How to set up SSO between Azure AD and Elastic Desktop Service-Elastic Desktop Service-阿里云帮助中心

This topic describes how to configure single sign-on (SSO) between Azure Active Directory (Azure AD) and Elastic Desktop Service. After you configure SSO, end users can sign in to cloud computers using their Azure AD credentials, which enables secure and unified sign-in management.

Background

Single sign-on (SSO) is a secure communication technology that allows you to efficiently access multiple trusted application systems with a single sign-on. SSO implements logon based on identity federation.

The following terms are frequently used in SSO scenarios:

Identity provider (IdP): an entity that contains the metadata of an external identity provider. An IdP provides identity management services, collects and stores user identity information such as usernames and passwords, and verifies user identities on user logons.

Common IdPs:
- On-premises IdPs: use on-premises architecture, such as Microsoft Active Directory Federation Service (AD FS) and Shibboleth.
- Cloud IdP: Alibaba Cloud Application Identity Service, Azure AD, Google Workspace, Okta, and OneLogin.

Service provider (SP): an application that uses the identity management feature of an IdP to provide users with specific services based on trust relationships with IdPs. In specific identity systems that do not comply with the Security Assertion Markup Language (SAML) protocol, such as OpenID Connect (OIDC), SP is the relying party of an IdP.
SAML 2.0: a standard protocol for user identity authentication for enterprises. It is one of the technical implementations for communication between SPs and IdPs. SAML is a de facto standard that is used by enterprises to implement SSO.

Procedure

If you use Azure AD to manage user accounts, you can configure SSO between the convenience accounts in Elastic Desktop Service and Azure AD users. In this scenario, Elastic Desktop Service acts as the service provider (SP), and Azure AD acts as the identity provider (IdP). They exchange metadata files based on the SAML protocol to enable SSO. After configuring SSO, users can securely connect to cloud computers using their Azure AD credentials.

Step 1: Create accounts in Elastic Desktop Service

For Azure AD users who will use cloud computers, create convenience accounts in the Elastic Desktop Service console with usernames that match their Azure AD usernames.

You can create convenience accounts by entering user information on either the Manual Entry tab or the Batch Entry tab. Use the Manual Entry tab for a few users and the Batch Entry tab for many users.

Important

When you enter user information, the usernames of the convenience accounts must match the corresponding Azure AD usernames. The matching is case-insensitive.

Before you add users on the Batch Entry tab, prepare a CSV file that meets the format requirements for convenience accounts.

Download a CSV file that contains user information from Azure AD.
1. Sign in to the Azure AD console.
2. In the left-side navigation pane, click Users.
3. On the All users (Preview) page, confirm that the user information meets the requirements.
  The Azure AD usernames must meet the format requirements for Elastic Desktop Service convenience accounts. You must modify any usernames that do not comply. Otherwise, you cannot create the corresponding convenience accounts.
  The username format requirements for a convenience account are as follows:
  - Must be 3 to 25 characters in length.
  - Can contain lowercase letters, digits, hyphens (-), and underscores (_). Periods (.) are not supported.
  - Must start with a lowercase letter or a digit.
4. At the top of the page, click Bulk operations and select Download users.
5. Follow the on-screen instructions to complete the download.
Use a spreadsheet application to open the downloaded CSV file. Adjust the user information to match the format requirements for importing convenience accounts, and then save the file in CSV format.
Note
When you adjust the user information, note the following:
- The required format for the import file is as follows:
  - For user-activated convenience accounts: The first column is the username (required), the second is the email address (required), and the third is the phone number (optional).
  - For administrator-activated convenience accounts: The first column is the username (required), the second is the email address (optional), the third is the phone number (optional), and the fourth is the password (required).
- In the CSV file downloaded from Azure AD, the userPrincipalName column uses a username@domain format. You can extract the prefix as the username for the convenience account. If the userPrincipalName is also the user's actual email address, you can use this column for the convenience account's email. If the actual email address is different, you must enter it manually.

After preparing the CSV file, create the convenience accounts on the Batch Entry tab in the Elastic Desktop Service console. For details, see Create a convenience account.

Important

After creating the convenience accounts, you must assign cloud computers to them. For details, see Manage convenience accounts.

