Cloud IAM Set Up a Trusted Profile for Federated Access
A 4-step recipe with IBM. We can help you get access.
Recipe · 4 steps
Cloud IAM Set Up a Trusted Profile for Federated Access
with IBM · Identity & Access Management
Create a trusted profile with a SAML claim rule and confirm it resolves.
- Create the trusted profile. On its own the profile trusts nobody — it is an empty identity until at least one claim rule is attached in the next step.
- Attach the SAML claim rule that defines the trust. Only identities presenting a token from the named realm whose claim satisfies this condition may apply the profile, so this condition is the actual security boundary.
- List the rules attached to the profile to confirm the new rule is the only trust path and that no unexpected rule is already granting access.
- Read the profile back and capture its IAM ID. That IAM ID is the subject any subsequent access policy must be written against — the profile still has no access until such a policy exists.
What you'll need to have ready
- accountId: The IBM Cloud account ID the trusted profile belongs to.
- profileName: The name of the trusted profile (e.g. "corp-sso-engineering").
- realmName: The realm name of the identity provider the trust is established with.
- claimName: The claim in the incoming token to test (e.g. "groups" or "email").
- claimValue: The value the claim must match for the profile to apply.
- claimOperator: How the claim value is compared.
- ruleName: The name of the claim rule.
- sessionExpiration: Token session expiration in seconds for identities applying this profile.
- profileDescription: A description of who the profile is for and why the trust exists.
For your developer
Arazzo workflow ibm:setup-trusted-profile-federation, 4 operations: createProfile → createClaimRule → listClaimRules → getProfile. Specs on APIs.io.