to open the create domain page.
Fill in the parameters and click “OK”.

Parameter	Description
Name	Domain name; required.
Notes	Domain notes; optional.

Note

When three-level permissions are not enabled, projects cannot be created under a domain.

Enable Domain

Enable a domain that is in the “Disabled” status.

Enable Individually: In the Actions column, choose “Enable” under “More”, then confirm.

Enable in Bulk: Select one or more domains in the “Disabled” status, click “Batch Actions” → “Enable” above the list, then confirm.

Disable Domain

Disable a domain that is in the “Enabled” status. After disabling, users and groups cannot be created under the domain, and users in the domain cannot log in to the OneCloud platform.

Disable Individually: In the Actions column, choose “Disable” under “More”, then confirm.

Disable in Bulk: Select one or more domains in the “Enabled” status, click “Batch Actions” → “Disable” above the list, then confirm.

Delete Domain

A domain must be disabled and have no resources before it can be deleted; the default domain cannot be deleted.

Delete Individually: In the Actions column, choose “Delete” under “More”, then confirm.

Delete in Bulk: Select one or more deletable domains, click “Batch Actions” → “Delete” above the list, then confirm.

Set Tags

Select one or more domains, click “Batch Actions” → “Set Tags” above the list, configure tags, then confirm.

View Domain Details

Click a domain name in the list to open the details drawer. Drawer tabs: Details, Users, Projects, Roles, Cloud Accounts, Operation Logs.

Note

Resource statistics update every 15 minutes; click the refresh button for a real-time refresh.

Basic Information

Includes Cloud ID, ID, name, status, tags, identity provider, enabled status, creation/update time, notes, and more.

Resource Statistics

Statistic	Description
Infrastructure Resources	CPU cores, memory, VM storage, GPU total and usage, VMs, EIP count, total bandwidth.
Resource Statistics	Counts of VPCs, DNS records, identity providers, projects, groups, users, policies, and roles.
Multi-Cloud Management Resources	Counts of cloud accounts, cloud users, cloud user groups, and proxies.

Users

On the “Users” tab, view user name, display name, enabled status, console access, MFA, and domain for users in the domain, and perform management actions.

Projects

On the “Projects” tab, view project name and domain for projects in the domain, and perform management actions.

Roles

On the “Roles” tab, view role name, policies, sharing scope, and domain for roles in the domain, and perform management actions.

Cloud Accounts

On the “Cloud Accounts” tab, view cloud account name, status, enabled status, health status, balance, platform, account, hosts, VMs, auto sync, sync/check time, sharing scope, domain, resource-owning project, and more, and perform management actions.

Operation Logs

On the “Operation Logs” tab, view domain-related operation records.
Supports filtering by time, loading more, viewing details, and exporting logs on this page (click in the upper right).

Docs: Project

Mon, 01 Jan 0001 00:00:00 +0000

A project owns resources. Compute resources on OneCloud (VMs, bare metal, images, disks, snapshots, and more) are provided to users by project. Users must join a project before they can use resources in that project.

Entry: In the cloud management platform, click the navigation menu in the upper left corner, then click “Authentication & Security/Authentication/Authentication System/Project” in the left menu to open the Project page.

View Project List

Field	Description
Name	Project name; click to open the details drawer.
Tags	Project tags.
Project Admin	Project administrator user.
Domain	Domain the project belongs to.
Time	Creation time.

Note

After “Organization” is enabled in global settings, an organization tree appears on the left of the list for hierarchical project filtering.

Project sources include: the system project created by default after deployment; projects created under a domain; and projects synced from public clouds.

Create Project

On the Project page, click “Create” above the list to open the create project page.
Fill in the project information and click “Create” to proceed to Add Users; if you do not need to add users yet, click “Skip” to return to the list.
When adding users, fill in the parameters and click “Join”; you can also click “Skip” to finish creation.

Note

When three-level permissions are not enabled, projects can only be created under the Default domain.

Project Information

Parameter	Description
Name	Project name; required.
Notes	Project notes; optional.
Domain	Domain the project belongs to. Selectable in Admin Console when three-level permissions are enabled; otherwise automatically assigned to the current domain.

Add Users (Optional)

Parameter	Description
User	Users to join the project; multi-select supported.
Role	Roles for the users in the project; multi-select supported. Choose roles in the project’s domain, or shared roles from other domains that already have policies bound.

