Connect your Corporate Identity System to let employees log in to their Mailbox with their corporate account.
This feature is available only in the AI Premium Edition. For differences between editions, see Edition Introduction.
This configuration requires an administrator with relevant technical expertise. Proceed with caution.
Identity authentication integration
Identity Authentication Integration allows employees to log in to their Mailbox using a single Corporate Identity System. This simplifies the login process, eliminates the need to remember multiple credentials, and improves productivity.
In this process, the Corporate Identity System acts as an Identity Provider (IdP).
Login flow using a corporate IdP
After you configure the integration, the login flow using a corporate IdP is as follows:
Redirect: When an employee accesses the custom Mailbox login URL, the system automatically redirects them to the corporate IdP's login page.
Request: The employee enters their corporate account credentials on the IdP's login page and submits the form.
Authenticate: The corporate IdP authenticates the user.
Authorize: After the IdP authenticates the user, the browser sends a Temporary Credential to the Mailbox Server. The Mailbox Server exchanges this credential with the corporate IdP to obtain the employee's Mailbox Account, then authorizes the account and completes the login.
Supported corporate IdP types
Alibaba Mail currently supports the following standard authentication protocols:
Microsoft Active Directory (AD)
OpenID Connect (OIDC)
OAuth
Your corporate IdP must strictly comply with the chosen protocol. If you use a third-party IdP product, such as Alibaba Cloud IDaaS, Authing, or Okta, you might encounter compatibility issues. We recommend configuring the integration first. If you are sure the configuration is correct but errors persist, contact our support team. We are working to optimize the integration and expand support for more third-party IDaaS providers.
Choose a corporate IdP type
First, determine your integration goal. Do you want the IdP to take over the entire authentication flow for your Mailbox, or only to validate account credentials?
If your corporate IdP does not have a login page and you only want it to validate account credentials, choose AD authentication.
If your corporate IdP has a login page and you want it to take over the entire Mailbox login flow, including credential validation, high-risk threat interception, and Two-Factor Authentication (2FA), choose either OIDC or OAuth authentication.
Next, determine the capabilities of your current corporate IdP.
If your corporate IdP supports OIDC, integrate using OIDC authentication.
If your corporate IdP supports OAuth, first evaluate whether it can be extended to support OIDC. If so, OIDC authentication is the preferred method. Otherwise, use OAuth authentication.
If your corporate IdP does not support OIDC or OAuth, we recommend that you implement OIDC support and then integrate.
Corporate IdP integration
Configuration process
1. Prepare for configuration
We currently support OIDC, Microsoft AD, and OAuth. If your Identity Source is OIDC or OAuth, you must first complete the prerequisites in the Mailbox console.
Select an application
2. Configure connection parameters
Enter connection settings, such as the server address and authentication information.
Identity authentication integration - AD
Identity authentication integration - OIDC
Identity authentication integration - OAuth
3. Enable identity source
After confirming the settings are correct, enable the Identity Source. All users will then use the new login method.