Identity mapping for federated user authentication

A system, comprising:

• one or more processors;
• and
• memory including instructions that, when executed by the one or more processors, cause the system to:
• receive, from a first user having privileges sufficient to manage an account via a federated identity generated through an identity broker of a first entity, a request to add a new user to the account, the request specifying an electronic address for a user of the first entity authorized to utilize the new user;
• validate the federated identity;
• as a result of validating the federated identity, generate a link usable by the user of the first entity to access the new user;
• use the electronic address to transmit the link to the user of the first entity;
• in response to obtaining a message at an endpoint associated with the link, prompt the user to provide a new username;
• associate the new user with the account and one or more policies applicable to the account and users of the account based at least in part on obtaining the new username;
• and
• enable the user of the first entity authorized to utilize the new user to utilize the new user to access one or more computing resources associated with the account.

A non-transitory computer-readable storage medium having stored thereon executable instructions that, as a result of being executed by one or more processors of a computer system, cause the computer system to at least:

• verify, based at least in part on a federated identity of a first user of an account, obtained from an identity broker of a datacenter, and in response to a request to generate a new user for the account, that the first user of the account is authorized to generate the new user for the account;
• obtain an electronic address for a user authorized to utilize the new user;
• transmit, using the electronic address for the user, a link to enable the user to access the new user via a second federated identity generated through the identity broker of the datacenter, where the access is provided in response to obtaining a username from the user;
• and
• associate the new user with the account and one or more policies applicable to the account and users of the account.