Integrate Role-Based Alibaba Cloud

1. Login into Alibaba Cloud as a RAM user. The Overview page appears. Use this link to log in.

2. On the left side, click SSO. The SSO page appears.

3. Click the Role-Based SSO tab.

4. Click Copy to copy the SAML metadata and paste it in a text file, such as Notepad.

5. Save the file in XML format.

6. Download File to download the Metadata File.

7. Leave this page open to return to later in this procedure.

1. In Identity as a Service, click > Security > Applications. The Applications Lists page appears.

2. Click Add. The Select an Application Template page appears.

3. Do one of the following:

● Select SAML Cloud Integrations from the search drop-down list and scroll to find the application you want to add to IDaaS.

- or -

● In the Search bar, enter a search option to filter for the application you want to add to IDaaS.

4. Click Alibaba Cloud. The Add Alibaba Cloud page appears.

5. Enter an Application Name.

6. Enter an Application Description.

7. Optional. Add a custom application logo.

a. Click next to Application Logo. The Upload Logo dialog box appears.

b. Click to select an image file to upload.

c. Browse to select your file and click Open. The Upload Logo dialog box reappears showing your selected image.

d. If required, resize your image.

e. Click OK.

8. Select the Authentication Flow that appears to users during login.

9. Click Next. The General page appears.

10. Click Upload Metadata XML and navigate to upload the metadata file you downloaded in Step 1: Download the role-based metadata file from Alibaba Cloud.

11. Enter the Max Authentication Age (seconds) to set the maximum amount of time that can elapse before a user is required to reauthenticate during a new login attempt. This applies for both SP-initiated and IDP-initiated login. Set this field to -1 to disable this feature.

12. From the SAML NameID Attribute drop-down list, select Email.

13. Select the SAML Signing Certificate from the drop-down list.

14. From the SAML NameID Encoding Format, select Transient.

15. Optional: Select Respond Immediately for Unsuccessful Responses to return to the application immediately after a login failure, rather than allow user to try again with a different userID.

16. Deselect Enable Go Back Button if you do not want users to be able to go back to the Alibaba Cloud login page to log in.

17. Select Show Default Assertion Consumer URL Service in the My Profile. When selected, the Default Assertion Consumer URL appears in a user's My Profile page in addition to relay states and Alternative Assertion Consumer URLs.

18. Add three SAML Attributes, as follows:

Add the role attribute, as follows:

a. Click Add. The Add Attribute dialog box appears.

b. In the Name field, enter:

https://www.aliyun.com/SAML-Role/Attributes/Role.

c. In the Value field, enter

acs:ram::$account_id:role/role1,acs:ram::$account_id:saml-provider/provider1

Note: You will edit this value after the adding IDaaS as an IdP to Alibaba.

d. Click Add to return to the Add Application page.

Add the user id attribute, as follows:

a. Under SAML Attributes, click Add.

b. In the Name field, enter

https://www.aliyun.com/SAML-Role/Attributes/RoleSessionName

c. In the Value field, enter user_id.

d. Click Add to return to the Add Application page.

Add the session duration attribute, as follows:

a. Under SAML Attributes, click Add.

b. In the Name field, enter:

https://www.aliyun.com/SAML-Role/Attributes/SessionDuration .

c. In the Value field, enter 1800.

d. Click Add to return to the Add Application page.

19. Leave the remaining settings at the default values.

20. Leave this page open. You need to return to it.

Download the Metadata file from Identity as a Service

1. In Identity as a Service, click > Security > Applications. The Applications List page appears.

2. Do one of the following:

● Click next to the application you are integrating with Identity as a Service.

–or–

● Click next to the application you are integrating with Identity as a Service and select SAML IDP Metadata.

The SAML Application Metadata dialog box appears.

3. Select the certificate to include in the SAML IDP Metadata file from the drop-down list.

4. If applicable, Select the domain to include in the SAML IDP Metadata file from the drop-down list.

5. Enter the Lifetime, in days, for the SAML IDP Metadata file. The value must be between 2 and 730.

6. Do one of the following, as required:

a. Copy the Public Endpoint to paste into your SAML application being used Identity Provider authentication.

b. Click Download.

Note: If you are using multiple domains, you must download each domain's metadata file separately because the values in the metadata file vary for each domain.

To configure role-based Alibaba Cloud for SSO with IDaaS, you need to create a role and add IDaaS as a Trusted Entity.

1. Return to the page you left open in Step 1: Download the metadata file from Alibaba Cloud.

2. Click Add IdP. The Add IdP page appears.

3. Enter an IdP Name. For example, IDaaS.

4. Click Upload Metadata File and browse to upload the metadata file you downloaded in Step 4: Download the metadata from Identity as a Service.

5. Click OK.

6. In the left tab, click Roles. The Roles page appears.

7. Click Create Role. The Create Role page appears.

8. Select IdP as the Trusted Entity.

9. Click Next to Configure the role.

10. Enter the RAM Role Name. For example, IDaaStrole.

11. From the IdP Type drop-down list, select SAML.

12. From the Select IdP drown-down list, select the IDP you created in step 2 above.

13. Click OK.

14. Click Add Permissions to Role. The Edit Role page appears.

15. Click the Grant Permissions tab. The Grant Permission dialog box appears.

16. Expand Policy and select AdministratorAccess.

17. Click Grant Permission.

18. Click Close.

19. Refresh your browser to apply the changes.

20. In the left pane, click SSO.

21. Click the name of your new IdP. For example, IDaaS. The IdP Details page appears. The IdP Details displays an ARN value. For example:

acs:ram::123456789009:saml-provider/IDaaS

22. Open a text file, such as Notepad, and copy the following values from the ARN:

● The numeric value for the ARN. For example, 123456780004. This value replaces $account_id.

● The IDP name, for example, IDaaS. This value replaces provider1.

● Record the name of the role you created in this step, for example, IDaaSRole. This value replaces role1.

You add these values to IDaaS in the next step.

23. Close the IdP Details page.

1. Return to the Add Alibaba Cloud page you left open in Step 2: Add Alibaba Cloud to IDaaS.

2. Go to the Value you added for the role SAML attribute. It appears as follows:

acs:ram::$account_id:role/role1,acs:ram::$account_id:saml-provider/provider1

3. Edit the Value with the following changes:

a. Replace both instances of $account_id with the ARN numeric value you copied in Step 4: Configure role-based Alibaba Cloud for SSO with IDaaS.

b. Replace provider1 with the name of the IDP you created in Step 4: Configure role-based Alibaba Cloud with IDaaS.

c. Replace role1 with the name of the role you created in Step 4: Configure role-based Alibaba Cloud with IDaaS.

4. Click Submit.

Testing Identity as a Service redirect log in

1. Log in to your Identity as a Service account.

2. Go to your My Profile page if you are not already there.

3. Under Applications, click Alibaba Cloud.

4. Respond to the second-factor authentication challenge. If you respond successfully, you are logged in to role-based Alibaba Cloud.

Integrate Role-based Alibaba Cloud

To integrate role-based Alibaba Cloud with Identity as a Service you must do the following:

Step 1: Download the metadata file from Alibaba Cloud and create a role and Trusted Entity as an Identity Provider

Step 2: Add role-based Alibaba Cloud to Identity as a Service

Step 3: Download the metadata from Identity as a Service

Step 4: Configure role-based Alibaba Cloud with IDaaS

Step 5: Add the ARN values to IDaaS

Step 6: Add a resource rule