Overview
WUYING Workspace supports single sign-on (SSO) with Azure Active Directory (Azure AD), Alibaba Cloud Identity as a Service (IDaaS), Active Directory Federation Services (AD FS), and DingTalk, which lets you quickly connect to cloud computers.
About SSO
Single sign-on (SSO) is a secure communication technology that allows you to efficiently access multiple trusted application systems with a single sign-on. SSO implements logon based on identity federation.
The following terms are frequently used in SSO scenarios:
-
Identity provider (IdP): an entity that contains the metadata of an external identity provider. An IdP provides identity management services, collects and stores user identity information such as usernames and passwords, and verifies user identities on user logons.
Common IdPs:
-
On-premises IdPs: use on-premises architecture, such as Microsoft Active Directory Federation Service (AD FS) and Shibboleth.
-
Cloud IdP: Alibaba Cloud Application Identity Service, Azure AD, Google Workspace, Okta, and OneLogin.
-
-
Service provider (SP): an application that uses the identity management feature of an IdP to provide users with specific services based on trust relationships with IdPs. In specific identity systems that do not comply with the Security Assertion Markup Language (SAML) protocol, such as OpenID Connect (OIDC), SP is the relying party of an IdP.
-
SAML 2.0: a standard protocol for user identity authentication for enterprises. It is one of the technical implementations for communication between SPs and IdPs. SAML is a de facto standard that is used by enterprises to implement SSO.
To establish mutual trust between Elastic Desktop Service and an enterprise identity provider (IdP), you must exchange metadata between Elastic Desktop Service and the IdP. For more information about configuring SSO based on SAML, see Configure SSO based on SAML.
Scenarios
You can use SSO if you want to log on from the Elastic Desktop Service logon page instead of your IdP's logon page. The implementation method depends on your business scenario. The following table describes common scenarios and configurations for implementing SSO between Elastic Desktop Service and various enterprise IdPs.
Scenario | Description | SSO configuration guide |
Use IDaaS for logon authentication to quickly log on to a WUYING Terminal and connect to a cloud computer. | If you use EIAM in IDaaS to manage user accounts, you can configure SSO between convenience users or enterprise AD users in WUYING Workspace and IDaaS users. In this scenario, WUYING Workspace acts as the SP and IDaaS acts as the IdP. SSO is implemented by exchanging metadata files based on the SAML protocol. After you configure SSO, you can securely use IDaaS credentials to connect to cloud computers. | |
Use LDAP for logon authentication to quickly log on to a WUYING Terminal and connect to a cloud computer. | If you use an LDAP server to manage user accounts, you can configure SSO between the LDAP server and convenience users in WUYING Workspace. After you configure SSO, end users can use their LDAP credentials to authenticate and connect to cloud computers. | |
Use Azure AD for logon authentication to quickly log on to a WUYING Terminal and connect to a cloud computer. | If you use Azure AD to manage user accounts, you can configure SSO between convenience users in WUYING Workspace and Azure AD users. In this scenario, WUYING Workspace acts as the SP and Azure AD acts as the IdP. SSO is implemented by exchanging metadata files based on the SAML protocol. After you configure SSO, you can securely use your internal Azure AD credentials to connect to cloud computers. | Example of implementing SSO between Azure AD and WUYING Workspace |
After you integrate IDaaS with WUYING Workspace, you can configure DingTalk QR code authentication for IDaaS. This allows users to use DingTalk to log on to a WUYING Terminal and connect to a cloud computer. | After you configure SSO between WUYING Workspace and IDaaS, IDaaS can be used for logon authentication. IDaaS supports logon from multiple external authentication sources, including LDAP and DingTalk QR code scanning. Therefore, after you configure Single Sign-On (SSO) between WUYING Workspace and IDaaS, you can use its identity authentication capabilities. You can configure DingTalk QR code authentication for IDaaS to allow users to connect to cloud computers using DingTalk. | |
When you connect to an enterprise Active Directory (AD), you can configure Single Sign-On (SSO) between Active Directory Federation Services (AD FS) and convenience users in WUYING Workspace. After this configuration, logon authentication is required only from AD FS. This allows users to quickly log on to a WUYING Terminal and connect to a cloud computer. | If your enterprise uses Active Directory (AD) Domain Services to manage user account information, you can use AD FS to implement SSO. In this scenario, WUYING Workspace acts as the SP and AD FS acts as the IdP. SSO is implemented by exchanging metadata files based on the SAML protocol. After you configure SSO, you can use credentials provided by AD FS to connect to cloud computers. | Implement SSO with AD FS and WUYING Workspace convenience accounts |