Ncloud Single Sign-On overview
    • PDF

    Ncloud Single Sign-On overview

    • PDF

    Article summary

    The latest service changes have not yet been reflected in this content. We will update the content as soon as possible. Please refer to the Korean version for information on the latest updates.

    Available in Classic and VPC

    Ncloud Single Sign-On is a NAVER Cloud Platform service that builds a system that allows you to access various applications with a single account. The Ncloud Single Sign-On service provides APIs for application, tenant, external IdP, SSO user, group, permission set, assignment, and IP ACL features in a RESTful form.

    Common Ncloud Single Sign-On settings

    The following describes commonly used request and response formats in Ncloud Single Sign-On APIs.

    Request

    The following describes the common request format.

    API URL

    The request API URL is as follows.

    https://sso.apigw.ntruss.com
    

    Request headers

    The following describes the request headers.

    FieldRequiredDescription
    x-ncp-apigw-timestampRequiredThis is the number of milliseconds that have elapsed since January 1, 1970 00:00:00 UTC
    • Request is considered invalid if the timestamp differs from the current time by more than 5 minutes
    x-ncp-iam-access-keyRequiredAccess key issued on NAVER Cloud Platform
    x-ncp-apigw-signature-v2RequiredBase64-encoded signature that encrypts the request information with a secret key that maps to the access key issued on NAVER Cloud Platform, using the HMAC encryption algorithm (HmacSHA256)
    Content-typeOptionalRequest data format
    • application/json
    • application/xml
    AcceptOptionalResponse data format
    • application/json

    Response

    The following describes the common response format.

    Response data type

    The following describes the common response date types.

    ProcessResult

    ProcessResult defines the API processing result. The following describes ProcessResult.

    FieldTypeRequiredDescription
    successBooleanRequiredAPI processing result
    • true | false
      • true: succeeded
      • false: failed
    idStringOptionalCreation/modification result ID
    • Use in creation, multiple addition/deletion APIs
    messageStringOptionalAPI processing result message

    The following is a sample syntax and response of ProcessResult.

    • Syntax
      ProcessResult {
          Boolean success;
          String id;
          String message;
      }
      
    • Examples
      {
          "id": "",
          "success": true
      }
      

    ErrorResponse

    ErrorResponse defines the details of a failure when an API call fails. The following describes ErrorResponse.

    FieldTypeRequiredDescription
    errorCodeIntegerRequiredRequired
    messageStringRequiredString

    The following is a sample syntax and response of ErrorResponse.

    • Syntax
      ErrorResponse {
        int errorCode;
        String message;
      }
      
    • Examples
      {
          "errorCode": 9060,
          "message": "The group name already exists."
      }
      

    Response status codes

    The following describes the response status codes.

