DocsICP FilingConsole
Documentation
Home Page Identity as a Service EIAM User Guide Application Management Standard Applications Common application configurations Alibaba Cloud user SSO

Alibaba Cloud user SSO

Updated at:
Copy as MD
Product
My Favorites

This topic describes how to configure Alibaba Cloud user single sign-on (SSO) in IDaaS. With user SSO, your enterprise members access Alibaba Cloud as RAM users.

Procedure

Step 1: Create an application in IDaaS

  1. Log on to the IDaaS console.

  2. Select an IDaaS instance and click Access Console below the operations area.

  3. Go to Application > Add Application > Marketplace, find the Alibaba Cloud user SSO application template, and click Add Application.

  4. Confirm the application name and click Add Now.

    In Protocol, select SAML 2.0.

Step 2: Configure single sign-on and account synchronization for the application

After you add the application, you are automatically redirected to the Alibaba Cloud User-Based SSO configuration page, where you can use smart configuration or manual configuration to complete the single sign-on and account synchronization configuration.

Smart configuration

After you enter the application, click Smart Config to quickly complete the following configuration. If you are already familiar with the quick guide, click Close Quick Guide on the right to hide the quick guide. If needed later, you can click Open Quick Start Guide to read it again.

  1. Select Enable Feature

    In Enable Feature, select the applicable scenario. The default is Enable SSO Only. You can also select Enable SSO and Account Sync. Different scenarios have different dependency check items.

  2. Enable SR Authorization

    After you select a scenario, go to Enable SR Authorization. If the status is Unauthorized, click Grant Authorization. After the authorization is complete, click Refresh on the right to Refresh the authorization status of the page.

  3. Run Dependency Check

    After authorization is enabled, the system automatically runs a dependency check based on the selected scenario and displays the check items and results. If a check item is Not Passed, address the failure reason and complete the corresponding Fix. The Start Configuration button becomes clickable only after all check items pass.

Note

  1. Smart configuration supports only the configuration of the current Alibaba Cloud account.

  2. The dependency check is an important step to ensure that SSO works properly. If any check item fails, follow the prompts to complete the corresponding fix.

Warning

After you enable RAM single sign-on (SSO), RAM users immediately switch to IDaaS for authentication, and the original logon method becomes invalid. Ensure that the accounts that require RAM logon already exist in IDaaS, and complete the authorization promptly after you configure SSO. Otherwise, the users may be unable to access the Alibaba Cloud Management Console.

Manual configuration

  1. Select Sign-In and click to open the single sign-on configuration page.

    In the single sign-on configuration section, turn on the single sign-on switch, enter the Alibaba Cloud Account ID (a 16-digit number, which is the ID of the target Alibaba Cloud account for which you want to implement SSO), set Application Account to IDaaS Username (this value is passed to the business system as the account identifier during single sign-on), and set Authorization Scope to Manual Authorization (after you select Manual Authorization, you must assign permissions in Application Authorization).

    Important

    After you convert the application to the standard SSO template, you can no longer use the smart configuration feature.

  2. Enter the Alibaba Cloud account ID. You can obtain it by clicking the profile picture in the upper-right corner of the page. Select the application account name attribute. When a user performs single sign-on, this field is used as the primary key to map to the RAM user in Alibaba Cloud and log on to Alibaba Cloud. If this is only for testing, set the authorization scope to all users and temporarily skip the step of assigning permissions to IDaaS accounts.

  3. In Application Settings, download the IdP metadata and save it to your computer. This file is used to establish the trust relationship of Alibaba Cloud with IDaaS.

  4. If your IDaaS account name is the same as the RAM username (the RAM user prefix), you can set Application User to IDaaS Username.

    If your IDaaS account name is different from the RAM username, set Application User to Application User, and then on the Application User page, bind the corresponding account relationship: select the IDaaS account for single sign-on and enter the RAM username prefix.

    Click Add Application Account. In the dialog box that appears, search for and select the IDaaS account by using the Search by Account Name drop-down list, and then click Save to complete the account binding.

  5. Log on to the RAM console. In the left-side navigation pane, click SSO. On the User SSO tab, click enable to turn on the SSO feature, and upload the IdP metadata that you downloaded from IDaaS in step 3. You do not need to enable an auxiliary domain.

Warning

After you enable RAM single sign-on (SSO), RAM users immediately switch to IDaaS for authentication, and the original logon method becomes invalid. Ensure that the accounts that require RAM logon already exist in IDaaS, and complete the authorization promptly after you configure SSO. Otherwise, the users may be unable to access the Alibaba Cloud Management Console.

Step 3 (Optional): Configure RAM user permissions

You may have existing RAM users, or you may want to synchronize the accounts in IDaaS to Alibaba Cloud (for more information, see Account synchronization: Event callback). In this case, assign permissions to the users under Users in the left-side menu bar as needed, so that the users have the appropriate permissions to access Alibaba Cloud resources. If you only want to test single sign-on, skip this step.

In the Actions column of the target user, click Add Permissions.

Step 4: Test SSO

  1. Initiate a user SSO logon from IDaaS or Alibaba Cloud:

    • Initiated from IDaaS (IdP-initiated): Log on to the IDaaS application portal with an IDaaS account that already has permissions on the Alibaba Cloud user SSO application, and then click the application icon on the page to initiate single sign-on to Alibaba Cloud.

    • Initiated from Alibaba Cloud (SP-initiated): Use an anonymous browser to open the Alibaba Cloud logon page, click Logon As RAM User below, enter the RAM username, and then click Next. On the RAM user logon page, click the RAM Username/Password Logon tab, and enter the RAM username in the Username field in the following format: <username>@<default domain> or <username>@<enterprise alias> (for example, username@company.onaliyun.com or username@company-alias), and then click Next.

  2. A prompt page appears. Click Logon with Enterprise Account or copy the logon link. If you are already logged on to the IDaaS application portal, you are directly logged on to Alibaba Cloud. Otherwise, you are redirected to the IDaaS logon page, and after you log on to IDaaS, you are automatically logged on to Alibaba Cloud.

Previous：Common application configurationsNext：Alibaba Cloud role SSO