Step 2: Create an application and assign users

In Azure AD, create an application for Elastic Desktop Service and assign the Azure AD users who will use Elastic Desktop Service to it. Follow these steps:

In the left-side navigation pane of the Azure AD console, click Enterprise applications.
On the All applications page, click New application.
In the top menu bar, click Create your own application.
In the panel that appears, enter a name for the application, select Integrate any other application you don't find in the gallery (Non-gallery), and then click Create.
Refresh the page and click the name of the newly created application.
In the left-side navigation pane of the application details page, click Users and groups, and then click Add user/group.
On the Add Assignment page that appears, select the users, and then click Assign.

Step 3: Configure Elastic Desktop Service as a trusted SP

You can upload the metadata file provided by Elastic Desktop Service to Azure AD to configure Elastic Desktop Service as a trusted SAML Service Provider (SP). The steps are as follows:

Obtain the SP metadata file from the Elastic Desktop Service console.
The following steps describe how to obtain the metadata file for an office network. You can also get the metadata file for an organization ID if needed. For details, see Configure SSO based on SAML.
1. Log on to the EDS enterprise console.
2. In the left-side navigation pane, choose Networks & Storage > Office Network.
3. In the top navigation bar, select a region.
4. On the office network page, find the office network for which you want to enable SSO and click the office network ID.
5. In the More Information section at the bottom of the page, find Application Metadata and click Download Application Metadata File.
  The metadata file is automatically downloaded to your computer.
Configure single sign-on for the Elastic Desktop Service application in Azure AD.
1. In the Azure AD console, open the application you created in Step 2.
2. In the left-side navigation pane of the application details page, click Single sign-on and select SAML.
3. Click Upload metadata file.
4. Select the SP metadata file that you downloaded from the Elastic Desktop Service console and click Add.
5. In the Basic SAML Configuration panel, verify that the identifier and reply URL are correct, and then click Save.
  Note
  Open the locally saved SP metadata file to confirm the identifier and reply URL:
  - Identifier (Entity ID): Corresponds to the entityID value in the md:EntityDescriptor tag.
  - Reply URL (Assertion Consumer Service URL): Corresponds to the Location value in the md:AssertionConsumerService tag.
  Important
  If the identifier and reply URL are not automatically populated after you upload the SP metadata file, enter them manually.

Step 4: Configure a trusted IdP in Elastic Desktop Service

You can upload the metadata file from Azure AD to the Elastic Desktop Service console to configure Azure AD as a trusted SAML IdP in the Elastic Desktop Service console. The steps are as follows:

Obtain the IdP metadata file from Azure AD.
1. In the Azure AD console, open the application you created in Step 2.
2. In the left-side navigation pane of the application details page, click Single sign-on.
3. In the SAML Signing Certificate section, click Download next to Federation Metadata XML.
Upload the IdP metadata file from Azure AD to the Elastic Desktop Service console.
The following steps describe how to upload the IdP metadata file to an office network. You can also upload it to an organization ID if needed. For details, see Configure SSO based on SAML.
1. Log on to the EDS enterprise console.
2. In the left-side navigation pane, choose Networks & Storage > Office Network.
3. In the top navigation bar, select a region.
4. On the office network page, find the office network for which you want to enable SSO and click the office network ID.
5. In the More Information section at the bottom of the page, enable SSO and upload the IdP metadata file.
  - SSO: Turn on this switch to enable SSO.
    This feature is disabled by default. The SSO configuration is inactive while this switch is off.
  - IdP Metadata: Click Upload to upload the IdP metadata file.
    A "Completed" status for IdP Metadata indicates that the enterprise IdP is configured as a trusted SAML IdP.

Next steps

After Single Sign-On (SSO) is configured, end users can access cloud computers by authenticating with their Identity Provider (IdP). This topic uses the Windows client as an example to describe how to connect to a cloud computer by using SSO.

Open the Windows client.
On the Pro Edition sign-in page, enter the office network ID or organization ID.
On the Azure AD sign-in page, enter your Azure AD user information.
After successfully signing in to the client, you can find the target cloud computer card on the cloud computer display page and click Connect.

FAQ

If the client displays the message "Authentication failed. Contact your administrator to check the SSO settings", verify that your SSO configuration is correct.
If the client displays the message "Internal error. Contact your administrator", confirm that a convenience account exists in Elastic Desktop Service with a username that matches the Azure AD user.