Note

Do not grant more permissions than needed. If a user needs access to multiple projects, manage project ownership and authorization centrally via Organization.

Manage Users/Groups

Manage users and groups that joined the project directly; supports adding, changing roles, and removing.

Entry: “Manage Users/Groups” in the list Actions column, or the “Joined Users/Groups” tab in the details drawer.

Add Users/Groups

On the “Joined Users/Groups” tab, click “Add”.
Configure the parameters and click “OK”.

Parameter	Description
Type	User or group.
Domain	Domain of the user/group (visible in Admin Console).
User/Group	Users or groups to join; multi-select supported.
Role	Roles when joining the project; multi-select supported.

Note

When a group joins a project, all users in the group join the project with the same roles.

Change Role

In the “Joined Users/Groups” list Actions column, click “Change Role”.
Change the roles and click “OK”.

Remove Users/Groups

Remove Individually: In the Actions column, click “Remove”, then confirm.

Remove in Bulk: Select one or more records, click “Remove”, then confirm.

Note

If a user joined a project both as a user and via a group, removing only the user record does not revoke project access; you must also remove the corresponding group, or remove the user from the group.

Set Project Admin

Assign an administrator user to a project.

Set Individually: In the Actions column, choose “Set Project Admin” under “More”, select a user, then confirm.

Set in Bulk: Select one or more projects, click “Set Project Admin” above the list, select a user, then confirm.

Set Tags

Select one or more projects, click “Set Tags” above the list, configure tags, then confirm.

You can also click “Edit Tags” in the Tags column to set tags for a single project.

Note

To attach a project under an organization leaf node, tag the project with the organization tags for that node, then click “Sync” in the upper left of the “Organization” page. You can also select a leaf node on the Organization page and “Add Project” directly. See Organization.

Delete Project

A project that still has resources cannot be deleted.

Delete Individually: In the Actions column, choose “Delete” under “More”, then confirm.

Delete in Bulk: Select one or more deletable projects, click “Delete” above the list, then confirm.

View Project Details

Click a project name in the list to open the details drawer. Drawer tabs: Details, Joined Users/Groups, Operation Logs.

Note

Resource statistics update every 15 minutes; click the refresh button for a real-time refresh.

Basic Information

Includes Cloud ID, ID, name, status, domain, tags, organization, group/user counts, project admin, creation/update time, notes, and more.

Resource Statistics

Statistic	Description
Host Resources	Counts of VMs, host templates, system images, host images, disks, snapshots, host snapshots, auto snapshot policies, security groups, IP subnets, and EIPs.
Load Balancer Resources	Counts of load balancer instances, access controls, and certificates.
Other Resources	Counts of cloud projects, buckets, RDS, and Redis.

Operation Logs

On the “Operation Logs” tab, view project-related operation records.
Supports filtering by time, loading more, viewing details, and exporting logs on this page (click in the upper right).

Docs: Group

Mon, 01 Jan 0001 00:00:00 +0000

A group is a collection of users. You can create and manage groups under a domain. When a group joins a project, all users in the group obtain project permissions with the same roles.

Group sources include: groups synced from LDAP or other identity providers; and groups created manually under a domain (groups created in an LDAP-synced domain are stored locally and are not written back to the LDAP server).

Entry: In the cloud management platform, click the navigation menu in the upper left corner, then click “Authentication & Security/Authentication/Authentication System/Group” in the left menu to open the Group page.

View Group List

Column	Description
Name	Group name; click to open the details drawer.
Domain	Domain the group belongs to.
Time	Creation time.

Above the list you can Create and Delete in bulk.

Create Group

Click “Create” above the list to open the create group dialog.
Fill in the parameters and click “OK”.

Parameter	Description
Name	Group name; required.
Notes	Group notes; optional.
Domain	Domain the group belongs to; visible only in Admin Console; required.

Manage Projects

Manage projects the group has joined; supports joining, changing roles, and removing.

Entry: “Manage Projects” in the list Actions column, or the “Joined Projects” tab in the details drawer.

Note

When three-level permissions are not enabled, a group can only join projects under the Default domain.
When three-level permissions are enabled, in Admin Console a group can join projects under any domain.

