Volcano Engine supports two single sign-on methods, user SSO and role SSO, among which:

• User SSO: After completing the mutual trust configuration between IdP and SP, when the enterprise IdP user logs in, Volcano Engine establishes the correspondence between the IdP user and Volcano Engine IAM user through the SAML assertion sent by the IdP, and the enterprise IdP user can access the Volcano Engine resources through the corresponding IAM user. The scope of access permissions is within the scope of the IAM user permissions.

• Role SSO: refers to the establishment of a trust identity for the role of the corresponding IdP and the completion of the mutual trust configuration between the IdP and the SP. When the enterprise IdP user logs in, the user accesses the Volcano Engine resources by playing the available IAM role specified in the SAML assertion sent by the IdP. The scope of access permissions is within the scope of the IAM role permissions.