Contact UsTry it for free
© 2026 Direct Cursus Technology L.L.C.

Creating a SAML app in Yandex Identity Hub for integration with VK Cloud

Written by
Updated at April 17, 2026

VK Cloud is a Russian cloud platform offering IaaS and PaaS services, data and AI/ML tools, as well as solutions you need to build a cloud infrastructure. VK Cloud supports SAML-based user authentication via an identity federation.

For your organization's users to be able to authenticate in VK Cloud via SAML SSO, create a SAML app in Yandex Identity Hub and configure it both on the Yandex Cloud and VK Cloud side.

SAML apps can be managed by users with the organization-manager.samlApplications.admin role or higher.

To give your organization's users access to VK Cloud:

  1. Create an app.
  2. Set up the integration.
  3. Add users and configure permissions.
  4. Make sure the application works correctly.

Create an app

  1. Log in to Yandex Identity Hub.
  2. In the left-hand panel, select  Apps.
  3. In the top-right corner, click Create application and in the window that opens:

    1. Select the SAML (Security Assertion Markup Language) single sign-on method.

    2. In the Name field, specify a name for your new app: vkcloud-saml.

    3. Optionally, in the Description field, enter a description for the new app.

    4. Optionally, add labels:

      1. Click Add label.
      2. Enter a label in key: value format.
      3. Press Enter.

    5. Click Create application.

Set up the integration

To integrate VK Cloud with the SAML app you created in Yandex Identity Hub, complete the setup both on the VK Cloud and Yandex Identity Hub side.

Configuring an identity federation on the VK Cloud side

Note

Only a project owner can create an identity federation in VK Cloud.

  1. Get the metadata for the new app:

    1. Log in to Yandex Identity Hub.
    2. In the left-hand panel, select Apps and then, the SAML app.
    3. On the Overview tab, under Identity provider (IdP) configuration, click Download metadata file.

    The downloaded XML file contains the required metadata and a certificate used for SAML response signature verification.

  2. Create an identity federation in VK Cloud using Yandex Identity Hub metadata:

    1. Go to your VK Cloud account.
    2. Open the Identity federation section and navigate to the Federations tab.
    3. Click Create.
    4. Click Upload IdP metadata and upload the XML metadata file you downloaded from Yandex Identity Hub.
    5. Click Upload.

  3. In the new federation's info, copy and save the federation ID. You will need it to set up a SAML application in Yandex Identity Hub and to manage federated user sign-ins.

Set up the SAML application in Yandex Identity Hub

Set up service provider endpoints

  1. Log in to Yandex Identity Hub.
  2. In the left-hand panel, select Apps and then, the SAML app.
  3. At the top right, click Edit and in the window that opens:
    1. In the **SP EntityID ** field, specify the address https://msk.cloud.vk.com/federation-service/v1/federation/saml/<federation_ID>/metadata, where <federation_ID> is the federation ID you copied when creating the federation in VK Cloud.
    2. In the ACS URL field, enter this address: https://msk.cloud.vk.com/federation-service/v1/federation/saml/<federation_ID>/acs.
    3. Click Save.

Configure user attributes

Warning

For the federation to function correctly in VK Cloud, SAML attribute names must have URI prefixes: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/ for user attributes; http://schemas.xmlsoap.org/claims/ for group attribute.
Without these prefixes (and if there are case variations, e.g., Group), attribute mapping in VK Cloud may fail.

Set user attributes for integration with VK Cloud:

  1. Log in to Yandex Identity Hub.

  2. In the left-hand panel, select Apps and select the desired app.

  3. Navigate to the Attributes tab.

  4. Make sure the attributes are configured as follows:

    Attribute Value
    http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress SubjectClaims.email
    http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name SubjectClaims.firstName
    http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname SubjectClaims.lastName

  5. If you plan to use group mapping, add an attribute for group transfer:

    1. Click Attribute name.
    2. In the Attribute name field, specify http://schemas.xmlsoap.org/claims/Group.
    3. In the Value field, specify SubjectClaims.groups.
    4. Click Save.

Add users and configure permissions

For the users of your organization to be able to authenticate in VK Cloud via a SAML application in Yandex Identity Hub, add them to the application and configure access permissions in VK Cloud.

Note

Users and groups added to a SAML application can be managed by a user with the organization-manager.samlApplications.userAdmin role or higher.

Add users to the Yandex Identity Hub SAML application

  1. Log in to Yandex Identity Hub.
  2. In the left-hand panel, select Apps and select the required app.
  3. Navigate to the Users and groups tab.
  4. Click Add users.
  5. In the window that opens, select the users.
  6. Click Add.

Configure group and role mapping in VK Cloud

To define federated users' access permissions in VK Cloud, configure mappings between IdP groups and VK Cloud roles.

  1. Go to your VK Cloud account.
  2. Open the Identity federation section and navigate to the Groups tab.
  3. Select the project you want to configure the federation for.
  4. Click Add (or Add group if groups already exist).
  5. Specify the IdP group name in lowercase and select the scope of permissions (Domain or Project), then proceed to assign roles.
  6. Click Add.

Make sure your application works correctly

To make sure your SAML app and its integration with VK Cloud work correctly, sign in to VK Cloud as one of the users you added to the app.

Proceed as follows:

  1. In your browser, open the federated user sign-in URL: https://cloud.vk.com/v1/federation/saml/<federation_ID>/signin, where <federation_ID> is the federation ID you copied when creating the federation in VK Cloud.
  2. Authenticate in Yandex Cloud under a user account from your organization.
  3. Make sure you have signed in to VK Cloud following authentication.
Previous
OpenID Connect
Next
Sentry