Join Project

On the “Joined Projects” tab, click “Join Project”.
Configure the parameters and click “OK”; users in the group join the project with the selected roles.

Parameter	Description
Domain	Domain of the project (visible in Admin Console).
Project	Projects to join; multi-select supported.
Role	Roles for the group in the project; multi-select supported.

Change Role

In the project list Actions column, click “Change Role”.
Adjust the roles and click “OK”.

Remove Project

Remove Individually: In the project list Actions column, click “Remove”, then confirm.

Remove in Bulk: Select one or more projects, click “Remove”, then confirm.

Manage Users

Manage users in the group; supports adding and removing.

Entry: “Manage Users” in the list Actions column, or the “Group Users” tab in the details drawer.

Add Users

On the “Group Users” tab, click “Add Users”.
Select users (multi-select supported) and click “OK”.

Remove Users

Remove Individually: In the user list Actions column, click “Remove”, then confirm.

Remove in Bulk: Select one or more users, click “Remove”, then confirm.

Delete Group

Groups synced from an LDAP server cannot be deleted. After a group is deleted, users in the group leave the projects the group had joined.

Delete Individually: In the Actions column, click “Delete”, then confirm.

Delete in Bulk: Select one or more deletable groups, click “Delete” above the list, then confirm.

View Group Details

Click a group name in the list to open the details drawer. Drawer tabs: Details, Joined Projects, Group Users, Operation Logs.

Basic Information

Includes Cloud ID, ID, name, status, domain, member count, creation/update time, notes, and more. Member count can be clicked to jump to the Group Users tab.

Operation Logs

On the “Operation Logs” tab, view group-related operation records.
Supports filtering by time, loading more, viewing details, and exporting logs on this page (click in the upper right).

Docs: User

Mon, 01 Jan 0001 00:00:00 +0000

Users are the direct consumers of resources. After a user joins a project with a role, the user can use resources in that project; specific management capabilities depend on the policies associated with the role.

User sources include: the administrator user created by default at deployment, manually created local users, and users synced from LDAP or other identity providers.

View User List

The list shows name, display name, tags, enabled status, console login, MFA, domain, creation/update time, and more.

Column	Description
Name	Username; click to open the details side panel.
Display Name	User display name.
Tags	User tags (LDAP users can sync tags automatically).
Enabled	Enabled or disabled status.
Console Login	Whether the user can log in to the OneCloud console.
MFA	Whether multi-factor authentication is enabled.
Domain	Domain the user belongs to.
Time	Creation/update time.

Create User

Click “Create” above the list to open the create user page.
Fill in user information and click “Create” to proceed to Join Project (optional).

User Information

Parameter	Description
Name	Username.
Notes	Optional description.
Password	Local user login password.
Domain	Domain the user belongs to (selectable in Admin Console).
Display Name	User display name.
Console Login	Whether the user can log in to the OneCloud console; login allowed by default.
Enable MFA	TOTP-based multi-factor authentication; global two-factor authentication must be enabled, otherwise this setting has no effect.

Join Project (Optional)

Parameter	Description
Project	Select domain and project.
Role	Roles when the user joins the project; multi-select supported.

Note

Do not grant more permissions than needed. If a user needs access to multiple projects, manage project ownership and authorization centrally via Organization instead of stacking high-privilege roles on each project.

After configuration, click “Join”; click “Skip” if not needed.

Note

When three-level permissions are not enabled, users can be created in any domain but can only join projects under the Default domain.
When three-level permissions are enabled, in Admin Console users can join projects in any domain.

Import Users

Bulk-import local users; prepare an Excel template file in advance.

Click “Import Users” above the list to open the import dialog.
Download the template and fill in user information in user_template.xlsx (username, department, password, and whether to allow WEB console login are all required).
Upload the file and click “OK”.

Note

Password in the template is optional; if no password is set, imported users can log in successfully with any password on the login page—change the password promptly.
Duplicate usernames cause import failure.

Modify Attributes

Modify display name, console login, Enable MFA, and other attributes.

Modify Individually: Actions column “Modify Attributes”, then confirm.

Modify in Bulk: Select users, “Batch Actions” → “Modify Attributes” above the list, then confirm.

Note

If MFA is not enabled in global settings, the MFA switch on the user has no effect.

Enable

Enable a user in the Disabled status; after enabling, the user can log in to the console normally.

