For AI agents: the complete documentation index is available at https://docs.dataplatform.ovh.net/llms.txt, the full documentation bundle is available at https://docs.dataplatform.ovh.net/llms-full.txt, and this page is available as Markdown at https://docs.dataplatform.ovh.net/iam-auth-providers.md.
  • 🇬🇧 English

    • Configure authentication providers for your Project

    The Identity Access Manager (IAM) lets you configure the authentication methods used to login to your Project and your applications

    Objective

    The Identity Access Manager (IAM) lets you configure the authentication methods used to login to your Project and your applications.

    You can set any authentication provider as active or inactive. Setting an authentication provider as inactive means that it can no longer be used to authenticate to a Project or an application.

    iam

    Default Data Platform authentication providers

    Data Platform offers 3 default authentication providers in every Project: Data Platform, Project, and API key.

    Data Platform

    This is the main authentication provider for the Data Platform. It lets you use your Data Platform account that you created when you first joined the platform.

    Info

    It is hosted in the Cloud Management Platform, which serves all organizations and Projects that you are part of.

    Project

    This is a simple sign-in-by-email method provided by the Project IAM for all applications deployed on this Project. It provides an easy method to invite end-users to your applications without having them create an account on Data Platform.

    Info

    It is hosted in the Project itself, which means all user information is stored within the Project itself and not shared with other Projects.

    API key

    API keys are usually used to let users connect using API and secret keys. Their main purpose is for advanced or custom configuration using Data Platform APIs.

    Warning

    This authentication method must be active for external users or applications to connect to the Project via API.

    Add an authentication provider

    Click on the +New auth. provider button.

    manage

    List of authentication providers

    Data Platform supports 7 external single sign-on providers:

    ProviderTypeDescription
    Azure ADOAuth 2.0Active Directory (AD) is a directory service that Microsoft developed for the Windows domain networks.
    OktaOAuth 2.0Okta provides cloud software that helps companies manage and secure user authentication into applications.
    Auth0OAuth 2.0Auth0 is a cloud-based identity authentication platform for application developers.
    GoogleOAuth 2.0Google SSO is the authentication protocol of Google.
    Open AMOAuth 2.0OpenAM is an open-source access management, entitlements and federation server platform supported by the Open Identity Platform Community.
    Open IDOAuth 2.0OpenID is an open standard and decentralized authentication protocol promoted by the non-profit OpenID Foundation.
    SAML 2.0SAML 2.0Security Assertion Markup Language 2.0 (SAML 2.0) is a version of the SAML standard for exchanging authentication and authorization data between security domains.
    List of authentication providers — Index list auth providers

    You can then configure your new authentication provider. The configuration depends on the provider.

    Learn how to plug in your Azure AD Learn how to plug in your Okta Learn how to plug in your Auth0

    Automatically map roles/groups from your authentication provider

    Automatically map groups or roles on Data Platform using permissions that were already set up in your authentication provider.

    Configure custom mapping of groups/roles

    Troubleshoot authentications from your external authentication provider

    Info

    This feature is only available for external authentication providers, and for the Data Platform authentication provider.

    It is possible to troubleshoot the external authentication provider configuration by logging the requests to the external server and the responses received from the server. By viewing what the identity provider sends back for each login request and how it is interpreted by Data Platform, this allows you to detect errors in a configuration such as the user information or the mapping.

    Login logs are available in the Log history tab of an existing authentication provider.

    history

    Opening a specific login will display:

    • the raw response received from the external authentication server
    • the configuration used by Data Platform to map user information to data sent by the external server
    • the result that is interpreted using the two aforementioned payloads: this is the final user information in the IAM as computed from the external authentication server.
    history

    Authentication Policies

    This section describes how to configure the authentication policies for account suspension due to multiple failed attempts. The settings are designed to enhance the security of user accounts by defining thresholds and actions to take when those thresholds are exceeded.

    SettingDescriptionOptions/Default
    Enable Account SuspensionThis toggle enables or disables the account suspension feature.Enabled (On)
    Login AttemptsSpecifies the number of failed login attempts allowed before the account is suspended.Infinite (∞)
    Password Renewal AttemptsSpecifies the number of failed password renewal attempts allowed before the account is suspended.Infinite (∞)
    Interval Time for Password AttemptsDefines the time window for considering the number of failed password attempts.1 Hour (default), adjustable
    Suspension DurationDefines the duration for which the account remains suspended after reaching the failed attempts threshold.5 Minutes (default), adjustable
    Notify Admin on SuspensionThis toggle enables or disables email notifications to the administrator when an account is suspended.Disabled (Off) by default

    Enable multi-factor authentication (MFA)

    Multi-factor authentication (MFA) is a feature which forces users to go through a second method of authentication in addition to their usual method. The available authentication methods are:

    • a code sent by email
    • a code sent by SMS
    • a code retrieved on a two-factor app (e.g. Google Authenticator, Microsoft Authenticator, etc..)
    Warning

    MFA enforcement at project-level is only available for the Project authentication method. In other words, if the user is logged in through their Data Platform account (Data Platform ID) (or any other registered authentication provider in the project) they will bypass the MFA requirement in the project (as the MFA enforcement should be delegated to the third-party system in this case).

