IBM Cloud

IBM Cloud Configuration

Navigate to Identity Providers

1. Log in to the IBM Cloud console

2. Go to Manage → Access (IAM) → Identity providers

   • Or navigate directly to: https://cloud.ibm.com/iam/identity-providers

3. Click Add

4. Select IBM Cloud SAML

Configure Service Provider Details

1. Name your IBM Cloud service provider configuration

   • Choose a descriptive name (e.g., SplitSecure-Production)
   • This helps identify the configuration if you have multiple IdP connections

2. Review the Advanced settings and adjust if necessary

3. Download the SP metadata for SplitSecure, by clicking Download metadata file to get the XML file

SplitSecure Configuration

Configure SplitSecure with IBM Cloud Details

1. In SplitSecure, navigate to Secure Accounts → Create Account
2. Select IBM Cloud
3. Enter a name for the account (e.g., IBM Cloud Secure Account)
4. Select your Identity Provider
5. Upload the IBM Cloud metadata XML file downloaded in Part 1
6. Provide your login URL which can be found at https://cloud.ibm.com/iam/identity-providers under Login URL next to your IdP
7. Click Create Account

Download SplitSecure IdP Metadata

1. In SplitSecure, navigate to Secure Accounts → SAML2 Identity Providers → [Your IdP] → Details
2. Click Download Metadata

Complete IBM Cloud Configuration

Upload IdP Metadata

Return to IBM Cloud and continue the setup:

1. Upload IdP metadata

1. Click Next

Verify SAML Connection

1. Click Verify
2. You will be redirected to SplitSecure’s authentication page
3. Sign in using your SplitSecure/corporate credentials
4. If successful, a confirmation message appears

Configure Assertion Mapping

Should show “All required claims found and mapped”

1. Click Next

Test the Connection

1. Click Test
2. Sign in with your SplitSecure credentials on the IdP login page
3. Verify the connection is successful
4. Click Next

Complete Setup

1. Click Create to finalize the configuration
2. Note your IdP URL for user access (e.g., https://cloud.ibm.com/authorize/<your-identifier>)

User Access Configuration

Option A: Dynamic User Onboarding (Recommended)

Users are automatically added to your IBM Cloud account on first login.

1. In Identity providers, edit your IdP configuration
2. Enable Dynamic onboarding
3. Configure access using Trusted Profiles or Access Group dynamic rules

Option B: Static User Onboarding

Users must exist in IBM Cloud before they can log in.

1. Go to Manage → Access (IAM) → Users
2. Invite users with email addresses matching their SplitSecure identity

Configure Access Groups with Dynamic Rules (Optional)

To automatically assign permissions based on SAML attributes:

1. Go to Manage → Access (IAM) → Access groups
2. Create or select an access group
3. Click Dynamic rules → Add
4. Configure:
   • Authentication method: Users federated by IBM Cloud SAML
   • Identity provider: Select your SplitSecure IdP
   • Conditions: Define rules based on SAML attributes

Test Authentication

Test Authentication (SP-Initiated)

1. Navigate to your IdP URL (e.g., https://cloud.ibm.com/authorize/<your-identifier>)
2. You should be redirected to SplitSecure for authentication
3. Fill out the form
4. After successful authentication, you should be logged into IBM Cloud

Troubleshooting

External Resources

• IAM Identity Providers IAM identity provider console
• SAML Federation Guide Complete federation tutorial
• Identity Provider Integration Integration documentation