Enable Individually: Actions column “More” → “Enable”, then confirm.

Enable in Bulk: Select disabled users, “Batch Actions” → “Enable”, then confirm.

Disable

Disable a user in the Enabled status; after disabling, login is blocked. If the user is already online, they are not forced out; subsequent login attempts fail after logout.

Disable Individually: Actions column “More” → “Disable”, then confirm.

Disable in Bulk: Select enabled users, “Batch Actions” → “Disable”, then confirm.

Change Password

Reset a local user’s password.

Actions column “More” → “Change Password” to open the reset password dialog.
Enter the new password and click “OK”.

Note

Only local (SQL identity provider) user passwords can be reset. LDAP authentication users do not support this operation.

Manage Projects

Manage projects the user has joined; supports joining, changing roles, and removing.

Join Project

Actions column “More” → “Manage Projects” to open the Joined Projects tab; or operate on that tab in the details side panel.
Click “Join Project”, select domain, project, and roles, then confirm.

Note

Do not grant more permissions than needed. If a user needs access to multiple projects, manage project ownership and authorization centrally via Organization.

Change Role

On the Joined Projects tab, click “Change Role” in the project Actions column.
Change the roles and confirm.

Note

Projects joined via a group do not support changing roles.

Remove Project

Remove Individually: On the Joined Projects tab, click “Remove” in the Actions column, then confirm.

Remove in Bulk: Select projects, click “Remove”, then confirm.

Note

Projects joined via a group cannot be removed directly.

Reset MFA

Clear MFA credentials bound to the user; the user must set them up again on the next login.

Actions column “More” → “Reset MFA” to open the confirmation dialog.
Click “OK”. After reset, previous MFA information is invalid and the user must reconfigure it on the login page.

Delete

Delete Individually: Actions column “More” → “Delete”, then confirm.

Delete in Bulk: Select users, “Batch Actions” → “Delete”, then confirm.

View User Details

Click a username in the list to open the details side panel. Tabs include: Details, Joined Projects, Joined Groups, Cloud Users, Passwordless Login Users, Operation Logs.

Details

Shows display name, enabled status, console login, MFA, tags, joined group/project counts, identity provider, and last login IP, access method, login time, password expiration time, and more.

Joined Projects

Shows projects the user has joined, including domain, join method (direct/via group), roles, policies, and more; supports joining projects, changing roles, and removing projects on this tab.

Joined Groups

Shows groups the user belongs to; supports Join Group and Leave Group (individual or bulk).

Cloud Users

Manage public cloud “cloud users” associated with this local user.

Column	Description
Username	Cloud username.
Console Login	Whether cloud console login is allowed.
Status	Cloud user status.
Password	View/retrieve password information.
Login URL	Cloud console login URL.
Associated Local User	The current local user.
Platform	Cloud platform.
Cloud Account	Owning cloud account.

Create Cloud User

On the “Cloud Users” tab, click “Create”.
Configure domain, cloud account/cloud subscription/cloud user group, name, email, and more, then confirm. The associated local user is fixed to the current user.

Supports enabling/disabling console login and deleting (individual or bulk).

Manage passwordless login users associated with this local user (used for passwordless access via cloud identity and similar scenarios).

Column	Description
Name	Passwordless login user name.
Status	Status.
Cloud User Group	Associated cloud user group.
Platform	Cloud platform.
Cloud Account	Owning cloud account.

Create Passwordless Login User

On the “Passwordless Login Users” tab, click “Create”.
Select project, cloud account (and cloud subscription if needed), and cloud user group, then confirm. The associated local user is fixed to the current user.

Supports deleting (individual or bulk).

Operation Logs

Click the “Operation Logs” tab.
Supports filtering by time, loading more, viewing details, and exporting logs on this page (click in the upper right).

Docs: Role

Mon, 01 Jan 0001 00:00:00 +0000

A role is a collection of policies. When a user joins a project, a role must be specified; the user obtains corresponding capabilities through the policies associated with the role. Built-in system roles cannot be deleted; create custom roles when built-in roles do not meet your needs.

