Configure identity authentication (Invitation-only)

Test code

This topic demonstrates how to call Alibaba Cloud SAE service APIs by using OIDC with a Java application in the China (Shenzhen) region.

• Add the following dependencies to the pom.xml file.

  <dependency>
      <groupId>com.aliyun</groupId>
      <artifactId>sae20190506</artifactId>
      <version>1.25.0</version>
  </dependency>
  <dependency>
      <groupId>com.aliyun</groupId>
      <artifactId>sts20150401</artifactId>
      <version>1.1.4</version>
  </dependency>
  <dependency>
      <groupId>com.aliyun</groupId>
      <artifactId>credentials-java</artifactId>
      <version>0.3.4</version>
  </dependency>

• The following code is a test sample.

  public static void main(String[] args) throws Exception {
      Client cred = newOidcCred();
      callAPI(cred);
  }
  public static void callAPI(com.aliyun.credentials.Client cred) throws Exception {
      com.aliyun.teaopenapi.models.Config config = new com.aliyun.teaopenapi.models.Config();
      config.credential = cred;
      // Replace cn-shenzhen with your region ID.
      config.endpoint = "sae-vpc.cn-shenzhen.aliyuncs.com";
      // Initialize the client. This client is used to call the Alibaba Cloud SAE service APIs.
      com.aliyun.sae20190506.Client client = new com.aliyun.sae20190506.Client(config);
      // Call an SAE OpenAPI operation to get the application list.
      com.aliyun.sae20190506.models.ListApplicationsRequest listApplicationsRequest = new com.aliyun.sae20190506.models.ListApplicationsRequest();
      ListApplicationsResponse listApplicationsResponse = client.listApplications(listApplicationsRequest);
      System.out.println("listApplicationsResponse->" + JSON.toJSONString(listApplicationsResponse));
  }
  private static com.aliyun.credentials.Client newOidcCred() throws Exception {
      // Create an OIDC credential.
      com.aliyun.credentials.models.Config credConf = new com.aliyun.credentials.models.Config();
      credConf.type = "oidc_role_arn";
      credConf.roleArn = System.getenv("ALIBABA_CLOUD_ROLE_ARN");
      credConf.oidcProviderArn = System.getenv("ALIBABA_CLOUD_OIDC_PROVIDER_ARN");
      credConf.oidcTokenFilePath = System.getenv("ALIBABA_CLOUD_OIDC_TOKEN_FILE");
      credConf.roleSessionName = "test-rrsa-oidc-token";
      // For more information about the STS service, visit https://next.api.aliyun.com/product/Sts.
       credConf.setSTSEndpoint("sts-vpc.cn-shenzhen.aliyuncs.com");
      return new com.aliyun.credentials.Client(credConf);
  }

  Important

  In the test code, the ALIBABA_CLOUD_ROLE_ARN, ALIBABA_CLOUD_OIDC_PROVIDER_ARN, and ALIBABA_CLOUD_OIDC_TOKEN_FILE environment variables are built into SAE and can be retrieved directly. After you use these environment variables to authenticate, the request can successfully return the list of SAE applications.

Prerequisites

• Your Alibaba Cloud account must have completed real-name verification. For more information, see Individual real-name verification or Enterprise real-name verification.

  Important

  Resource Access Management (RAM) is a free service. You can use it directly with any Alibaba Cloud account that has completed real-name verification. This service cannot be disabled.

• A namespace has been created. For more information, see Manage namespaces.

Step 1: Enable RRSA OIDC

1. Create an application

   On the SAE Application List page, select a destination region and namespace in the top navigation bar, and then click Create Application. On the Application Basic Information page, configure the parameters and click Next: Advanced Settings.

   Change a running application

   Warning

   After you redeploy an application, the application is restarted. To prevent unpredictable errors such as business interruptions, we recommend that you deploy applications during off-peak hours.

   On the SAE Application List page, select a destination region and namespace in the top navigation bar. Click the ID of the target Application to open the application details page.In the navigation pane on the left, click Basic Information. In the upper-right corner, click Deploy Application.

   Change a stopped application

   On the SAE Application List page, select a destination region and namespace in the top navigation bar. Click the ID of the target Application to open the application details page.Click Basic Information, and then click Modify Application Configuration.

2. Find and expand the Identity Authentication Service section, and then enable RRSA OIDC.

Step 2: Create a RAM role

1. On the Roles page on the RAM console, click Create Role. In the upper-right corner, click Switch Editor and select the Script Editor tab.

   1. In the editor, enter the following script:

      {
        "Version": "1",
        "Statement": [
          {
            "Effect": "Allow",
            "Principal": {
              "Federated": [
                "${ARN_1}",
                "${ARN_2}"
              ]
            },
            "Action": "sts:AssumeRole",
            "Condition": {
              "StringEquals": {
                "oidc:aud": [
                  "sts-vpc-inner.${regionId}.aliyuncs.com"
                ],
                "oidc:iss": [
                  "${issuer URL_1}",
                  "${issuer URL_2}"
                ],
                "oidc:sub": [
                  "system:serviceaccount:sl-${uid}-${namespaceId}:sae-oidc-sa"
                ]
              }
            }
          }
        ]
      }

   2. Replace the variables in the script with their actual values:

      Parameter	Value
      ${regionId}	The ID of the region where the application is deployed. Example: cn-hangzhou.
      ${uid}	Your account ID. You can find your account ID by clicking your profile picture in the upper-right corner of the console.
      ${namespaceId}	The namespace ID. For example, if you use the default namespace in the China (Hangzhou) region, set ${namespaceId} to cn-hangzhou. The default part is omitted. If you use the test namespace in the China (Hangzhou) region, set the value to cn-hangzhou-test.
      ${ARN_1}, ${ARN_2}, ... ${issuer URL_1}, ${issuer URL_2}, ...	On the OIDC tab of the RAM console, view the list of identity providers automatically created by SAE. Click an identity provider's name to open its details page and find the values for ARN and issuer URL. The number of ${ARN} and ${issuer URL} entries in the script must match the number of identity providers created by SAE. For example, if SAE created only one identity provider, keep only ${ARN_1} and ${issuer URL_1} in the script. In the left-side navigation pane, click SSO. On the Role-based SSO tab, click the OIDC subtab. Important When you enable RRSA OIDC in SAE for the first time, the system automatically creates an identity provider. The name of the identity provider is in the format sae-rrsa-{regionId}-xxxx and cannot be changed. The xxxx part is a random four-character string of digits and lowercase letters. If you enable the RRSA OIDC feature in SAE again in the same region, the system does not create a new identity provider. You can continue to use the existing one.

   3. Click OK.

2. Grant the AliyunSAEReadOnlyAccess permission to the target role.

   1. On the Roles page, click the name of the target role.

      In this example, the role name is sae-test.

   2. On the details page of the role, click the Permissions tab and then click Grant Permission.

   3. In the Grant Permission panel, grant the AliyunSAEReadOnlyAccess permission to the role, and then click OK.

      Set Scope to Alibaba Cloud Account.

Step 3: Associate the RAM role with the application

Return to the Identity Authentication Service section. For RAM Role, select the RAM role you created in the previous step and complete the application deployment.

Step 4: Verify the result

1. On the Basic Information page, click the Instances tab. Find the target instance and click Webshell in the Actions column to open its command-line interface.

2. In the command-line interface, run the curl 127.0.0.1:<container_port> command to verify the connection.

3. In the left-side navigation pane, choose Log Management > Real-time Logs, and then select the instance you verified.

   From the Pod Name drop-down list, select a pod that is in the Running state.

4. On the Real-time Logs page, verify that the SAE API operation was called successfully.