Integrate Role-based Alibaba Cloud

Role-based Alibaba Cloud allows an enterprise to manage users in IDaaS without the need to synchronize users from IDaaS to Alibaba and allows users of the enterprise to access Alibaba Cloud using a specific RAM role. See https://www.alibabacloud.com/help/en/ram/user-guide/role-based-sso-by-using-saml/ for more information.

Note: This guide was tested using Identity as a Service 5.36 and Alibaba Cloud. Other versions of Alibaba Cloud may require integration and configuration steps that differ from those documented in this procedure. For newer versions of Alibaba Cloud, this integration guide may be used as an initial approach for integrating Alibaba Cloud. In the event of other issues, contact support@entrust.com for assistance.

To integrate role-based Alibaba Cloud with Identity as a Service you must do the following:

Before you begin, open two browser windows: one for Alibaba Cloud and one for IDaaS.

Step 1: Download the metadata file from Alibaba Cloud and create a role and Trusted Entity as an Identity ProviderStep 1: Download the metadata file from Alibaba Cloud and create a role and Trusted Entity as an Identity Provider

On the left side, click SSO. The SSO page appears.

Click the Role-Based SSO tab.

Click Copy to copy the SAML metadata and paste it in a text file, such as Notepad.

Save the file in XML format.

Download File to download the Metadata File.

Leave this page open to return to later in this procedure.

Step 2: Add role-based Alibaba Cloud to Identity as a ServiceStep 2: Add role-based Alibaba Cloud to Identity as a Service

In Identity as a Service, click > Security > Applications. The Applications Lists page appears.

Click Add. The Select an Application Template page appears.

Do one of the following:

Select SAML Cloud Integrations from the search drop-down list and scroll to find the application you want to add to IDaaS.

- or -

In the Search bar, enter a search option to filter for the application you want to add to IDaaS.

Click Alibaba Cloud. The Add Alibaba Cloud page appears.

Enter an Application Name.

Enter an Application Description.

Optional. Add a custom application logo.

Click next to Application Logo. The Upload Logo dialog box appears.

Click to select an image file to upload.

Browse to select your file and click Open. The Upload Logo dialog box reappears showing your selected image.

If required, resize your image.

Click OK.

Select the Authentication Flow that appears to users during login.

Click Next. The General page appears.

Click Upload Metadata XML and navigate to upload the metadata file you downloaded in Step 1: Download the role-based metadata file from Alibaba Cloud.

Enter the Max Authentication Age (seconds) to set the maximum amount of time that can elapse before a user is required to reauthenticate during a new login attempt. This applies for both SP-initiated and IDP-initiated login. Set this field to -1 to disable this feature.

From the SAML NameID Attribute drop-down list, select Email.

Select the SAML Signing Certificate from the drop-down list.

From the SAML NameID Encoding Format, select Transient.

Optional: Select Respond Immediately for Unsuccessful Responses to return to the application immediately after a login failure, rather than allow user to try again with a different userID.

Deselect Enable Go Back Button if you do not want users to be able to go back to the Alibaba Cloud login page to log in.

Select Show Default Assertion Consumer URL Service in the My Profile. When selected, the Default Assertion Consumer URL appears in a user's My Profile page in addition to relay states and Alternative Assertion Consumer URLs.

Add three SAML Attributes, as follows:

Add the role attribute, as follows:

Click Add. The Add Attribute dialog box appears.

In the Name field, enter:

https://www.aliyun.com/SAML-Role/Attributes/Role.

In the Value field, enter

acs:ram::$account_id:role/role1,acs:ram::$account_id:saml-provider/provider1

Note: You will edit this value after the adding IDaaS as an IdP to Alibaba.

Click Add to return to the Add Application page.

Add the user id attribute, as follows:

Under SAML Attributes, click Add.

In the Name field, enter

https://www.aliyun.com/SAML-Role/Attributes/RoleSessionName

In the Value field, enter user_id.

Click Add to return to the Add Application page.

Add the session duration attribute, as follows:

Under SAML Attributes, click Add.

