DocsICP FilingConsole
官方文档
首页

Implement unified authentication with a centralized IdP

更新时间：
复制 MD 格式
我的收藏

Using a centralized identity provider (IdP) for unified workforce identity authentication simplifies identity management and ensures consistency across your on-premises and cloud environments. This allows you to manage identities from a single location as your organization changes or as employees join and leave. This approach eliminates the need for separate cloud credentials, such as RAM user credentials. Your employees only need to manage the credentials for their identity in your corporate IdP. For enhanced security, many organizations restrict IdP access to their corporate network, which adds another layer of protection to the authentication process.

Priority

High

What to avoid

  • Not using identity federation and single sign-on. This practice forces employees to create and manage separate cloud accounts and passwords, increasing the risk of credential exposure.

  • Lacking an automated lifecycle management process for workforce identities. For example, you must manually delete cloud identities when employees leave your organization.

Implementation

1. Choose the right SSO method

Alibaba Cloud supports two single sign-on (SSO) methods:

  • 用户SSO

    阿里云通过IdP颁发的SAML断言确定企业用户与阿里云RAM用户的对应关系 。企业用户登录后，使用该RAM用户访问阿里云资源。更多信息，请参见用户SSO概览。

  • 角色SSO

    支持基于SAML 2.0和OIDC的两种角色SSO：

    • SAML角色SSO：阿里云通过IdP颁发的SAML断言确定企业用户在阿里云上可以使用的RAM角色。企业用户登录后，使用SAML断言中指定的RAM角色访问阿里云资源。请参见SAML角色SSO概览。

    • OIDC角色SSO：企业用户通过IdP签发的OIDC令牌（OIDC Token），调用阿里云API扮演指定角色并换取角色临时身份凭证（STS Token），然后使用STS Token安全地访问阿里云资源。更多信息，请参见OIDC角色SSO概览。

We recommend that you use role SSO. However, if some of the cloud products you use do not yet support role-based access, you must use user SSO. For a list of cloud services that support role-based access by using STS, see Cloud Services That Support STS.

Note

For a detailed comparison of user SSO and role SSO, see Scenarios for SSO.

2. Integrate SSO with your corporate IdP

Alibaba Cloud provides a variety of products and features to help you quickly integrate your corporate IdP with Alibaba Cloud for SSO. The right integration solution depends on your scenario and your specific IdP. You can integrate your IdP directly with RAM identities. In certain scenarios, you can use Identity as a Service (IDaaS) for unified SSO. The following sections describe when to use each approach.

Direct SSO integration with RAM identities

If you only need to integrate with RAM for cloud resource management and your IdP supports SAML 2.0, we recommend a direct integration.

  • For single-account scenarios, you can use the single sign-on feature provided by Resource Access Management (RAM) to integrate Alibaba Cloud with your corporate IdP.

  • For multi-account scenarios, such as in a Landing Zone, we recommend that you use CloudSSO to directly integrate with your corporate IdP. This method allows for centralized identity management and authentication across multiple accounts. For a detailed guide, see Implement Multi-account Single Sign-on by Using CloudSSO.

The following are integration guides for common IdPs with Alibaba Cloud RAM identities:

Microsoft Entra ID

If you only need to integrate with RAM for cloud resource management, you can directly integrate Microsoft Entra ID for SSO.

Okta

In most cases, you only need to integrate with RAM identities for cloud resource management. You can directly integrate Okta with RAM identities for SSO.

AD FS

If you do not require a secondary verification check, such as multi-factor authentication (MFA), on the AD FS side, you can directly integrate AD FS with RAM identities for SSO.

  • Single-account scenarios

  • For multi-account scenarios, we recommend that you use CloudSSO to directly integrate with your corporate IdP for centralized identity management and authentication across multiple accounts.

    • SSO: Example of SSO between AD FS and CloudSSO.

    • User/group automatic synchronization: Because AD FS does not officially support the SCIM protocol, you must use an alternative method to implement synchronization. For example, you can use an open source tool provided by Alibaba Cloud, such as ldap2scim, to implement the synchronization mechanism.

Feishu

If you do not need to automatically synchronize your Feishu directory and only need to integrate with RAM identities for cloud resource management, you can directly integrate Feishu with RAM identities for SSO by using the standard SAML protocol.

  • For single-account scenarios, you can use the single sign-on feature provided by Resource Access Management (RAM) to integrate Alibaba Cloud with your corporate IdP.

