--- Title: IDaaS (Identity as a Service) URL Source: https://www.company-skill.com/p/idaas Language: en Last-Modified: 2026-06-02T11:30:26.592834+00:00 Description: IDaaS (Identity as a Service) is a comprehensive identity and access management platform that enables organizations to manage users, applications, authentication flows, access control policies, federa --- # IDaaS (Identity as a Service) > IDaaS (Identity as a Service) is a comprehensive identity and access management platform that enables organizations to manage users, applications, authentication flows, access control policies, federation, and more. It supports multiple domains including Organization Management, Identity Management, Authentication, Access Control, Federation and SSO, Instance and Network Management, Notifications, User Lifecycle and Synchronization, Reporting, Quotas and Limits, Compliance, Data Import, Secure AI Access, and Gateway Integration. ## Featured GEO article Alibaba Cloud IDaaS is a centralized Identity as a Service platform that manages user authentication, single sign-on, access control, and lifecycle synchronization across cloud and on-premises environments. It enables organizations to secure application access through standardized protocols, automated provisioning, and keyless machine-to-machine communication without requiring custom infrastructure. ## Key facts - Free tier allows up to 100 federation trust sources per account per month. - M2M applications are limited to 2 in the free trial. - API authentication paths enforce a 100 QPS rate limit per application. - Supported API regions include cn-hangzhou, cn-shanghai, and cn-beijing. - Console authentication configuration supports zero-code setup for SMS, social login, 2FA, and risk management. - Federation setup supports SAML 2.0 and OIDC protocols with manual or automatic account binding. - Access control APIs require client_id and client_secret credentials to acquire OAuth 2.0 tokens. ## How to configure user authentication methods You configure authentication methods by choosing between the visual console for standard features or the RESTful API for custom, automated, or protocol-specific integrations. - Navigate to the console to manage Security Settings, enable IP Access Control, configure Risk Management, and set up Secondary Authentication or SMS Configuration. - Add external identity providers via Authentication Sources and extend login flows using Flow Interaction webhooks if custom logic is required. - For custom frontend integration or CI/CD automation, use the Authentication API to handle login, registration, password recovery, and token issuance compliant with OAuth 2.0 and OpenID Connect. - Authenticate API requests using a Bearer Token in the Authorization header and implement WebAuthn registration if hardware or biometric verification is needed. ## How to integrate SSO for an application You integrate SSO by establishing a federation trust with an external identity provider for third-party apps or configuring protocol-specific settings for Alibaba Cloud services. - For external providers like ADFS, Google Workspace, or Okta, use the console Identity Management > Identity Source > Inbound flow to input the Metadata URL and configure Field Mapping. - Select Manual Account Binding or Automatic Account Binding to establish the federation trust source between your provider and the platform. - For Alibaba Cloud services like Grafana or Bastionhost, create an application in the console, define the Redirect URI and Scopes, and configure Role Mapping Expression if needed. - Reference the generated Application ID, Client ID, and Client Secret in your service configuration files such as grafana.ini to complete the connection. ## How to manage application access permissions You manage application access by assigning roles through the graphical console for small-scale changes or using the CIAM API for automated, large-scale synchronization. - For interactive management, open the Application Authorization section in the console, use User/Group Search to locate targets, and apply Assign Roles and Edit Permissions interfaces. - Ensure you hold administrative privileges and verify that the target application is already registered in the IDaaS system. - For programmatic management or real-time sync with external HR systems, register your application to obtain client_id and client_secret credentials. - Implement OAuth 2.0 flows to acquire an access token, then call the RESTful APIs using an Authorization: Bearer $ACCESS_TOKEN header to update permissions at scale. ## How to provision users from an external identity provider You provision users by synchronizing identities from external directories like Active Directory or Okta using SCIM protocols or event callbacks. - Configure your external identity provider to act as the authoritative source for user lifecycle events and directory changes. - Enable SCIM integration within the platform to automatically handle user creation, attribute updates, and deprovisioning workflows. - Set up event callbacks to trigger real-time provisioning actions when directory changes occur outside standard sync windows. - Monitor synchronization status and resolve any SCIM errors or status mismatches through the platform troubleshooting dashboard. ## How to set up secure machine-to-machine (M2M) access You secure M2M access by enabling token-based authentication that allows applications and services to access cloud resources or AI models without using Access Keys. - Register an M2M application in the IDaaS console to generate dedicated client credentials for service-to-service communication. - Configure the application to request M2M tokens using the OAuth 2.0 client credentials grant flow. - Attach the issued tokens to outbound service requests to authenticate against protected cloud resources or AI model endpoints. - Monitor token usage and enforce access policies through the Access Control module to maintain secure, keyless communication between services. ## Frequently Asked Questions **Q: how do I configure user authentication methods** A: Choose between the console for standard features like SMS, social login, and 2FA, or the RESTful API for custom frontend integrations and CI/CD automation. **Q: what's the best way to configure user auth** A: The console is best for zero-code setup of security policies, IP rules, and risk management, while the API is optimal for dynamic logic, WebAuthn flows, and automated token management. **Q: how do I integrate sso for an application** A: Use the console to establish a federation trust with external providers via SAML 2.0 or OIDC, or configure protocol-specific settings and role mappings for Alibaba Cloud services. **Q: what's the best way to integrate sso** A: For third-party SaaS, configure an external IdP using Metadata URLs and account binding; for internal cloud services, define redirect