Introduction to Identity Center

Identity Center provides unified identity and permission management for multiple accounts based on the cloud organization structure. Using the Identity Center feature of Cloud Organization, you can centrally manage cloud platform users of your enterprise, configure Single Sign-On (SSO) between the enterprise identity management system and the cloud platform, and centrally configure user access permissions on multiple accounts.

Features

• Unified management of cloud platform users
  Identity Center offers you a user management module where you can maintain all users who need to access the cloud platform. You can manage users and user groups manually or use the System for Cross-domain Identity Management (SCIM) protocol to synchronize users and user groups from your enterprise identity management system to Identity Center.
• Unified configuration of SSO with your enterprise identity management system
  Identity Center supports enterprise-level SSO based on the Security Assertion Markup Language (SAML) 2.0 protocol. Only a one-time configuration in both Identity Center and the enterprise identity management system is needed to set up SSO.
• Unified configuration of user access permissions on multiple accounts
  By leveraging the structure of your cloud organization, you can centrally configure user or user group permissions to access any member account within the enterprise in Identity Center. These permissions can be modified or deleted at any time.
• Unified login portal
  Identity Center provides a unified login portal where enterprise employees can access all accounts they are authorized to use with a single login. They can then log in to the cloud platform console and easily switch between multiple accounts.

Relationship Between Identity Center and CAM

• Cloud Access Management (CAM) supports identity and permission management of individual cloud platform accounts. It offers user management (including users, user groups, and roles), SSO, and permission configuration, which are only effective on individual cloud platform accounts. When your enterprise has multiple cloud platform accounts, you need to use CAM to manage users of each account separately and to configure SSO and permissions separately, which poses significant management challenges.
• Identity Center provides unified identity and permission management for multiple accounts of an organization. With Identity Center, you can perform unified configuration, achieving user management and SSO for multiple cloud platform accounts. To achieve this, Identity Center offers identity management independent of CAM, but its permission configuration feature reuses the permission policies in CAM. In addition, the access of Identity Center users to accounts is essentially another SSO performed by Identity Center users assuming the CAM role of each account.
• When you start using Identity Center for unified identity and permission management of your cloud organization, you no longer need to use CAM to manage individual accounts. However, in certain cases, you can still use CAM on individual accounts. For example, you have existing CAM users and CAM roles, or you need to use access keys for programmatic access to cloud platform resources. Using Identity Center does not restrict the original features of CAM. Both services can be used simultaneously.