  • For multi-account scenarios, we recommend that you use CloudSSO to directly integrate with your corporate IdP for centralized identity management and authentication across multiple accounts.

Note

IdPs not listed in the preceding guides may still be compatible with Alibaba Cloud SSO. Any IdP that supports the SAML 2.0 protocol, such as Google Workspace, Auth0, or Keycloak, can be integrated with Alibaba Cloud RAM identities for SSO.

SSO integration by using IDaaS

We recommend using Identity as a Service (IDaaS) to implement unified SSO in these scenarios. For more information about IDaaS and its pricing, see What is IDaaS EIAM?

  • You have multiple user systems on Alibaba Cloud, such as RAM identities, Bastionhost users, and Elastic Desktop Service users, and you need to integrate them all with a corporate IdP for unified SSO. In this case, you can use IDaaS as a bridge between these different user systems.

  • Your IdP does not support the standard SAML protocol, such as DingTalk, WeCom, or another LDAP-based IdP. In this case, you can integrate your IdP with IDaaS and then use IDaaS as a bridge to other cloud user systems.

  • You want to automate user synchronization, but your IdP does not support the standard SCIM protocol, such as Feishu. In this case, you can use IDaaS as a bridge to automatically provision users from your IdP as cloud identities.

  • For security reasons, you require a secondary authentication method, such as multi-factor authentication (MFA), during user sign-in, but your IdP does not support it. In this case, you can use IDaaS to enforce MFA.

  • Your organization does not have a corporate IdP and you need one to integrate with multiple applications. You can use IDaaS as your corporate IdP.

Note

If none of the preceding scenarios apply to you, we recommend that you directly integrate your corporate IdP with Alibaba Cloud RAM identities to simplify your architecture and reduce maintenance costs.

For common corporate IdPs, you can follow the steps below to integrate your corporate IdP with Alibaba Cloud for SSO.

Microsoft Entra ID

We recommend that you use Identity as a Service (IDaaS) to integrate SSO with Microsoft Entra ID if the following scenario applies to you:

  • You have multiple user systems on Alibaba Cloud, such as RAM identities, Bastionhost users, and Elastic Desktop Service users, and you need to integrate them all with Microsoft Entra ID for unified SSO.

The following are the implementation steps:

  • SSO:

    • First, integrate and bind IDaaS with Microsoft Entra ID. This allows users from Microsoft Entra ID to sign in to IDaaS by using the OIDC protocol. For more information, see Bind Microsoft Entra ID (Azure AD).

    • Next, integrate IDaaS with your other user systems, such as RAM users, RAM roles, Bastionhost users, and Elastic Desktop Service users. IDaaS then acts as a bridge to provide unified SSO across these systems. The following are SSO configuration guides for common identity scenarios:

      Note

      For information about how to integrate SSO for more user systems, see Common Application Configurations in the IDaaS documentation.

  • User/group automatic synchronization:

    • First, synchronize Microsoft Entra ID accounts to IDaaS. When you bind IDaaS with Microsoft Entra ID, enable Automatic Account Creation in the Select a scenario step. Then, when a user signs in through OIDC, an IDaaS account is automatically created if one does not already exist. The account information is updated with each subsequent sign-in.

    • Next, synchronize IDaaS accounts to other user systems to enable automatic user provisioning from your corporate IdP to multiple systems. For more information, see Account Synchronization - Event Callback.

      • For information about how to synchronize Bastionhost users, see Centralize Management of Bastionhost Users with IDaaS.

    Note

    IDaaS does not currently support group synchronization.

Okta

We recommend that you use Identity as a Service (IDaaS) to integrate SSO with Okta if the following scenario applies to you:

  • You have multiple user systems on Alibaba Cloud, such as RAM identities, Bastionhost users, and Elastic Desktop Service users, and you need to integrate them all with Okta for unified SSO.

The following are the implementation steps:

  • SSO:

    • First, integrate and bind IDaaS with Okta. This allows users from Okta to sign in to IDaaS by using the OIDC protocol. For more information, see Bind Okta.

    • Next, integrate IDaaS with your other user systems, such as RAM users, RAM roles, Bastionhost users, and Elastic Desktop Service users. IDaaS then acts as a bridge to provide unified SSO across these systems. The following are SSO configuration guides for common identity scenarios:

      Note

      For information about how to integrate SSO for more user systems, see Common Application Configurations in the IDaaS documentation.

