ZStack ZSphere 4.10.6>ZStack ZSphere Documentation>ZStack ZSphere User Guide>System Management>Identity and Access Management

System Management

Identity and Access Management

Overview

The Identity and Access Management module of ZStack ZSphere provides unified user identity management and access control. It supports centralized management of regular users, configuration of a unified authentication system for single sign-on with ZStack ZSphere, and management of access permissions for all users to platform resources.

Centralized User Management

It supports the unified creation and management of users and user groups.

Precise Role-Based Access Control

Different role permissions can be granted to different users and user groups, allowing you to precisely control the operations that specific users or user groups can perform on particular resources, thereby assisting in maintaining the security of the environment.

Integration with Unified Authentication Systems

It supports configuring a unified authentication system based on OIDC, AD, LDAP protocols for single sign-on (SSO). This allows direct use of users from the unified identity authentication system without the need to create additional users, enhancing management efficiency and reducing security risks.

Preparation

Before using the ZStack ZSphere identity and access management features, ensure that the platform version and license authorization meet the requirements.

Make sure the installed software version is ZStack ZSphere 4.10.0 or later.
To use the single sign-on system, roles, and user group features, ensure that the ZStack ZSphere is installed with a valid Advanced Edition license.

Single Sign-On

ZStack ZSphere provides unified identity authentication login services, supporting seamless access to the unified authentication login system. Corresponding unified authentication users can log in directly to the virtualization platform and conveniently use platform resources. Currently, OIDC, AD, and LDAP authentication servers are supported.

OIDC Authentication: OIDC (OpenID Connect) is an authentication protocol built on the OAuth2 framework, allowing clients to verify user identities and obtain basic user configuration information. Through the OIDC authentication server, user information can be synchronized to the virtualization platform according to mapping rules, and OIDC authentication system users can log in to the virtualization platform without a password.
AD Authentication: AD (Active Directory) is a directory service for Windows Standard Server, Windows Enterprise Server, and Windows Datacenter Server, providing a standalone and standardized login authentication system for increasingly diverse enterprise office applications. Through the AD authentication server, AD users can be synchronized to the virtualization platform, supporting direct login to the virtualization platform using specified AD login attributes.
LDAP Authentication: LDAP (Lightweight Directory Access Protocol) is a protocol for accessing directory services, providing a standardized directory service for increasingly diverse enterprise office applications. Through the LDAP authentication server, LDAP users can be synchronized to the virtualization platform, supporting direct login to the virtualization platform using specified LDAP login attributes.

Next Chapter: Security Access Settings

System Management

Identity and Access Management

Overview

Centralized User Management

Precise Role-Based Access Control

Integration with Unified Authentication Systems

Preparation

Single Sign-On

Products

Solutions

Help & Support

Contact Us