Identity as a Service:Set custom domains

Step 1: Add a domain name

In the Alibaba Cloud DCDN console, go to the Domain Names page and add a domain name.

Configure the following fields:

• Accelerated Domain Name: Your custom domain name.

• Origin Info:

  • Set Origin Type to Origin Domain Name.

  • Enter the initialization domain name shown on the proxy configuration page (do not include https://).

  • Set Port to 443.

After adding the domain name, copy the CNAME record provided by DCDN and add it to your DNS settings. For instructions, see Configure a CNAME record.

Step 2: Configure an HTTPS certificate

On the Domain Names page, open the domain's details page. On the SSL Certificate tab, configure an HTTPS certificate. For instructions, see Configure an HTTPS certificate.

Step 3: Enable back-to-origin HOST

On the domain's details page, go to the Origin Fetch tab and enable Origin HOST.

Set Domain Name Type to Origin Domain Name. The initialization domain name of the IDaaS EIAM instance is automatically selected.

Step 4: Add back-to-origin HTTP headers

On the Origin Fetch tab, click Custom Request Header and add the IP, Host, Token, and other values provided in the IDaaS EIAM console. These headers help prevent IP address spoofing and improve access security.

After completing the configuration, use Test Connectivity in the IDaaS EIAM console to run a connectivity check.

The test simulates access from the IDaaS EIAM service. If you have applied access policies to the domain (such as IP allowlists), the test result may not reflect what your users experience. Test in a simulated user environment as well.

After a successful test, review the affected features, update any related configurations, and roll out the custom domain to your users. If users should still be able to access the initialization domain name, enable automatic redirection.

Step 1: Install Nginx

Choose the installation method for your environment.

# Download the installation package
wget http://nginx.org/download/nginx-1.18.0.tar.gz

# Extract
tar -zxvf nginx-1.18.0.tar.gz
cd nginx-1.18.0

# Configure and specify the installation directory
./configure --prefix=/usr/local/nginx

# Compile and install
make && make install

# Verify the installation
cd /usr/local/nginx/sbin
./nginx -t

nginx: the configuration file /usr/local/nginx//conf/nginx.conf syntax is ok
nginx: configuration file /usr/local/nginx//conf/nginx.conf test is successful

# Install the EPEL repository (required on some systems)
sudo yum install epel-release -y

# Install Nginx
sudo yum install nginx -y

# Start and enable Nginx
sudo systemctl start nginx
sudo systemctl enable nginx

# Verify the service status
sudo systemctl status nginx

# Update the package list
sudo apt update

# Install Nginx
sudo apt install nginx -y

# Start and enable Nginx
sudo systemctl start nginx
sudo systemctl enable nginx

# Verify the service status
sudo systemctl status nginx

Step 2: Configure Nginx

1. Find the configuration file path.

   nginx -t

2. Configure the reverse proxy to forward requests from your custom domain (for example, www.example.com) to the IDaaS EIAM initialization domain (for example, *****.aliyunidaas.com). Edit the server block under http in nginx.conf:

   server {
       # Listen on HTTPS and enable SSL
       listen 443 ssl;
   
       # Your custom domain name
       server_name www.example.com;
   
       location / {
           # Forward to the IDaaS EIAM initialization domain
           proxy_pass https://*****.aliyunidaas.com;
       }
   }

3. Redirect HTTP traffic to HTTPS.

   server {
       listen 80;
       server_name www.example.com;
   
       location / {
           return 301 https://$host$request_uri;
       }
   }

4. Configure the SSL certificate. Upload your certificate and key files to the Nginx server, then update nginx.conf:

   server {
       listen 443 ssl;
       server_name www.example.com;
   
       # SSL certificate paths
       ssl_certificate      /usr/local/nginx/ssl/www.example.com.crt;
       ssl_certificate_key /usr/local/nginx/ssl/www.example.com.key;
   
       # SSL settings
       ssl_protocols TLSv1.2 TLSv1.3;
       ssl_ciphers HIGH:!aNULL:!MD5;
   }

5. Add the IDaaS EIAM back-to-origin request headers. Copy the IP, Host, and Token values from the IDaaS EIAM console, then add them to the location block using proxy_set_header. These headers authenticate your proxy with IDaaS EIAM and pass the client's real IP address. Misconfiguring or omitting them can allow IP spoofing.

   location / {
       proxy_pass http://***.aliyunidaas.com;
   
       # Pass the client's real IP address
       proxy_set_header X-IDaas-Client-IP $remote_addr;
   
       # Host value expected by IDaaS EIAM
       proxy_set_header X-IDaas-Host eiam-idaas.idpsso.net;
   
       # Proxy authentication token from the IDaaS EIAM console
       proxy_set_header X-IDaas-Proxy-Token PTC*****************************6j;
   
       # Preserve the original Host header
       proxy_set_header Host $host;
   }

   

Step 3: Restart Nginx

Restart Nginx after saving the configuration.

sudo /usr/local/nginx/sbin/nginx -s reload

sudo service nginx restart

sudo systemctl restart nginx