Enterprise account single sign-on (SSO)
This topic describes how to enable single sign-on (SSO) for enterprise accounts to access Apsara DevOps.
You can integrate third-party enterprise accounts using one of the following two methods:
User-based SSO for RAM, which is described in this topic.
SSO using the IDaaS service. For more information, see Use IDaaS to log on to Apsara DevOps with identities from sources such as DingTalk, WeCom, Lark, Active Directory, OpenLDAP, Okta, and Azure AD.
Configuration
To integrate enterprise accounts using user-based SSO for RAM, an enterprise administrator must complete the following steps:
Go to the RAM console to configure user-based SSO for RAM and create the corresponding RAM users. Your enterprise must provide an identity provider (IdP) that supports SAML 2.0. For more information, see User-based SSO overview.
When adding members in Apsara DevOps, configure automatic synchronization of RAM users from your Alibaba Cloud account. For more information, see Automatically synchronize RAM users.
In addition to the methods described above, region-based organizations in Alibaba Cloud DevOps also support single sign-on through identity providers such as DingTalk, Feishu, WeCom, SAML, CAS, and Alibaba Cloud. For more information, see Identity Source Management.
Workflow
The following is the single sign-on flow for a user, Alice, who has an enterprise account:
Alice accesses Apsara DevOps in a browser.
Apsara DevOps detects that the user is not logged on and redirects them to the Alibaba Cloud logon page. The logon page that appears depends on the method that was used for the previous logon. By default, the Alibaba Cloud account logon page is displayed, but the user can switch to the RAM user logon page.
Alice switches to the RAM user logon page and selects the option for enterprise account logon. Her browser is then redirected to her enterprise's logon page.
After she logs on with her enterprise account, Alice is automatically redirected to Apsara DevOps, where she can begin working.