Tencent Cloud currently supports two SSO methods: Role-Based SSO and User-Based SSO. This document describes the application scenarios and selection criteria of these two methods, assisting you in choosing the appropriate SSO method based on your overall business requirements.
Role-Based SSO
Role-Based SSO applies to the following scenarios:
Considering management costs, you may prefer to avoid creating and managing users in the cloud, thus evading the workload brought about by user synchronization.
You want to sustain some cloud based local users while using SSO. The cloud based user can direct log in to Tencent Cloud and can be employed for a variety of purposes such as testing new features, serving as an alternative login method in the case of network or enterprise's IdP issues.
You want to differentiate permissions on the cloud based on the group joined by the user in the local IdP or a particular attribute of the user. You can adjust permissions by simply changing the group or attribute.
You assert multiple Tencent Cloud accounts but operate with a unified enterprise IdP. You desire a single configuration within the enterprise IdP that grants SSO capability to multiple Tencent Cloud accounts.
Your various branch offices contain multiple IdPs, and they all require access to a single Tencent Cloud account. You need to set up multiple IdPs within a single Tencent Cloud account to implement SSO.
You wish that SSO can also be performed through a programmatic access method except the console.
User-based SSO
User-based SSO applies to the following scenarios:
You prefer logins initiated on Tencent Cloud's login page, rather than directly accessing your IdP's login page.
There are certain cloud products you require that temporarily do not support role access. For the cloud products that support role access (i.e., access via STS), please refer to CAM-Enabled Role. Your IdP does not support sophisticated customized attribute configurations.
Your business does not require role-based SSO but you wish to streamline the IdP configurations.