Note

Built-in system roles are described below (names and associated policies depend on the deployment environment):

Role	Associated Policies	Sharing Scope	Policy Scope	Description
admin	sysadmin	Globally shared	System	When a user joins the system project in the default domain with the admin role, the user has all Admin Console permissions.
domainadmin	domainadmin	Globally shared	Domain	All Domain Admin Console permissions.
project_owner	projectadmin	Globally shared	Project	All permissions within the project scope.
project_editor	projecteditor	Globally shared	Project	Edit permissions for resources within the project scope.
member	projectviewer, projectdashboard	Globally shared	Project	Read-only permissions for resources within the project scope.
fa	sysmeteradmin, sysdashboard	Globally shared	System	All system billing and metering permissions.

View Role List

Column	Description
Name	Role name; click to open the details drawer.
Policies	Number of associated policies; hover to view policy names and descriptions.
Sharing Scope	Not shared (private), Domain share - partial, Domain share - all.
Domain	Domain the role belongs to.
Time	Creation time.

Above the list you can Create, Set Sharing, and Delete in bulk.

Create Role

Click “Create” above the list to open the create role dialog.
Step 1: Fill in role information, then click “Next”.
Step 2: Associate policies (required), expand advanced configuration if needed, then click “OK”.

Step 1: Role Information

Parameter	Description
Name	Role name; required.
Notes	Role notes; optional.
Domain	Domain the role belongs to; selectable in Admin Console when three-level permissions are enabled.

Step 2: Associate Policies

Parameter	Description
Policies	Policies associated with the role; required; multi-select supported.

Advanced Configuration (optional):

Parameter	Description
IP Whitelist	Only users logging in from whitelisted IPs have this role’s permissions; leave empty for no restriction. Formats such as `192.168.1.1` or `192.168.1.0/24`; separate multiple addresses with `;`.
Effective Projects	Limit policies to specific projects; if not specified, they apply globally.
Valid Time Range	Start and end time when the policies are effective.

Manage Policies

Manage policies associated with the role; supports adding and removing.

Entry: “Manage Policies” in the list Actions column, or the “Policies” tab in the details drawer.

The policy list shows name, notes, IP whitelist, effective projects, and valid time range.

Add Policies

On the “Policies” tab, click “Add Policy”.
Select policies and configure advanced parameters (IP whitelist, effective projects, valid time range), then click “OK”.

Remove Policies

Remove Individually: In the policy list Actions column, click “Remove”, then confirm.

Remove in Bulk: Select one or more policies, click “Remove”, then confirm.

Set the sharing scope of a role:

Not shared (private): Available only to users in this domain.
Domain share - partial: Shared to specified domains; available only to users in the role’s domain and the shared domains.
Domain share - all: Globally shared; available to users in all domains.

Note

Both of the following must be true: the current user is in Admin Console, and OneCloud has three-level permissions enabled.

Set Sharing Individually: Actions column “More” → “Set Sharing”, configure the sharing scope, then confirm.

Set Sharing in Bulk: Select one or more roles, click “Set Sharing” above the list, configure, then confirm.

Delete Role

Built-in system roles cannot be deleted. Custom roles can be deleted only when they are private and unused.

Delete Individually: Actions column “More” → “Delete”, then confirm.

Delete in Bulk: Select deletable roles, click “Delete” above the list, then confirm.

View Role Details

Click a role name in the list to open the details drawer. Drawer tabs: Details, Policies, Operation Logs.

Basic Information

Includes Cloud ID, ID, name, status, domain, policy count, matching user/group/project counts, sharing scope, creation/update time, notes, and more. Policy count can be clicked to jump to the Policies tab.

Operation Logs

On the “Operation Logs” tab, view role-related operation records.
Supports filtering by time, loading more, viewing details, and exporting logs on this page (click in the upper right).

Docs: Policy

Mon, 01 Jan 0001 00:00:00 +0000

Policies define operation permissions on OneCloud platform resources. After deployment, commonly used policies (system policies) are preconfigured. Users have no permissions by themselves; when joining a project they must be assigned a role, and obtain capabilities through policies associated with that role.

Note

System policies combine user views and operation permissions to generate 9 policy types for resources: Admin Console, Domain Admin Console, and Project view × Manage, Edit, and Read-only.

Entry: In the cloud management platform, click the navigation menu in the upper left corner, then click “Authentication & Security/Authentication/Authentication System/Policy” in the left menu to open the Policy page.