    HTTP status codeCodeMessageDescription
    400400The user is not a member of this group.Input of a user not belonging to the group
    400400The permission set doesn't exist.No permission set exists
    400400The application name already exists.Input of an existing application name
    400400Tenant already existsTenant already exists
    400400The login ID is already in use.Login ID already in use entered
    400500The policy doesn't exist.Non-existent policy name entered
    4009016The application does not exist.Non-existent application ID entered
    4009020There is a registered identity provider.External IdP already exists
    4009021This identify provider doesn't exist.Non-existent external IdP
    4009023The identity provider can't be deleted while the organization is integrated.Unable to delete identity provider while organization is integrated
    4009024Invalid metadata format.Metadata format error
    4009025There is no certificate information for signing in the metadata.No certificate information for signing metadata
    4009026There are two or more certificates for signing in the metadata.Two or more certificates for signing exist in the metadata
    4009027There is no SingleSignOnService binding in the metadata.No protocol binding information in metadata
    4009028There is no SingleSignOnService location in the metadata.No SAML login URL information mapped to the binding protocol in metadata
    4009029There is no entityId in the metadata.No entityID information in metadata
    4009030There is no IdPSSODescriptor in the metadata.No IDPSSODescriptor information in metadata
    4009031There is no SingleSignOnService in the metadata.No SingleSignOnService in metadata
    4009032There is no SingleSignOnService POST binding or Redirect binding in the metadata.No HTTP-POST or HTTP-Redirect information in metadata
    4009033The idpSigninUrl value is not in URL format.idpSigninUrl value format error
    4009034There is no KeyInfo in the metadata.No KeyInfo information in metadata
    4009035This is not the master account of the organization.Organization integration requested with non-master account
    4009036The organization doesn't exist.Organization doesn't exist in master account
    4009046Invalid certificate format.Errors in certificate format for metadata signing
    4009050This user doesn't exist.Non-existent SSO user ID entered
    4009060The group name already exists.Group name already in use entered
    4009061This group doesn't exist.Non-existent group ID entered
    4009070The permission set name already exists.Permission set name already in use entered
    4009071At least one policy must be selected.Policy ID not entered
    4009072This system managed policy doesn't exist.Non-existent System Managed policy ID entered
    4009073The permission set doesn't exist.Non-existent permission set ID entered
    4009080Assignment does not exist.Non-existent assignment ID entered
    4009081The assignment target doesn't match.Non-matching assignment target entered
    4009083The assignment target doesn't exist.Non-existent assignment target entered
    4009084An assignment created with the specified account and permission set already exists.Assignment created with the same information already exists
    4009085The assigned account is invalid.Non-existent account number entered
    4009086A target already exists in the assignment.Target information already added entered
    4009087The Assignment name already exists.Assignment name already in use entered
    4009100The IP ACL does not exist.Non-existent IP ACL ID entered
    4009101IP ACL destination cannot be empty.Assignment ID missing
    4009102A target already exists in the assignment.Assignment ID already added entered
    4009103Assignment - remaining IP ACL mapping exists.Unable to delete because assignment is added to IP ACL
    4009104IP ACL destination does not match.Non-existent assignment - IP ACL mapping information entered
    4009105Assignment - IP ACL mapping does not exist.Assignment - IP ACL mapping information that already exists entered
    4009106Invalid access restriction setting for Assignment.Assignment access control status is false
    4009110An MFA device already exists.MFA device already exists for SSO user
    4009111Invalid OTP.Invalid OTP information entered
    4009112The MFA device does not exist.MFA device doesn't exist for SSO user
    4009113Two-factor authentication not applied.Two-factor authentication not applied
    Note

    For response status codes common to NAVER Cloud Platform, see Ncloud API response status codes.

    Ncloud Single Sign-On API

    The following describes the APIs provided by the Ncloud Single Sign-On service.

    Application

    The following describes the application-related APIs.

    APIDescription
    Get application listGet application list
    Get applicationGet details of a single application
    Create applicationCreate application
    Edit applicationEdit application information
    Delete applicationDelete application
    Reissue OAuth 2.0 client secretReissue OAuth 2.0 client secret

    Tenant

    The following describes the tenant-related APIs.

    APIDescription
    Get tenantGet tenant
    Create tenantCreate tenant
    Edit tenantEdit tenant information
    Delete tenantDelete tenant

    External IdP

    The following describes the external IdP-related APIs.

    APIDescription
    Get external IdPGet external IdP
    Create external IdPCreate external IdP
    Edit external IdPEdit external IdP information
    Delete External IdPDelete External IdP
    Get attribute mapperGet attribute mapper
    Edit attribute mapperEdit attribute mapper
    Parse external IdP metadataParse external IdP metadata
    Get Ncloud Single Sign-On metadataGet Ncloud Single Sign-On metadata
    Get Ncloud Single Sign-On URL dataGet Ncloud Single Sign-On URL data
    Set external IDP loginSet external IDP login information
    Set Organization integrationIntegrate Organization

    SSO User

    The following describes the SSO user-related APIs.

