Learn about the different types of identities that can be managed from your OVHcloud account.
Requirements
Instructions
Understanding identities
Several types of identities can interact with OVHcloud products:
OVHcloud account
This is the primary identity used to log in to the OVHcloud Control Panel. The OVHcloud account can also be referred to as a NIC or NIC-handle in the documentation.
This identity acts as a root account and cannot have its rights restricted, regardless of the access policies implemented.
Local users
Local users are identities associated with your OVHcloud account. These accounts are designed for human interaction with OVHcloud products, as they are based on login/password authentication, and access rights depend on the IAM policies implemented.
The configuration of local users is detailed in the dedicated documentation.
You can also use them to log in to the OVHcloud APIs by generating a token associated with the user. The rights of this token can be limited to a specific scope in addition to IAM policies.
For an application based on a token linked to a local user to use an OVHcloud API, the token must integrate it within its scope AND for the user who created the token to have rights on this API.
Local users can also be referred to as sub-users in the documentation.
We recommend using local users as soon as more than one person connects to your OVHcloud account in order to assure traceability of actions.
Service accounts
Service accounts are identities associated with your OVHcloud account. These accounts are designed for machine interactions with OVHcloud products, as they are based on client/token authentication, and access rights depend on the IAM policies implemented.
The creation of service accounts is covered in dedicated documentation.
A service account can then be used for login on OVHcloud APIs as well as on third-party APIs such as those exposed by OpenStack.
Federated users
These are user accounts from an identity federation. These users come from a third-party directory and are therefore not managed directly by OVHcloud. Their access rights depend on the IAM policies implemented.
Federated users are represented by user groups in rights management.
We recommend using identity federation as soon as the number of people connecting to your OVHcloud account becomes large enough, or if you want to centralize your access to a third-oarty directory used for other services than OVHcloud.
User groups
The different identities can be associated in user groups to make them easier to manipulate. Configuring user groups is covered in the local users management documentation.
Users of OVHcloud products
Some products offered by OVHcloud can also propose their own users, such as OpenStack, VMware vSphere, or Object Storage. Those users are independent from the OVHcloud account and are managed directly through the products concerned.
For products that allow usage of an OVHcloud identity (local user, service account, federated user) or specific user, we recommend using specific users in order to maintain reversibility and limit the dependency on OVHcloud. If you want to have centralized management across all of your products, we suggest using OVHcloud identities.
Go further
For more information and tutorials, please see our other Manage & Operate support guides or explore the guides for other OVHcloud products and services.