Configure password-free logon with OAuth-阿里云帮助中心

Configure an OAuth callback address for your OAuth application to allow users to log on to your service without a password using their Alibaba Cloud account. This topic describes the configuration process.

The configuration process includes the following steps:

Step 1: Create a RAM application
Step 2: Modify the SaaS server-side configuration

Step 1: Create a RAM application

Before you configure password-free logon with OAuth, create an application in the Resource Access Management (RAM) console. This application is used to retrieve user information and access Alibaba Cloud APIs.

Log on to the RAM console.
In the navigation pane on the left, choose Integration Management > OAuth Application (Public Preview).
On the Enterprise Applications tab, click Create Application.

In the Create Application dialog box, configure the parameters for the application.

Parameter	Description
Application Name	The application name must be 1 to 64 characters in length. It can contain letters, digits, periods (.), underscores (_), and hyphens (-).
Display Name	The display name can be up to 24 characters in length.
Application Type	The available types are: WebApp: A web application that interacts through a browser. NativeApp: A native application that runs on a desktop or mobile operating system. ServerApp: An application that directly accesses Alibaba Cloud services without requiring user logon. Currently, only applications that use the System for Cross-domain Identity Management (SCIM) protocol for user synchronization are supported.
Access Token Validity Period	The validity period can be set from 15 minutes to 3 hours.
Refresh Token Validity Period	The validity period can be set from 2 hours to 1 year.
Callback Address	Enter the planned callback address. Note For security, enter an address that starts with `https://`.

After the application is created, go to the Enterprise Applications tab and click the name of the application.
On the basic information page, add OAuth scopes to the application.

Adding OAuth scopes specifies the permissions that the service provider needs to obtain from the user.
1. On the Application OAuth Scopes tab, click Add OAuth Scope.
2. In the Add OAuth Scope panel, select the required OAuth scopes.
3. Click OK.
On the basic information page, add an application key.

The server side of your Software as a Service (SaaS) application uses this key as a configuration parameter for authentication calls when connecting to the application management service.
1. On the Application Keys tab, click Create Key.
2. In the Create Application Key dialog box, view, copy, or download the application key.
3. Click Close.
Note
Each application can have a maximum of two application keys.

Step 2: Modify the SaaS server-side configuration

After you create the application, import the OAuth software development kit (SDK) into your SaaS project. Then, add the OAuth configuration data to the configuration file of your SaaS service to connect the OAuth application to your SaaS server.

Import the OAuth SDK into your SaaS project. Add a callback block and a user authorization request to the SDK.

For more information about how to integrate OAuth with your SaaS service, see Common OAuth SDK examples.

Modify the configuration file of your SaaS project. Add the required configuration items for the OAuth application, such as AK, accessTokenUri, and userAuthorizationUri.

Example modification

This example shows how to modify the `application.yml` file after you import the OAuth SDK. Replace the placeholder values in the OAuth configuration section with the values from the application that you created.

aliyun:
    client:
      clientId: 4086517946102XXXXXX 
      #(OAuth Application ID)
      clientSecret: 4ljFyOsIOp2****
      #(OAuth Application Secret)
      accessTokenUri: https://oauth.aliyun.com/v1/token
      userAuthorizationUri: https://signin.aliyun.com/oauth2/v1/auth
      tokenName: access_token
      authenticationScheme: query
      clientAuthenticationScheme: form
    resource:
      userInfoUri: https://oauth.aliyun.com/v1/userinfo


logging:
  level:
    org.springframework.security: DEBUG

What to do next

After you create and connect the application, go to the Compute Nest console to deploy the service that includes the password-free logon feature.