Hong Kong Government Practice Guide for Cloud Computing Security (ISPG-SM04 v2.1) 5.5.2: Build an identity and access management architecture on open standards

What does 5.5.2 require?

A B/D considers an identity and access management architecture that uses open standards such as OpenID to provision accounts, authenticate and authorise in the cloud, with mature standards such as SAML and XACML and their security features (message-level security through XML signing and encryption) used as appropriate; identity federation lets disparate identity repositories interconnect and users sign on once across applications. Cloud services selected should use industry standards such as SAML for secure single sign-on, passing identity and attributes and enforcing authorisation policies.