[Yandex Cloud documentation](../../../../index.md) > [Tutorials](../../../index.md) > [Security](../../index.md) > Setting up single sign-on (SSO) for apps > Cloud.ru > OpenID Connect # Creating an OIDC application in Yandex Identity Hub for integration with Cloud.ru [Cloud.ru](https://cloud.ru/) is a Russian provider of cloud services, spanning IaaS, PaaS, AI/ML tools, and solutions for public, private, and hybrid cloud deployments, including support for infrastructure migration and operation. Cloud.ru supports [OpenID Connect](https://en.wikipedia.org/wiki/OpenID#OpenID_Connect_(OIDC)) (OIDC) authentication to provide secure SSO for your organization's users. For your [organization's](../../../../organization/concepts/organization.md) users to be able to authenticate in Cloud.ru via OpenID Connect SSO, create an [OIDC app](../../../../organization/concepts/applications.md#oidc) in Yandex Identity Hub and configure it both in Yandex Identity Hub and Cloud.ru. OIDC apps can be managed by users with the `organization-manager.oauthApplications.admin` [role](../../../../organization/security/index.md#organization-manager-oauthApplications-admin) or higher. To give access to Cloud.ru to the users of your organization: 1. [Create an app](#create-app). 1. [Set up the integration](#setup-integration). 1. [Make sure the application works correctly](#validate). ## Create an app {#create-app} {% list tabs group=instructions %} - Cloud Center UI {#cloud-center} 1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization). 1. In the left-hand panel, select ![shapes-4](../../../../_assets/console-icons/shapes-4.svg) **Apps**. 1. In the top-right corner, click ![Circles3Plus](../../../../_assets/console-icons/circles-3-plus.svg) **Create application** and in the window that opens: 1. Select the **OIDC (OpenID Connect)** single sign-on method. 1. In the **Name** field, specify a name for your new app: `cloud-ru-oidc-app`. 1. In the **Folder** field, select the folder where you want to create an OAuth client for your app. 1. Optionally, in the **Description** field, enter a description for the new app. 1. Optionally, add [labels](../../../../resource-manager/concepts/labels.md): 1. Click **Add label**. 1. Add a label in `key: value` format. 1. Press **Enter**. 1. Click **Create application**. - CLI {#cli} If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../../cli/quickstart.md#install). The folder used by default is the one specified when [creating](../../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id ` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions. 1. See the description of the CLI command for creating an OIDC app: ```bash yc organization-manager idp application oauth application create --help ``` 1. Create an OAuth client: ```bash yc iam oauth-client create \ --name cloud-ru-oauth-client \ --scopes openid,email,profile ``` Where: * `--name`: OAuth client name. * `--scopes`: User attributes available to Cloud.ru. The specified attributes are: * `openid`: User ID. Required attribute. * `email`: User email address. * `profile`: Additional user details, such as first name, last name, and avatar. Result: ```text id: ajeqqip130i1******** name: cloud-ru-oauth-client folder_id: b1g500m2195v******** status: ACTIVE ``` Save the `id` field value for when you need to create and configure your app. 1. Create a secret for your OAuth client: ```bash yc iam oauth-client-secret create \ --oauth-client-id ``` Result: ```text oauth_client_secret: id: ajeq9jfrmc5t******** oauth_client_id: ajeqqip130i1******** masked_secret: yccs__939233b8ac**** created_at: "2025-10-21T10:14:17.861652377Z" secret_value: yccs__939233b8ac******** ``` Save the `secret_value` field value: you will need it to configure Cloud.ru. 1. Create an OIDC app: ```bash yc organization-manager idp application oauth application create \ --organization-id \ --name cloud-ru-oidc-app \ --description "OIDC application for integration with Cloud.ru" \ --client-id \ --authorized-scopes openid,email,profile \ --group-distribution-type none ``` Where: * `--organization-id`: [ID of the organization](../../../../organization/operations/organization-get-id.md) you want to create your OIDC app in. This is a required setting. * `--name`: OIDC app name. This is a required setting. * `--description`: OIDC app description. This is an optional setting. * `--client-id`: OAuth client ID you got in Step 2. This is a required setting. * `--authorized-scopes`: Specify the same attributes as when creating the OAuth client. * `--group-distribution-type`: Set to `none` as user groups are not provided to Cloud.ru. Result: ```text id: ek0o663g4rs2******** name: cloud-ru-oidc-app organization_id: bpf2c65rqcl8******** group_claims_settings: group_distribution_type: NONE client_grant: client_id: ajeqqip130i1******** authorized_scopes: - openid - email - profile status: ACTIVE created_at: "2025-10-21T10:51:28.790866Z" updated_at: "2025-10-21T12:37:19.274522Z" ``` {% endlist %} ## Set up the integration {#setup-integration} To configure Cloud.ru integration with the OIDC app you created in Yandex Identity Hub, complete the setup both in Cloud.ru and Yandex Identity Hub. ### Configure your OIDC application in Yandex Identity Hub {#setup-idp} #### Get the application’s credentials {#get-credentials} {% list tabs group=instructions %} - Cloud Center UI {#cloud-center} 1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization). 