  • User/group automatic synchronization:

    • First, synchronize Okta accounts to IDaaS. When you bind IDaaS with Okta, enable Automatic Account Creation in the Select a scenario step. Then, when a user signs in through OIDC, an IDaaS account is automatically created if one does not already exist. The account information is updated with each subsequent sign-in.

    • Next, synchronize IDaaS accounts to other user systems to enable automatic user provisioning from your corporate IdP to multiple systems. For more information, see Account Synchronization - Event Callback.

      • For information about how to synchronize Bastionhost users, see Centralize Management of Bastionhost Users with IDaaS.

    Note

    IDaaS does not currently support group synchronization.

AD FS

We recommend that you use Identity as a Service (IDaaS) to integrate SSO with AD FS if any of the following scenarios apply to you:

  • You have multiple user systems on Alibaba Cloud, such as RAM identities, Bastionhost users, and Elastic Desktop Service users, and you need to integrate them all with AD FS for unified SSO.

  • You require a secondary authentication method for user sign-in, such as multi-factor authentication (MFA).

  • You need to synchronize users from Active Directory (AD) to Alibaba Cloud and want to use a managed product or solution for synchronization instead of a self-managed open source solution.

The following are the implementation steps:

  • SSO:

    • First, integrate and bind IDaaS with AD. For more information, see Bind AD - Inbound.

      • If your AD FS is deployed on Alibaba Cloud and allows communication only within a VPC, create a dedicated endpoint and select it as the IDaaS network endpoint when you bind IDaaS to AD. For more information, see Network Endpoints.

        Note

        Purchasing dedicated endpoints requires an Enterprise Edition instance. For more information, see Billing of dedicated endpoints.

  • Next, integrate IDaaS with your other user systems, such as RAM users, RAM roles, Bastionhost users, and Elastic Desktop Service users. IDaaS then acts as a bridge to provide unified SSO across these systems. The following are SSO configuration guides for common identity scenarios:

    Note

    For information about how to integrate SSO for more user systems, see Common Application Configurations in the IDaaS documentation.

  • User/group automatic synchronization:

    • First, synchronize AD users to IDaaS accounts. When you integrate IDaaS with AD, enable Incremental Synchronization in the Step 2: Select a scenario step. IDaaS listens for changes to user or organization data in AD and performs a synchronization approximately every 10 minutes to import the changes. If a single incremental synchronization involves a large amount of data, the process may be delayed. We recommend that you perform a full synchronization on a regular basis to ensure that the data is consistent between AD and IDaaS.

    • Next, synchronize IDaaS accounts to other user systems to enable automatic user provisioning from your corporate IdP to multiple systems. For more information, see Account Synchronization - Event Callback.

      • For information about how to synchronize Bastionhost users, see Centralize Management of Bastionhost Users with IDaaS.

    Note

    IDaaS does not currently support group synchronization.

LDAP IdP

If your IdP supports only the LDAP protocol, you must use IDaaS to integrate SSO.

  • SSO:

    • First, integrate and bind IDaaS with your LDAP IdP. For more information, see Bind OpenLDAP - Inbound.

    • Next, integrate IDaaS with your other user systems, such as RAM users, RAM roles, Bastionhost users, and Elastic Desktop Service users. IDaaS then acts as a bridge to provide unified SSO across these systems. The following are SSO configuration guides for common identity scenarios:

      Note

      For information about how to integrate SSO for more user systems, see Common Application Configurations in the IDaaS documentation.

  • User/group automatic synchronization:

    • First, synchronize LDAP IdP users to IDaaS accounts. When you integrate IDaaS with your LDAP IdP, enable Scheduled Check in the Step 2: Select a scenario step. Because LDAP does not support incremental data queries, IDaaS performs a full synchronization of all data from the LDAP source node automatically every day at midnight.

    • Next, synchronize IDaaS accounts to other user systems to enable automatic user provisioning from your corporate IdP to multiple systems. For more information, see Account Synchronization - Event Callback.

      • For information about how to synchronize Bastionhost users, see Centralize Management of Bastionhost Users with IDaaS.

    Note

    • IDaaS does not currently support group synchronization.

DingTalk and WeCom

If you use DingTalk or WeCom to manage employee identities, you must use IDaaS to integrate SSO.

  • SSO:

    • First, integrate and bind IDaaS with DingTalk or WeCom. For more information, see Bind DingTalk - Inbound and Bind WeCom.

