Setting up a domain in an identity federation
A domain allows you to authenticate through Login Discovery. When authenticating, a user with your domain will be redirected to your identity federation.
Associating a domain
- Log in to Yandex Identity Hub using an administrator or organization owner account.
- In the left-hand panel, click Federations and select a target federation.
- Navigate to the Domains tab.
- In the top-right corner, click Add domain.
- Enter the domain name.
- Click Add.
To use the domain to add new users, have it verified.
If you do not have the Yandex Cloud CLI yet, install and initialize it.
The folder used by default is the one specified when creating the CLI profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also specify a different folder for any command using --folder-name or --folder-id.
If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.
-
See the description of the CLI command to associate a domain with a federation:
yc organization-manager federation saml add-domain --help -
Run this command:
yc organization-manager federation saml add-domain <federation_name_or_ID> \ --domain <domain>Where
--domainis your domain.Result:
done (1s) domain: example. com status: NEED_TO_VALIDATE status_code: organization/domain-diagnostics#need-to-validate created_at: "2025-10-09T06:40:18.704791371Z" validated_at: "1970-01-01T00:00:00Z" challenges: - created_at: "2025-10-09T06:40:18.704791371Z" updated_at: "2025-10-09T06:40:18.704791371Z" type: DNS_TXT status: PENDING dns_challenge: name: _yandexcloud-challenge. example. com type: TXT value: TlHc5HKJDeQIgPqaoiiSXxgy3CWFD+MLMJJP********Save the
valueas you will need it to validate the domain.
Use the Federation.AddDomain REST API method for the Federation resource or the FederationService/AddDomain gRPC API call.
Getting a list of domains
- Log in to Yandex Identity Hub using an administrator or organization owner account.
- In the left-hand panel, click Federations.
- Select the federation you need from the list.
- Navigate to the Domains tab. You will see a list of all available domains.
If you do not have the Yandex Cloud CLI yet, install and initialize it.
The folder used by default is the one specified when creating the CLI profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also specify a different folder for any command using --folder-name or --folder-id.
If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.
-
See the description of the CLI command for getting a list of domains in a federation:
yc organization-manager federation saml list-domains --help -
Run this command:
yc organization-manager federation saml list-domains <federation_name_or_ID>
Use the Federation.ListDomains REST API method for the Federation resource or the FederationService/ListDomains gRPC API call.
Viewing information about a domain
- Log in to Yandex Identity Hub using an administrator or organization owner account.
- In the left-hand panel, click Federations.
- Select a federation from the federation list.
- Navigate to the Domains tab.
- Click the domain name.
If you do not have the Yandex Cloud CLI yet, install and initialize it.
The folder used by default is the one specified when creating the CLI profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also specify a different folder for any command using --folder-name or --folder-id.
If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.
-
See the description of the CLI command for viewing information about a domain in a federation:
yc organization-manager federation saml get-domain --help -
Run this command:
yc organization-manager federation saml get-domain <federation_name_or_ID> \ --domain <domain>Where
--domainis your domain.
Use the Federation.GetDomain REST API method for the Federation resource or the FederationService/GetDomain gRPC API call.
Deleting a domain
You cannot delete the default domain or a domain with associated users.
- Log in to Yandex Identity Hub using an administrator or organization owner account.
- In the left-hand panel, click Federations and select the target federation.
- Navigate to the Domains tab.
- In the domain section, click and select Delete.
If you do not have the Yandex Cloud CLI yet, install and initialize it.
The folder used by default is the one specified when creating the CLI profile. To change the default folder, use the yc config set folder-id <folder_ID> command. You can also specify a different folder for any command using --folder-name or --folder-id.
If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions.
-
See the description of the CLI command for deleting a domain from a federation:
yc organization-manager federation saml delete-domain --help -
Run this command:
yc organization-manager federation saml delete-domain <federation_name_or_ID> \ --domain <domain>Where
--domainis your domain.For example, delete
my-domain.rufrommy-federation:yc organization-manager federation saml delete-domain my-federation \ --domain my-domain.ru
Use the Federation.DeleteDomain REST API method for the Federation resource or the FederationService/DeleteDomain gRPC API call.