1. Scenario overview
A large customer wants staff to sign in to the IoT SIM platform with an identity the company already has, not a second password, and wants that identity to follow the org chart in roles and audit. OAuth and SSO on the SimtoLink IoT Cloud Platform speak OpenID Connect (OIDC), SAML 2.0, and the OAuth apps people already use: WeCom, DingTalk, and Feishu. The first sign-in links the IdP account or opens a platform account. After that, one click is enough.
You can require SSO and turn off the local password, set a session length, and sign out together so an IdP logout ends the platform session. With multi-tenant management, each tenant can point at its own IdP.
2. Core capabilities
IdP setup
Enter metadata, certificates, Client ID and Secret, and the callback URL. Callbacks can differ by environment. OIDC discovery pulls the configuration for you.
Attributes and roles
Map the IdP’s group and department onto a platform role and a data scope. A regular expression or a script can extend that, inside a secure sandbox.
Mobile and QR
An H5 page inside WeCom or DingTalk signs the user in without a second password. The web app can use a QR code. The self-service platform can share that IdP or use its own.
Hardening
Add MFA on top. Alert on an unusual sign-in. Quotas and rate limits slow a brute-force attempt.
3. Typical use cases
- One identity for a group: The group connects the SimtoLink IoT Cloud Platform to corporate LDAP or Azure AD. Operations signs in with the badge account. When someone leaves, IT disables that one identity and access to the platform stops.
- Operations inside WeCom: A mobile team opens the CMP in a WeCom H5 page, scans to sign in, and sees SIM status alerts and data alerts without switching accounts.
- A separate sign-in for each tenant: An MVNO offers a white-label CMP to several companies. Each tenant has its own OIDC IdP, so staff see only that company’s IoT SIM data.
4. Implementation notes
Before you integrate, check clock sync. SAML is sensitive to time. Test that a disabled account and a leaver take effect on the IdP at once. Write down the fallback: if the IdP is down, a local admin account can be turned on for a while.
5. What you gain
OAuth and SSO on the SimtoLink IoT Cloud Platform cut the cost of managing accounts, raise the security baseline, and sit inside the company’s IT. People stop keeping a second password. When someone leaves, one disablement in the identity source closes access, which lowers the chance of a leak left behind by a person. JIT provisioning means a new hire can use the platform the day they start. MFA on top meets the authentication bar of Classified Protection Level 3 and a zero-trust framework.