Integrate User-based Alibaba Cloud
User-based Alibaba Cloud allows a user to access Alibaba Cloud resources as a RAM user. See https://www.alibabacloud.com/help/en/ram/user-guide/overview-of-user-based-sso for more information.
Note: This guide was tested using Identity as a Service 5.36 and Alibaba Cloud. Other versions of Alibaba Cloud may require integration and configuration steps that differ from those documented in this procedure. For newer versions of Alibaba Cloud, this integration guide may be used as an initial approach for integrating Alibaba Cloud. In the event of other issues, contact support@entrust.com for assistance.
Prerequisites
Before you begin, create a RAM user and enable the Console access in the Alibaba cloud console. See the Alibaba Cloud documentation.
To integrate user-based Alibaba Cloud with Identity as a Service you must do the following:
Before you begin, open two browser windows: one for Alibaba Cloud and one for IDaaS.
Step 1: Download the user-based metadata file from Alibaba CloudStep 1: Download the user-based metadata file from Alibaba Cloud
Log in to Alibaba Cloud as a RAM user (use this link). The Overview page appears.
On the left side, click SSO. The SSO page appears.
Click the User-Based SSO tab.
Click Download File to download the Metadata File.
Leave this page open to return to later in Step 5: Configure Alibaba for SSO with IDaaS.
Step 2: Add user-based Alibaba Cloud to Identity as a ServiceStep 2: Add user-based Alibaba Cloud to Identity as a Service
In Identity as a Service, click 
> Security > Applications. The Applications Lists page appears.
Click Add. The Select an Application Template page appears.
Do one of the following:
Select SAML Cloud Integrations from the search drop-down list and scroll to find the application you want to add to IDaaS.
- or -
In the Search bar, enter a search option to filter for the application you want to add to IDaaS.
Click Alibaba Cloud. The Add Alibaba Cloud page appears.
Enter an Application Name.
Enter an Application Description.
Optional. Add a custom application logo.
Click 
next to Application Logo. The Upload Logo dialog box appears.
Click 
to select an image file to upload.
Browse to select your file and click Open. The Upload Logo dialog box reappears showing your selected image.
If required, resize your image.
Click OK.
Select the Authentication Flow that appears to users during login.
Click Next. The General page appears.
Click Upload Metadata XML and navigate to upload the metadata file you downloaded in Step 1: Download the user-based metadata file from Alibaba Cloud.
Enter the Max Authentication Age (seconds) to set the maximum amount of time that can elapse before a user is required to reauthenticate during a new login attempt. This applies for both SP-initiated and IDP-initiated login. Set this field to -1 to disable this feature.
From the SAML NameID Attribute drop-down list, select Email.
Select the SAML Signing Certificate from the drop-down list.
Optional: Select Respond Immediately for Unsuccessful Responses to return to the application immediately after a login failure, rather than allow user to try again with a different userID.
Deselect Enable Go Back Button if you do not want users to be able to go back to the Alibaba Cloud login page to log in.
Select Show Default Assertion Consumer URL Service in the My Profile. When selected, the Default Assertion Consumer URL appears in a user's My Profile page in addition to relay states and Alternative Assertion Consumer URLs.
Add a Relay State as follows:
Click Add next to Relay State. The Add Relay State dialog box appears.
In the Name field, enter RelayState.
In the Value field, enter *.aliyun.com.
Click Add.
Leave the remaining settings at the default values.
Click Submit.
Step 3: Add a resource ruleStep 3: Add a resource rule
Step 4: Download the metadata from Identity as a ServiceStep 4: Download the metadata from Identity as a Service
Download the Metadata file from Identity as a Service
In Identity as a Service, click > Security > Applications. The Applications List page appears.
Do one of the following:
Click 
next to the application you are integrating with Identity as a Service.
–or–
Click 
next to the application you are integrating with Identity as a Service and select SAML IDP Metadata.
The SAML Application Metadata dialog box appears.
Select the certificate to include in the SAML IDP Metadata file from the drop-down list.
If applicable, Select the domain to include in the SAML IDP Metadata file from the drop-down list.
Enter the Lifetime, in days, for the SAML IDP Metadata file. The value must be between 2 and 730.
Do one of the following, as required:
Copy the Public Endpoint to paste into your SAML application being used Identity Provider authentication.
Click Download.
Note: If you are using multiple domains, you must download each domain's metadata file separately because the values in the metadata file vary for each domain.
Step 5: Configure user-based Alibaba Cloud for SSO with IDaaSStep 5: Configure user-based Alibaba Cloud for SSO with IDaaS
Return to the page you left open in Step 1: Download the metadata file from Alibaba Cloud.
Next to Setup SSO, click Edit. The SSO Settings dialog box appears.
Select Enabled for SSO Status to require users to log in with Identity as a Service (the IDP).
Click Upload File to browse to select the Metadata File you downloaded in Step 4: Download the metadata file from Identity as a Service.
Enter an Auxiliary Domain Name, for example, mycompany.com. This setting uses the auxiliary domain name as the suffix NameID element in SAML assertions.
Click OK.
Step 6: Test the integrationStep 6: Test the integration
Testing Service Provider Login
Open a Web browser and enter the URL for your Alibaba Cloud user-based account. You are directed to Identity as a Service. Use this link to log in.
Click Logon with Enterprise Account. You are redirected to IDaaS.
Enter your Alibaba Cloud account User ID and click Next.
Respond to the second-factor authentication challenge. If you respond successfully, you are logged in to the Alibaba Home page.
Testing Identity as a Service redirect log in
Log in to your Identity as a Service account.
Go to your My Profile page if you are not already there.
Under Applications, click Alibaba Cloud.
Respond to the second-factor authentication challenge. If you respond successfully, you are logged in to user-based Alibaba Cloud.