Elastic Desktop Service:Implement SSO for IDaaS users and convenience accounts

Step 1: Enable the SSO feature for an office network

Perform the following steps to enable the SSO feature for the destination office network.

1. Log on to the Elastic Desktop Service Enterprise console.

2. In the left-side navigation pane, choose Networks & Storage > Office Networks.

3. In the upper-left corner of the top navigation bar, select a region.

4. On the Office Networks page, find the desired office network and click its ID.

5. In the Other Information section of the office network details page, turn on the SSO switch.

   Note

   The SSO, MFA, and Client Logon Verification features are mutually exclusive. You can enable only one of the features for an office network within a period of time. For organization IDs, these features are not mutually exclusive. You can enable all of them at the same time.

Step 2: In the IDaaS console, configure WUYING Workspace as a trusted SP

1. Log on to the Alibaba Cloud IDaaS console.

2. On the EIAM page, on the IDaaS tab, create an IDaaS instance. For more information, see Create a free instance.

3. Create an account. For more information, see Create an account.

   Note

   The account name that you create in the IDaaS console must be the same as the username of the convenience account in WUYING Workspace.

4. Click the ID of the IDaaS instance. Then, in the EIAM console, add the EDS application.

   1. In the navigation pane on the left, click Applications.

   2. On the Applications page, click Add Application.

   3. On the Marketplace tab, enter EDS in the search box.

   4. On the card that appears, click Add Application.

   5. In the confirmation dialog box, click Add.

      The application is successfully added when its status is Enabled on the Applications page.

5. Enable SSO for IDaaS.

   1. On the Applications page, find the application and click Manage in the Actions column.

   2. On the application details page, choose Sign-In > SSO.

   3. Set the SSO switch to Enabled.

6. Configure EDS as a trusted service provider (SP).

   1. Enter the office network ID from Step 1.

   2. Select an application account as needed. For example, select IDaaS account.

      Note

      • By default, the IDaaS account name is used as the application logon identifier.

      • If you select Application Account, the application account name must be the same as the IDaaS logon account name to complete SSO. For more information, see Configure Application User for SAML.

   3. Select an authorization scope as needed. For example, select Accessible To All.

      Note

      If you want to allow only specific IDaaS accounts to access the application, select Manual Authorization. You must then add application authorization. For more information, see Authorization.

   4. Click Save.

7. In the Application Settings section, find IdP Metadata and click Download to obtain the SAML metadata file.

Step 3: In the WUYING Workspace console, configure IDaaS as a trusted IdP

1. Log on to the Elastic Desktop Service Enterprise console.

2. In the left-side navigation pane, choose Networks & Storage > Office Networks.

3. In the upper-left corner of the top navigation bar, select a region.

4. On the Office Networks page, find the office network for which you want to enable SSO and click its office network ID.

5. On the office network details page, in the Other Information section at the bottom, turn on the SSO switch.

6. To the right of IdP Metadata, click Upload File and upload the SAML metadata file that you obtained in the previous step.

Step 1: Add a SAML application and obtain the SAML metadata file

1. Log on to the Alibaba Cloud IDaaS console.

2. On the EIAM page, on the IDaaS tab, create an IDaaS instance. For more information, see Create a free instance.

3. Create an account. For more information, see Create an account.

   Note

   The account name that you create in the IDaaS console must be the same as the username of the convenience account in WUYING Workspace.

4. Add a SAML application.

   1. In the navigation pane on the left, click Applications.

   2. On the Applications page, click Add Application.

   3. On the Standard Protocols tab, click Add Application on the SAML 2.0 card.

      Important

      You can add applications that use standard protocols in IDaaS Enterprise Edition. If you are using the Free Edition of IDaaS, upgrade to the Enterprise Edition as prompted. For more information, see Instance Management. IDaaS Enterprise Edition is a paid service. For more information about billing, see Product Billing.

   4. In the dialog box that appears, enter an application name and click Add.

      The application is successfully added when its status is Enabled on the Applications page.

5. Obtain the SAML metadata file.

   1. On the Applications page, find the application and click Manage in the Actions column.

   2. On the application details page, choose Sign-In > SSO.

   3. In the Application Settings section, find IdP Metadata and click Download to obtain the SAML metadata file.

Step 2: In the WUYING Workspace console, configure IDaaS as a trusted IdP

1. In the left-side navigation pane, choose Users > Users & Organizations. On the Users & Organizations page, click the Enterprise Identity Source tab.

2. On the Enterprise Identity Sources page, perform the following operations based on your business requirements:

   • If you have not added an enterprise identity source, click SAML to add an enterprise identity source.

   • If you have added an enterprise identity source, click Add Enterprise Identity Source in the upper-left corner. In the Add Enterprise Identity Source panel, click SAML.

3. In the Add Enterprise Identity Source panel, configure the following parameters and click Confirm.

   Parameter	Description
   Enterprise Identity Source Name	The name of the enterprise identity source, which is used to identify the IdP.
   Enterprise Identity Source Type	The type of the enterprise identity source. Select SAML.
   IdP Metadata	The IdP metadata. Click Upload File to upload the metadata file of the IdP.
   User Account Type	The type of the account. Valid values: Convenience Account and Enterprise AD Account. If you select Enterprise AD Account, you must also select an AD domain name.

4. On the Enterprise Identity Sources page, find the enterprise identity source that you want to manage and click Edit in the Actions column.

5. In the Edit Enterprise Identity Source panel, click Download File below Application Metadata.

Step 3: In the IDaaS console, configure WUYING Workspace as a trusted SP

1. In the Alibaba Cloud IDaaS console, on the Applications page, find the SAML application that you created in Step 1 and click Manage in the Actions column.

2. On the application details page, click Upload Metadata and select the application metadata file that you downloaded in Step 2.

   If a URL is automatically populated in the input box to the right of Upload Metadata, the upload is successful.

3. To the right of Upload Metadata, click Parse.

   If URLs are automatically populated in the ACS URL and SP Entity ID fields, the parsing is successful. For more information about the fields for SSO configuration, see SAML 2.0 SSO configuration.

4. Select the application account and authorization scope. For example, select IDaaS Account and Accessible to All.

   Note

   For more information about application accounts, see Configure Application User for SAML.

5. Click Save.