In the Name field, enter:

https://www.aliyun.com/SAML-Role/Attributes/SessionDuration .

In the Value field, enter 1800.

Click Add to return to the Add Application page.

Leave the remaining settings at the default values.

Leave this page open. You need to return to it.

Step 3: Download the metadata from Identity as a ServiceStep 3: Download the metadata from Identity as a Service

Download the Metadata file from Identity as a Service

In Identity as a Service, click > Security > Applications. The Applications List page appears.

Do one of the following:

Click next to the application you are integrating with Identity as a Service.

–or–

Click next to the application you are integrating with Identity as a Service and select SAML IDP Metadata.

The SAML Application Metadata dialog box appears.

Select the certificate to include in the SAML IDP Metadata file from the drop-down list.

If applicable, Select the domain to include in the SAML IDP Metadata file from the drop-down list.

Enter the Lifetime, in days, for the SAML IDP Metadata file. The value must be between 2 and 730.

Do one of the following, as required:

Copy the Public Endpoint to paste into your SAML application being used Identity Provider authentication.

Click Download.

Note: If you are using multiple domains, you must download each domain's metadata file separately because the values in the metadata file vary for each domain.

Step 4: Configure role-based Alibaba Cloud with IDaaSStep 4: Configure role-based Alibaba Cloud with IDaaS

To configure role-based Alibaba Cloud for SSO with IDaaS, you need to create a role and add IDaaS as a Trusted Entity.

Return to the page you left open in Step 1: Download the metadata file from Alibaba Cloud.

Click Add IdP. The Add IdP page appears.

Enter an IdP Name. For example, IDaaS.

Click Upload Metadata File and browse to upload the metadata file you downloaded in Step 4: Download the metadata from Identity as a Service.

Click OK.

In the left tab, click Roles. The Roles page appears.

Click Create Role. The Create Role page appears.

Select IdP as the Trusted Entity.

Click Next to Configure the role.

Enter the RAM Role Name. For example, IDaaStrole.

From the IdP Type drop-down list, select SAML.

From the Select IdP drown-down list, select the IDP you created in step 2 above.

Click OK.

Click Add Permissions to Role. The Edit Role page appears.

Click the Grant Permissions tab. The Grant Permission dialog box appears.

Expand Policy and select AdministratorAccess.

Click Grant Permission.

Click Close.

Refresh your browser to apply the changes.

In the left pane, click SSO.

Click the name of your new IdP. For example, IDaaS. The IdP Details page appears. The IdP Details displays an ARN value. For example:

acs:ram::123456789009:saml-provider/IDaaS

Open a text file, such as Notepad, and copy the following values from the ARN:

The numeric value for the ARN. For example, 123456780004. This value replaces $account_id.

The IDP name, for example, IDaaS. This value replaces provider1.

Record the name of the role you created in this step, for example, IDaaSRole. This value replaces role1.

You add these values to IDaaS in the next step.

Close the IdP Details page.

Step 5: Add the ARN values to IDaaSStep 5: Add the ARN values to IDaaS

Return to the Add Alibaba Cloud page you left open in Step 2: Add Alibaba Cloud to IDaaS.

Go to the Value you added for the role SAML attribute. It appears as follows:

acs:ram::$account_id:role/role1,acs:ram::$account_id:saml-provider/provider1

Edit the Value with the following changes:

Replace both instances of $account_id with the ARN numeric value you copied in Step 4: Configure role-based Alibaba Cloud for SSO with IDaaS.

Replace provider1 with the name of the IDP you created in Step 4: Configure role-based Alibaba Cloud with IDaaS.

Replace role1 with the name of the role you created in Step 4: Configure role-based Alibaba Cloud with IDaaS.

Click Submit.

Step 6: Add a resource ruleStep 6: Add a resource rule

See Create resource rules.

Step 7: Test the integrationStep 7: Test the integration

Testing Identity as a Service redirect log in

Go to your My Profile page if you are not already there.

Under Applications, click Alibaba Cloud.

Respond to the second-factor authentication challenge. If you respond successfully, you are logged in to role-based Alibaba Cloud.