Skip to main content
Open Connectors → Connect → Huawei Cloud as an Administrator. Use the issuer, audience and subject shown by that team’s wizard; self-hosted deployments need their own configured OIDC issuer. Do not substitute values from another team.

​
Identity provider and agency

  1. In Huawei IAM, create an OIDC identity provider using the wizard’s values.
  2. Create a trust agency of type Identity Provider / OIDC and select that provider. Use the audience shown in Nuphos.
  3. Grant only the permissions needed for the work. The agency must support the account-scoped credential Nuphos requests (All resources scope); a project-only agency cannot supply it. Read-only permissions are enough for browsing.
  4. Set the team-pinned identity conditions shown by the wizard, including subject and issuer. Keep them when narrowing the agency’s permissions.

​
Save and verify

Enter a label, the Account ID (32 hex characters from My Credentials), the identity provider name, and trust agency name. The provider name is not Huawei’s separate hexadecimal provider ID. No long-lived access key is required for this federation flow. After connecting, verify a bounded account/region read before broader work. CCE clusters and ECS instances have resource pages; the authorized agent API access can cover other resources within the agency’s policy. In-cluster RBAC remains a separate requirement. If federation fails, check backend OIDC configuration, audience, team subject, agency name and account scope. Remove the connection in Nuphos and revoke the unneeded cloud trust/agency when ending access.