    Info

    It is possible for an admin of an organization to enforce MFA on the Data Platform ID authentication method for a whole organization, by turning on the option in the organization settings. For single sign-on from other authentication providers, the MFA enforcement should be delegated to the third-party system.

    To enforce MFA in your Project for the Project authentication method, open the Project authentication provider, find the panel "Multi factor authentication (MFA)" and turn it on.

    Enable multi-factor authentication (MFA) — Dpid mfa activate

    Choose the methods you will allow your users to authenticate with.

    Methods have the following requirements:

    • Email: none
    • SMS: a phone number must be registered on the user's page for this option to be enabled
    • External two-factor apps: a 2FA app code must be generated by an administrator from the user's IAM page for this option to work. Users will NOT be able to self-generate a code from the app they are logging to.
    Enable multi-factor authentication (MFA) — Dpid mfa methods

    After you save, any user logging in via the Project authentication method will always need to authenticate through a second method.

    Warning

    If the Project authentication method is used for one or more Data Platform apps, you must update the CAM/IAM extension of all your apps or your users will no longer be able to login.

    Migrate an app to IAM 1.4.0

    1 - Update the version of client-authority-manager module

    • Open ./config/forepaas.json file (root level of app)

    • Edit "client-authority-manager" : "XXX" to "client-authority-manager" : "1.4.0"

    • Reload modules in the application's Overview, above Versions. If you work locally, use
      command `npx git+https://gitlab.forepaas.com/open-sources/fppm.git install -f``

    • Check version update by opening ./config/forepaas/client-authority-manager/forepaas.json and looking at version

    2 - Add new translation to i18n configuration

    • Edit ./config/i18n/en.json
    • Add these lines:
    "authentication.mfa.authenticator": "Use authenticator app",
"authentication.mfa.authenticator.code_label": "Enter the code from the two-factor app on your mobile device. If you’ve lost your device, please contact your admin to regenerate an authentication code",
"authentication.mfa.authenticator.send": "Activate",
"authentication.mfa.code": "XXXXXX",
"authentication.mfa.description": "Two-factor authentication is required to reach this page.",
"authentication.mfa.description2": "Please select one of the methods below to authenticate.",
"authentication.mfa.email": "Send me an email",
"authentication.mfa.email.code_label": "Enter the code you received by email",
"authentication.mfa.email.resend": "Resend email",
"authentication.mfa.email.send": "Send email",
"authentication.mfa.email.send.success": "An email containing an authentication code has been sent to you",
"authentication.mfa.no-phone": "You don’t have a registered phone number. Please ask your admin to add your phone number to your user info to be able to use this method.",
"authentication.mfa.send.authenticator": "An email containing a QR code has been sent to you. Please scan it with your external two-factor app to activate MFA for Data Platform.",
"authentication.mfa.sms": "Send me an SMS",
"authentication.mfa.sms.code_label": "Enter the code you received by SMS",
"authentication.mfa.sms.resend": "Resend SMS",
"authentication.mfa.sms.send": "Send SMS",
"authentication.mfa.sms.send.success": "An SMS containing an authentication code has been sent to you"
    • Edit ./config/i18n/fr.json
    • Add these lines
    "authentication.mfa.authenticator": "Utiliser une app Authenticator",
"authentication.mfa.authenticator.code_label": "Saisissez le code de l'application à deux facteurs sur votre appareil mobile. Si vous avez perdu votre appareil, veuillez contacter votre administrateur pour régénérer un code d'authentification",
"authentication.mfa.authenticator.send": "Activer",
"authentication.mfa.code": "XXXXXX",
"authentication.mfa.description": "Une authentification à deux facteurs est requise pour accéder à cette page.",
"authentication.mfa.description2": "Veuillez sélectionner l'une des méthodes ci-dessous pour vous authentifier.",
"authentication.mfa.email": "M'envoyer un email",
"authentication.mfa.email.code_label": "Entrez le code que vous avez reçu par email",
"authentication.mfa.email.resend": "Réenvoyer email",
"authentication.mfa.email.send": "Envoyer email",
"authentication.mfa.email.send.success": "Un email contenant un code d’authentification vient de vous être envoyé.",
"authentication.mfa.no-phone": "Vous n'avez pas de numéro de téléphone enregistré. Veuillez demander à votre administrateur d'ajouter votre numéro de téléphone à vos informations utilisateur pour pouvoir utiliser cette méthode.",
"authentication.mfa.send.authenticator": "Un email contenant un code QR vous a été envoyé. Veuillez le scanner avec votre application externe pour activer l’authentification a multiple facteurs pour Data Platform.",
"authentication.mfa.sms": "M'envoyer un SMS",
"authentication.mfa.sms.code_label": "Entrez le code que vous avez reçu par SMS",
"authentication.mfa.sms.resend": "Renvoyer SMS",
"authentication.mfa.sms.send": "Envoyer SMS",
"authentication.mfa.sms.send.success": "Un SMS contenant un code d’authentification vient de vous être envoyé."

    Go further

    If you need training or technical assistance to implement our solutions, contact your sales representative or click on this link to get a quote and ask our Professional Services experts for a custom analysis of your project.

    Ask questions, give your feedback and interact directly with the team building the Data Platform on the dedicated Discord channel.

    If you need support with your OVHcloud services, create a request in our Help Centre.

    Join our community of users.