View Policy List

The list shows name, enabled status, policy scope, sharing scope, domain, creation/update time, and more. Tabs support filtering by All, Custom, and System.

Column	Description
Name	Policy name; click to open the details side panel.
Enabled	Enabled or disabled status.
Policy Scope	Admin Console, Domain Admin Console, or No Admin Console.
Sharing Scope	Not shared (private), Domain share - partial, Domain share - all.
Domain	Domain the policy belongs to.
Time	Creation/update time.

Above the list you can Enable, Disable, Set Sharing, and Delete in bulk.

Create Policy

When system policies do not meet your needs, create a custom policy.

Note

After creating or modifying a custom policy, wait about 5 minutes for it to take effect.

Click “Create” above the list to open the create policy page.
Configure the parameters and click “Create”.

Parameter	Description
Domain	Domain the policy belongs to (selectable in Admin Console when three-level permissions are enabled).
Name	Custom policy name.
Notes	Optional description.
Policy Scope	Admin Console, Domain Admin Console, or No Admin Console; cannot be changed after creation.
Organization	Can associate organization nodes when policy scope is not “No Admin Console” (optional).
Domain Tags	Configurable when policy scope is Admin Console (optional).
Project Tags	Configurable when policy scope is not “No Admin Console” (optional).
Resource Tags	Optional; limit where the policy applies by resource tags.
Edit Mode	Visual View (default) or YAML Edit View.
Policy Content	Configure according to the selected edit mode; see below.

Visual View

Configure policy content by selection, mainly including:

Resource Permissions: Select list, details, update, create, delete, and various execute actions by module/menu; supports select-all at module and menu levels.
Other Permissions: Select common operations by service and resource; you can search by permission name and expand “Execute Actions” for detailed selection.

Policy scope affects which resource items appear in the visual panel: project scope does not show domain-level/system-level resources; domain scope does not show system-level resources.

YAML Edit View

Write the policy in the YAML editor, describing allow or deny by service, resource, and action. Default content:

policy:
 "*": allow

Note

Do not break the YAML structure arbitrarily; incorrect format may cause creation failure or the policy not taking effect.

Modify Policy

Used to modify custom policies; system policies cannot be modified.

Note

After modification, wait about 5 minutes for it to take effect.
After a logged-in user’s policies are modified, the user must refresh the browser page to see the latest permissions.

In the Actions column, click “Modify” to open the modify policy page.
You can modify name, notes, tag conditions, edit mode, and policy content; Policy Scope cannot be changed after creation.
Click “OK” to finish.

Enable

Enable a policy in the Disabled status; supports individual and bulk operations.

Enable Individually: Actions column “More” → “Enable”, then confirm.

Enable in Bulk: Select one or more disabled policies, click “Enable” above the list, then confirm.

Disable

Disable a policy in the Enabled status. After disabling, matching users no longer have the corresponding operation permissions.

Disable Individually: Actions column “More” → “Disable”, then confirm.

Disable in Bulk: Select one or more enabled policies, click “Disable” above the list, then confirm.

Clone

Quickly create a copy based on an existing policy.

Actions column “More” → “Clone” to open the clone dialog.
Enter a new name and click “OK”. The clone matches the source policy; use Modify to adjust further.

Set the sharing scope of a policy:

Not shared (private): Available only to users in this domain.
Domain share - partial: Shared to specified domains; available only to users in the resource’s domain and the shared domains.
Domain share - all: Globally shared; available to users in all domains.

Note

Both of the following must be true: the current user is in Admin Console, and OneCloud has three-level permissions enabled. System policies do not support setting sharing.

Set Sharing Individually: Actions column “More” → “Set Sharing”, configure the sharing scope, then confirm.

Set Sharing in Bulk: Select policies, click “Set Sharing” above the list, configure, then confirm.

Delete

Delete custom policies in the Disabled status; system policies cannot be deleted.

Delete Individually: Actions column “More” → “Delete”, then confirm.

Delete in Bulk: Select disabled policies, click “Delete” above the list, then confirm.

View Policy Details

Click a policy name in the list to open the details side panel.

Details

Shows enabled status, whether shared, tags, policy scope, policy content, and other basic information.

Operation Logs

In the details side panel, click the “Operation Logs” tab.
Supports filtering by time, loading more, viewing details, and exporting logs on this page (click in the upper right).