Alibaba Cloud DevOps SSO

Procedure

Step 1: Create an application

1. Log on to the IDaaS Management Console.

2. Select an IDaaS instance and, in the Actions area, click Console.

3. Go to Applications > Add Application > Application Marketplace, search for the Alibaba Cloud DevOps SSO application template, and click Add Application.

4. Confirm the application name and click Add.

   For Application Name, enter "Alibaba Cloud - Alibaba Cloud DevOps". For Protocol, select SAML 2.0.​

Step 2: Configure application single sign-on

1. After you add the application, you are automatically redirected to the application single sign-on configuration page, where you configure the application.

   On the Login Access > Single Sign-On tab, turn on the SSO switch. Enter the Alibaba Cloud Account ID (a 16-digit number that identifies the target Alibaba Cloud account for SSO). For Application Account, select IDaaS Username. For Authorization Scope, select Manual Authorization (after you select Manual Authorization, assign permissions in Application Authorization).

2. To get the Alibaba Cloud Account ID, click the profile picture in the upper-right corner of the Alibaba Cloud Management Console home page > Account Center page. Select the application account name attribute. During single sign-on, this field serves as the primary key that maps users to RAM users in Alibaba Cloud, which enables logon to Alibaba Cloud DevOps. For testing purposes only, set the authorization scope to all users and temporarily skip the step of assigning permissions to IDaaS accounts.

3. In Application Configuration Information, download the IdP metadata file and save it to your computer. This file establishes the trust relationship between Alibaba Cloud and IDaaS.

4. If your IDaaS account name is the same as your RAM username (the RAM subaccount prefix), for Application Account you can select IDaaS Username.

   In the Single Sign-On configuration section, enter the Alibaba Cloud Account ID and set Authorization Scope to Manual Authorization.

   If your IDaaS account name differs from your RAM username, for Application Account, select Application Account. On the Application Account page, bind the account relationship, select the IDaaS account for single sign-on, and enter the RAM username prefix.

Step 3: Configure Single Sign-On for Users in Alibaba Cloud

1. Log on to the Alibaba Cloud RAM console.

2. In the left-side navigation pane, click SSO Management.

3. On the Single Sign-On for Users tab, you can view the current SSO login settings.

4. Click Edit, select Enabled for the SSO feature status, and upload the IdP metadata file that you downloaded from IDaaS in Step 2. You do not need to enable an auxiliary domain name.

5. Click OK to complete the configuration.

Step 4: Try SSO

You can now use Alibaba Cloud DevOps SSO. There are two ways to initiate SSO:

1. Initiate SSO from IDaaS (IdP-initiated): Log on to the IDaaS application portal with an IDaaS account that has permissions for the Alibaba Cloud DevOps SSO application. Click the icon on the page to initiate single sign-on and log on to Alibaba Cloud DevOps.

2. Initiate SSO from Alibaba Cloud DevOps (SP-initiated): In an anonymous browser, visit the Alibaba Cloud DevOps URL. You are automatically redirected to the Alibaba Cloud login page. At the bottom, click RAM User, enter the Alibaba Cloud username, and click Next.

3. A prompt page appears. Click Log on with Enterprise Account or copy the login link. If you are already logged on to the IDaaS application portal, you can log on directly to Alibaba Cloud DevOps. Otherwise, you are redirected to the IDaaS login page. After you log on to IDaaS, you are automatically logged on to Alibaba Cloud DevOps.