Setting up access to an SAML app in Yandex Identity Hub

If you do not have the Yandex Cloud CLI yet, install and initialize it.

The folder used by default is the one specified when creating the CLI profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also specify a different folder for any command using --folder-name or --folder-id. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.

1. View the description of the CLI command for assigning roles for a SAML application:

   yc organization-manager idp application saml application set-access-bindings --help
   

2. Get a list of SAML apps and their IDs:

   yc organization-manager idp application saml application list --organization-id <organization_ID>
   

   Where --organization-id is the ID of the organization you need the list of SAML apps for.

3. Get the ID of the user, service account, or group to which you are assigning roles for the SAML application.

4. Use the yc organization-manager idp application saml application set-access-bindings command to assign the following roles:

   yc organization-manager idp application saml application set-access-bindings \
     --id <app_ID> \
     --access-binding role=<role>,subject=<subject_type>:<subject_ID>
   

   Where:

   • --id: ID of the SAML application to grant access to.

   • role: ID of the role you need to assign.

   • subject: Subject getting the role.

     Subject designations

     To indicate a subject, use a combination of its type and unique ID, i.e., <subject_type>:<ID>. How you can designate a subject:

     Subject type	Subject designation
     userAccount	userAccount:<user_ID>
     serviceAccount	serviceAccount:<service_account_ID>
     federatedUser	federatedUser:<user_ID>
     group	group:<group_ID>
     system	system:allAuthenticatedUsers (All authenticated users group)
     	system:allUsers (All users group)
     	system:group:organization:<organization_ID>:users (All users in organization X group)
     	system:group:federation:<federation_ID>:users (All users in federation N group)
     	system:group:userpool:<pool_ID>:users (All users in userpool P group)

   Provide a separate --access-binding parameter for each role. Here is an example:

   yc organization-manager idp application saml application set-access-bindings \
     --id <app_ID> \
     --access-binding role=<role1>,service-account-id=<service_account_ID> \
     --access-binding role=<role2>,service-account-id=<service_account_ID> \
     --access-binding role=<role3>,service-account-id=<service_account_ID>
   

Use the Application.SetAccessBindings REST API method for the Application resource or the ApplicationService/SetAccessBindings gRPC API call.

Provide the following in the request:

• Role in the accessBindings[].roleId parameter.

• ID of the subject getting the role for the SAML application in the accessBindings[].subject.id parameter.

• Type of the subject getting the role for the SAML application in the accessBindings[].subject.type parameter.

  Subject designations

  To indicate a subject, use a combination of its type and unique ID in the subject.type and subject.id fields of the request. Possible combinations:

  subject.type	subject.id
  userAccount	<user_ID>
  serviceAccount	<service_account_ID>
  federatedUser	<user_ID>
  group	<group_ID>
  system	allAuthenticatedUsers (All authenticated users group)
  	allUsers (All users group)
  	group:organization:<organization_ID>:users (All users in organization X group)
  	group:federation:<federation_ID>:users (All users in federation N group)
  	group:userpool:<pool_ID>:users (All users in userpool P group)