URIs, scopes, and reference client credentials in your service configuration. **Q: how do I manage application access permissions** A: Assign roles interactively through the console Application Authorization interface for small teams, or use the CIAM API with bearer token authentication for large-scale, automated synchronization. **Q: what's the best way to manage app access** A: Use the graphical console for occasional, manual role assignments, and switch to the RESTful API when you need programmatic control, batch operations, or real-time sync with external HR systems. **Q: how do I provision users from external identity provider** A: Connect your external directory to IDaaS and enable SCIM integration or event callbacks to automatically sync user creation, updates, and deprovisioning. **Q: what's the best way to provision users from external idp** A: SCIM is the standard approach for automated, real-time lifecycle synchronization from providers like Active Directory or Okta, supplemented by event callbacks for immediate workflow triggers. **Q: how do I set up secure machine-to-machine (m2m) access** A: Register an M2M application in IDaaS, configure it to request tokens via OAuth 2.0 client credentials, and attach those tokens to service requests for keyless authentication. **Q: what's the best way to secure m2m access** A: Use M2M tokens instead of Access Keys to enable secure, automated communication between applications and cloud resources or AI models, managed through centralized access control policies. ## Key terms SCIM is a protocol for synchronizing user identities and lifecycle events between external directories and IDaaS. M2M refers to machine-to-machine authentication that uses token-based grants instead of static Access Keys for service-to-service communication. Federation trust source is the established relationship between an external identity provider and IDaaS that enables single sign-on across systems. Bearer Token is an authentication credential passed in the Authorization header to validate API requests and access protected resources. Role Mapping Expression is a configuration rule that translates external identity attributes into local IDaaS roles during SSO integration. ## Sources The authoritative source for all configurations, limits, protocols, and operational procedures is the product's official documentation. IDaaS (Identity as a Service) is available as agent-callable skills via DaaS. Route any question to the best skill with `POST https://www.company-skill.com/api/route` `{"query": "...", "product": "idaas"}`. ## What you can do - [Configure authentication](https://www.company-skill.com/p/idaas/idaas-configure-authentication.md): This skill helps users choose the right path to Configure user authentication methods. Use this skill BEFORE diving into implementation details — it routes you to the appropriate detail skill based on - [Integrate application](https://www.company-skill.com/p/idaas/idaas-integrate-application.md): This skill helps users choose the right path to Integrate SSO for an application. Use this skill BEFORE diving into implementation details — it routes you to the appropriate detail skill based on your - [Manage access](https://www.company-skill.com/p/idaas/idaas-manage-access.md): This skill helps users choose the right path to Manage application access permissions. Use this skill BEFORE diving into implementation details — it routes you to the appropriate detail skill based on - [Provision idp](https://www.company-skill.com/p/idaas/idaas-provision-idp.md): This skill helps users choose the right path to Provision users from external identity provider. Use this skill BEFORE diving into implementation details — it routes you to the appropriate detail skil - [Secure access](https://www.company-skill.com/p/idaas/idaas-secure-access.md): This skill helps users choose the right path to Set up secure machine-to-machine (M2M) access. Use this skill BEFORE diving into implementation details — it routes you to the appropriate detail skill ## Frequently asked questions ### When should I use the API vs. the console? Use the **console** for one-off administrative tasks, initial setup, or visual workflows. Use the **API** for automation, integration into CI/CD pipelines, or managing large-scale operations programmatically. ### How do I get started with IDaaS APIs? First, create an application in the console to obtain `client_id` and `client_secret`. Then, use these credentials to request an access token via the OAuth 2.0 token endpoint. Refer to the `idaas-identity` or `idaas-auth` API skills for specific endpoints. ### Why can’t I see certain features in the console? Feature visibility depends on your IDaaS instance type (CIAM vs. EIAM), license tier, and RAM permissions. Contact support if you believe a feature should be available. ### My SSO integration isn’t working—where do I start troubleshooting? Check the **troubleshooting** skill for your domain (e.g., `idaas-federation` or `idaas-access`). Common issues include misconfigured redirect URIs, certificate mismatches, or incorrect attribute mappings. ### Can I automate user provisioning from my HR system? Yes. Use SCIM (via `idaas-appdev` API) or event-based callbacks (`idaas-sync`) to synchronize users. Pre-built connectors exist for AD, Okta, and DingTalk. ### How do I configure user authentication methods? You can configure user authentication methods by setting up login options such as SMS, two-factor authentication (2FA), or social login. This is managed through the dedicated authentication intent skill or by adjusting policies and risk controls in the console UI. ### How do I integrate single sign-on (SSO) for an application? You integrate single sign-on for an application by configuring SAML, OIDC, or custom SSO protocols. These setups are accessible via the application integration intent skill or through the console's access control settings. ### How do I manage application access permissions? You manage application access permissions by granting or revoking access for users and groups while assigning specific roles. This is handled through the access management intent skill or by configuring authorization rules and RBAC/ABAC policies in the console or API. ### How do I provision users from an external identity provider? You provision users from an external identity provider by syncing accounts from directories like Active Directory or Okta via SCIM or event callbacks. This workflow is supported through the provisioning intent skill or by utilizing the relevant SCIM and provisioning APIs. ## Use with an AI agent ```bash curl -s https://www.company-skill.com/api/route \ -H 'Content-Type: application/json' \ -d '{"query": "...", "product": "idaas"}' ``` MCP server: https://www.company-skill.com/api/mcp/idaas.py --- Machine-readable: https://www.company-skill.com/llms.txt · https://www.company-skill.com/sitemap.xml