1. In the left-hand panel, select ![shapes-4](../../../../_assets/console-icons/shapes-4.svg) **Apps** and select the OIDC app. 1. On the **Overview** tab, under **Identity provider (IdP) configuration**, expand the **Additional attributes** section and copy the parameter values you need to specify in Cloud.ru: * `ClientID`: Unique application ID. * `OpenID Configuration`: URL with the configuration of all parameters required to set up the integration. * `Authorization endpoint`: URL to which the service provider will redirect the user for authentication. * `Token endpoint`: URL to which the external application sends a request to obtain an ID token and access token. * `Userinfo endpoint`: URL the external application can use to obtain user attributes. 1. Under **App secrets**, click **Add secret**, and in the window that opens: 1. Optionally, add a description for the new secret. 1. Click **Create**. The window will display the generated [application secret](../../../../organization/concepts/applications.md#oidc-secret). Save this value. {% note warning %} If you refresh or close the application information page, you will not be able to view the secret again. {% endnote %} If you closed or refreshed the page before saving the secret, click **Add secret** to create a new one. To delete a secret, in the list of secrets on the OIDC app page, click ![ellipsis](../../../../_assets/console-icons/ellipsis.svg) in the secret row and select ![trash-bin](../../../../_assets/console-icons/trash-bin.svg) **Delete**. - CLI {#cli} If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../../cli/quickstart.md#install). The folder used by default is the one specified when [creating](../../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id ` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions. 1. Get the new OIDC app info: ```bash yc organization-manager idp application oauth application get ``` Where `` is your OIDC app ID you got when creating the app. This will return the application information, including the following: ```text id: ek0o663g4rs2******** name: cloud-ru-oidc-app organization_id: bpf2c65rqcl8******** client_grant: client_id: ajeqqip130i1******** authorized_scopes: - openid - email - profile ``` Save the `client_id` value: you will need it to configure Cloud.ru. 1. Get the OpenID Connect Discovery configuration URL: ```bash yc organization-manager idp application oauth application get \ --format json | jq -r '.client_grant.issuer_uri' ``` The result will look as follows: ```text https://auth.yandex.cloud/oauth/ ``` Save this URL: this is the OpenID Connect Discovery URL you will need to configure Cloud.ru. 1. Use the OAuth client secret that you saved when creating the app in the previous step. If you have not saved the secret, create a new one: ```bash yc iam oauth-client-secret create \ --oauth-client-id ``` Save the `secret_value` from the command output: this is the client secret you will need to configure Cloud.ru. {% endlist %} ### Set up the OIDC app in Cloud.ru {#setup-sp} 1. Log in to the Cloud.ru [console](https://console.cloud.ru/). 1. Navigate to the **Federations** tab in the **Administration** section. 1. Click **Create federation** and select the **OpenID** protocol type. 1. Enter the federation name and description. 1. Set the session duration. {% note info %} The maximum lifetime of an SSO session is from 30 minutes to 7 days. If there is no activity, the session is automatically terminated and re-authentication is required. {% endnote %} 1. Fill in the fields using the values of OIDC application settings in Yandex Identity Hub: 1. **Auth URL**: **Authorization endpoint** field value. 1. **Userinfo URL**: **Userinfo endpoint** field value. 1. **Token URL**: **Token endpoint** field value. 1. **Logout URL**: `end_session_endpoint` value from `OpenID Configuration`. 1. **Client ID**: **ClientID** field value. 1. **Client Secret**: **App secrets** section value. 1. **JWKS URI**: `jwks_uri` value from `OpenID Configuration`. 1. Click **Create**. 1. In the list of federations, find the new federation and copy its ID. Save this ID as you will need it later. ### Configure the redirect URI in Yandex Identity Hub {#setup-redirect} {% list tabs group=instructions %} - Cloud Center UI {#cloud-center} 1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization). 1. In the left-hand panel, select ![shapes-4](../../../../_assets/console-icons/shapes-4.svg) **Apps** and select the OIDC app. 1. At the top right, click ![pencil](../../../../_assets/console-icons/pencil.svg) **Edit** and in the window that opens: 1. In the **Redirect URI** field, specify the authentication endpoint for your Cloud.ru instance formatted as follows: ```text https://id.cloud.ru/auth/system/idp//callback ``` For example: `https://id.cloud.ru/auth/system/idp/5ca1bc33-7e8a-711a-b29a-a8a121eda1cd/callback`. 