    APIDescription
    Get SSO user listGet SSO user list
    Get SSO userGet details of a single SSO user
    Create SSO userCreate a single SSO user
    Bulk create SSO usersBulk create SSO users of one or more
    Edit SSO userEdit SSO user information
    Bulk delete SSO usersBulk delete SSO users of one or more
    Delete SSO userDelete SSO user
    Check SSO user login IDCheck validity and duplication of SSO user login ID
    Get SSO user access ruleGet SSO user access rule
    Edit SSO user access ruleEdit SSO user access rule
    Get SSO user profileGet SSO user profile
    Get SSO user group listGet group list
    Get SSO user groupGet single group details
    Add SSO user groupAdd SSO user to group
    Delete SSO user groupDelete SSO user from group
    Set SSO user statusEnable or disable SSO user
    Get SSO user sessionGet SSO user session
    Expire SSO user sessionExpire SSO user session
    Get SSO user assignment listGet the list of assignments the SSO user belongs to
    Delete SSO user assignmentDelete SSO user from assignment
    Get SSO user MFA device listGet MFA device owned by SSO user
    Add SSO user MFA deviceAdd MFA device to SSO user
    Delete SSO user MFA deviceDelete MFA device owned by SSO user

    Group

    The following describes the group-related APIs.

    APIDescription
    Get group listGet group list
    Get groupGet single group details
    Create groupCreate group
    Edit groupEdit group information
    Delete group listBulk delete groups of one or more
    Delete groupDelete group
    Check group nameCheck validity and duplication of group name
    Get SSO user list of groupGet the list of SSO users in the group
    Add SSO user to groupAdd group to SSO user
    Delete SSO user of groupDelete SSO user from group
    Get group assignment listGet the list of assignments the group belongs to
    Delete group assignmentDelete group from assignment

    Permission Set

    The following describes the permission set-related APIs.

    APIDescription
    Get permission set listGet permission set list
    Get permission setGet details of a single permission set
    Create permission setCreate permission set
    Edit permission setEdit permission set information
    Delete permission set listBulk delete permission sets of one or more
    Delete permission setDelete permission set
    Check permission set nameCheck validity and duplication of permission set name
    Delete permission set policyDelete policy assigned to permission set
    Get system managed policy listGet the list of System Managed policies that can be assigned to permission set
    Check existence of user created policyCheck for the existence of User Created policy in permission set

    Assignment

    The following describes the assignment-related APIs.

    APIDescription
    Get assignment listGet assignment list
    Get assignmentGet details of a single assignment
    Create assignmentCreate assignment
    Edit assignmentEdit assignment information
    Delete assignmentDelete assignment
    Set assignment statusEnable or disable assignment
    Get assignment target listGet the list of targets (SSO users, groups) added to assignment
    Add assignment targetAdd target (SSO user, group) to assignment
    Delete assignment targetDelete target (SSO user, group) from assignment
    Get IP ACL assignment listGet the list of IP ACLs added to assignment
    Add IP ACL to assignmentAdd IP ACL to assignment
    Delete IP ACL from assignmentDelete IP ACL added to assignment
    Get assignment account listGet the list of accounts added to organization
    Check existence of user created policyCheck for the existence of User Created policy in target account

    IP ACL

    The following describes the IP ACL-related APIs.

    APIDescription
    Get IP ACL listGet IP ACL list
    Get IP ACLGet details of a single IP ACL
    Create IP ACLCreate IP ACL
    Edit IP ACLEdit IP ACL information
    Delete IP ACL listBulk delete IP ACLs of one or more
    Delete IP ACLDelete IP ACL
    Check IP ACL nameCheck validity and duplication of IP ACL name
    Get IP ACL assignment listGet the list of assignments added to IP ACL
    Add assignment to IP ACLAdd assignment to IP ACL
    Delete assignment of IP ACLDelete assignment from IP ACL

    NAVER Cloud Platform provides a variety of related resources to help users better understand Ncloud Single Sign-On APIs.


    Was this article helpful?

    Changing your password will log you out immediately. Use the new password to log back in.
    First name must have atleast 2 characters. Numbers and special characters are not allowed.
    Last name must have atleast 1 characters. Numbers and special characters are not allowed.
    Enter a valid email
    Enter a valid password
    Your profile has been successfully updated.