    • Next, integrate IDaaS with your other user systems, such as RAM users, RAM roles, Bastionhost users, and Elastic Desktop Service users. IDaaS then acts as a bridge to provide unified SSO across multiple systems. The following are SSO configuration guides for common identity scenarios:

      Note

      For information about how to integrate SSO for more user systems, see Common Application Configurations in the IDaaS documentation.

  • User/group automatic synchronization:

    • First, synchronize employees from your DingTalk or WeCom directory to IDaaS accounts.

      • When you bind IDaaS with DingTalk, enable Incremental Synchronization in the Step 1: Select a scenario step. IDaaS then calls the DingTalk API to listen for directory events. When your DingTalk directory changes, the data is synchronized to IDaaS in real time.

      • When you bind IDaaS with WeCom, enable Scheduled Check in the Step 3: Select a scenario step. Because WeCom does not support incremental data queries, IDaaS performs a full synchronization of all data from the WeCom source node automatically every day at midnight.

    • Next, synchronize IDaaS accounts to other user systems to enable automatic user provisioning from your corporate IdP to multiple systems. For more information, see Account Synchronization - Event Callback.

      • For information about how to synchronize CloudSSO users, see Synchronize Users from WeCom and Feishu to CloudSSO by Using IDaaS.

      • For information about how to synchronize Bastionhost users, see Centralize Management of Bastionhost Users with IDaaS.

    Note

    • IDaaS does not currently support group synchronization.

    • Note that incremental synchronization in IDaaS is triggered only by adding, deleting, or updating employees in the directory, not by changes to the visibility scope in DingTalk or WeCom. You must manually trigger a full synchronization for visibility scope changes. If needed, you can implement a solution to perform automatic full synchronizations on a schedule. For more information, see the solution guide "Implement scheduled user synchronization from an IdP to IDaaS by using Function Compute".

Feishu

We recommend that you use Identity as a Service (IDaaS) to integrate SSO with Feishu if any of the following scenarios apply to you:

  • You have multiple user systems on Alibaba Cloud, such as RAM identities, Bastionhost users, and Elastic Desktop Service users, and you need to integrate them all with Feishu for unified SSO.

  • You want to automatically synchronize Feishu users.

The following are the implementation steps:

  • SSO:

    • First, integrate and bind IDaaS with Feishu. For more information, see Bind Feishu.

    • Next, integrate IDaaS with your other user systems, such as RAM users, RAM roles, Bastionhost users, and Elastic Desktop Service users. IDaaS then acts as a bridge to provide unified SSO across these systems. The following are SSO configuration guides for common identity scenarios:

      Note

      For information about how to integrate SSO for more user systems, see Common Application Configurations in the IDaaS documentation.

  • User/group automatic synchronization:

    • First, synchronize employees from your Feishu directory to IDaaS accounts. When you bind IDaaS with Feishu, enable Scheduled Check in the Step 3: Select a scenario step. IDaaS then performs a full synchronization of Feishu data automatically every day at midnight.

    • Next, synchronize IDaaS accounts to other user systems to enable automatic user provisioning from your corporate IdP to multiple systems. For more information, see Account Synchronization - Event Callback.

      • For information about how to synchronize CloudSSO users, see Synchronize Users from WeCom and Feishu to CloudSSO by Using IDaaS.

      • For information about how to synchronize Bastionhost users, see Centralize Management of Bastionhost Users with IDaaS.

    Note

    • IDaaS does not currently support group synchronization.

    • IDaaS does not currently support incremental synchronization for Feishu data.

Important notes

When using automatic user synchronization, deleting a user in your IdP also deletes the corresponding SCIM-provisioned RAM user. This action also deletes any associated AccessKey, which can disrupt any applications or services that rely on it. Therefore, we strongly recommend that you follow the principle of single responsibility for identities:

  • Do not create an AccessKey for a RAM user that is used by an employee to sign in to the Alibaba Cloud console.

  • For applications that call Alibaba Cloud APIs, create a separate RAM user with a dedicated AccessKey and disable console sign-in for that user. For more information, see Change the sign-in settings of a RAM user.

Related resources

Related solutions

  • Implement Multi-account Single Sign-on by Using CloudSSO

  • Synchronize IdP Users to CloudSSO by Using IDaaS

  • Centralize Management of Bastionhost Users with IDaaS

  • Synchronize Users from WeCom and Feishu to CloudSSO by Using IDaaS

  • Implement Unified Identity and Access Management for Multi-account ACK Clusters with CloudSSO

Previous：Establish secure logon mechanismsNext：Simplify personnel management with user groups