1. Click **Save**. - CLI {#cli} If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../../cli/quickstart.md#install). The folder used by default is the one specified when [creating](../../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id ` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions. 1. Update your OAuth client by providing the redirect URI: ```bash yc iam oauth-client update \ --id \ --redirect-uris "https://id.cloud.ru/auth/system/idp//callback" ``` Where: * ``: OAuth client ID you got when you created it. * `--redirect-uris`: Authentication endpoint for your Cloud.ru instance, e.g., `https://id.cloud.ru/auth/system/idp/5ca1bc33-7e8a-711a-b29a-a8a121eda1cd/callback`. Result: ```text id: ajeiu3otac08******** name: cloud-ru-oauth-client redirect_uris: - https://id.cloud.ru/auth/system/idp/5ca1bc33-7e8a-711a-b29a-a8a121eda1cd/callback scopes: - openid - email - profile folder_id: b1gkd6dks6i1******** status: ACTIVE ``` {% endlist %} ### Add users {#add-users} To enable your organization's users to authenticate to Cloud.ru using the Yandex Identity Hub OIDC application, you must explicitly add their accounts both to the application and to the Cloud.ru federation. {% note info %} Users and groups added to an OIDC application can be managed by a user with the `organization-manager.oidcApplications.userAdmin` [role](../../../../organization/security/index.md#organization-manager-oidcApplications-userAdmin) or higher. {% endnote %} #### Add users to the Yandex Identity Hub OIDC application {#add-app-users} {% note tip %} If you want to fine-tune user authentication in your applications, including authentication only from specific IP addresses, use [authentication policies](*authentication_policies). {% endnote %} [*authentication_policies]: Authentication policies are a Yandex Identity Hub tool that allows you to flexibly configure access to applications by denying or allowing authentication for specific users in specific applications and/or from specific IP addresses. For more information, see [Authentication policies in Yandex Identity Hub](../../../../organization/concepts/authentication-policy.md). {% list tabs group=instructions %} - Cloud Center UI {#cloud-center} 1. Log in to [Yandex Identity Hub](https://center.yandex.cloud/organization). 1. In the left-hand panel, select ![shapes-4](../../../../_assets/console-icons/shapes-4.svg) **Apps** and select the required app. 1. Navigate to the **Users and groups** tab. 1. Click ![person-plus](../../../../_assets/console-icons/person-plus.svg) **Add users**. 1. In the window that opens, select the required user. 1. Click **Add**. - CLI {#cli} If you do not have the Yandex Cloud CLI yet, [install and initialize it](../../../../cli/quickstart.md#install). The folder used by default is the one specified when [creating](../../../../cli/operations/profile/profile-create.md) the CLI profile. To change the default folder, use the `yc config set folder-id ` command. You can also specify a different folder for any command using `--folder-name` or `--folder-id`. If you access a resource by its name, the search will be limited to the default folder. If you access a resource by its ID, the search will be global, i.e., through all folders based on access permissions. 1. Get the [user ID](../../../../organization/operations/users-get.md). 1. To add a user to the application: 1. See the description of the CLI command for adding users to an app: ```bash yc organization-manager idp application oauth application add-assignments --help ``` 1. Run this command: ```bash yc organization-manager idp application oauth application add-assignments \ --id \ --subject-id ``` Where: * `--id`: OIDC app ID. * `--subject-id`: User ID. Result: ```text assignment_deltas: - action: ADD assignment: subject_id: ajetvnq2mil8******** ``` {% endlist %} {% note alert %} Make sure the user's `email` attribute is specified and matches their account email address in the Cloud.ru federation. {% endnote %} #### Add users to the Cloud.ru federation {#add-cloudru-users} 1. Log in to the Cloud.ru [console](https://console.cloud.ru/). 1. Open the **Users** section and go to the **Federated users** tab. 1. In the top-right corner, click **Add federation user**. 1. Select the federation you want to add the user to. 1. Specify the user's email address. 1. Grant the user access permissions for projects and platforms. 1. Click **Add**. ## Make sure your application works correctly {#validate} To make sure both your OIDC app and its integration with Cloud.ru work correctly, authenticate to Cloud.ru as one of the users you added to the app. Proceed as follows: 1. In your browser, open the Cloud.ru [console](https://console.cloud.ru/) login page. 1. If you were logged in, log out. 1. On the login screen, click **SSO**. 1. In the dialog that appears, enter the ID of the federation you created and click **Log in**. 1. On the Yandex Cloud authentication page, enter the email address and user password. 1. Make sure you have successfully authenticated to Cloud.ru.