Logon-free access
更新时间：
复制 MD 格式
Customers of virtual operators cannot log on directly to the Alibaba Cloud Management Console. This topic describes the logon-free access flow, which enables these customers to access the console using a security access API.
Background information
Alibaba Cloud allows users to log on to the console using an Alibaba Cloud account or a Resource Access Management (RAM) user. To support logon-free access, Alibaba Cloud also provides a logon method that uses a Security Token Service (STS) token. Virtual operator partners act as trusted entities. They use role assumption to obtain an STS token and enable logon-free access for their users.
Prerequisites
- Activate RAM. For more information, see Billing methods.
- Create a RAM user. Note You do not need to create a new RAM user for each role assumption. You can use an existing RAM user.
- Grant the AliyunSTSAssumeRoleAccess permission to the RAM user. For more information, see Manage RAM user permissions.
- Create an AccessKey.
Logon-free flow
The logon-free flow is shown in the following figure.
- The user logs on to the virtual operator partner's portal.
- The virtual operator partner uses a RAM user as a trusted entity. To assume the customer's role, the partner calls the AssumeRole API and provides the AccessKey ID and AccessKey secret of the RAM user. The partner then calls the GetSigninToken API to request a temporary security token (SigninToken) for the Alibaba Cloud Management Console from the logon service. Note Do not call the AssumeRole API with the AccessKey ID and AccessKey secret of the partner's Alibaba Cloud account. The call will fail.
- The logon service returns the temporary security token to the virtual operator partner.
- The virtual operator partner returns the temporary security token to the user.
- The virtual operator partner calls the Login API and uses the temporary security token to request a logon from the Alibaba Cloud logon service.
- After successful authentication, the Alibaba Cloud logon service returns the request result.
- The user logs on to an Alibaba Cloud product console.
References
该文章对您有帮助吗？