CloudSSO is integrated with Alibaba Cloud Command Line Interface (Alibaba Cloud CLI). Users can log on to the CloudSSO user portal by using browsers. Alternatively, users can access CloudSSO by using Alibaba Cloud CLI. If a user uses Alibaba Cloud CLI to access CloudSSO, the user needs to select an account in a resource directory and the required access configuration to access Alibaba Cloud resources. This topic describes how to use Alibaba Cloud CLI to access CloudSSO.

Step 1: Install CLIs

You must install Alibaba Cloud CLI and CloudSSO CLI:

  • Install Alibaba Cloud CLI

    For more information, see Documentation of Alibaba Cloud CLI.

  • Install CloudSSO CLI

    Use the package management tool npm to install CloudSSO CLI. You must run the following command:

    npm i @alicloud/sso-cli -g

    For more information, see CloudSSO CLI.

Step 2: Configure information about access to CloudSSO

  1. Configure the URL to access CloudSSO.

    Sample request:

    acs-sso configure
    ? please input 'signinUrl': https://signin-******.alibabacloudsso.com/device/login

    signinUrl indicates the URL used to log on to the CloudSSO user portal. To obtain the URL, log on to the CloudSSO console, go to the Overview page, and then find the User Logon URL section.

    Sample success response:

    configuration done!
  2. Configure the account that is used to access CloudSSO.

    The following list provides the commonly used logon commands:

    • Default logon
      1. Run the following command:
        acs-sso login
      2. In the browser that appears, log on to the user portal. After you log on to the user portal, close the browser.
        If no browsers appear, copy the logon URL and user code that are provided in the CLI to log on to the user portal. Example:
        If your default browser is not opened automatically, please use the following URL to finish the signin process.
        Signin URL: https://signin-****.alibabacloudsso.com/device/code
        User Code: *********
      3. If the current user is assigned access permissions on multiple accounts in your resource directory, the CLI reminds you to select an account and the access configuration for the account. Then, the CLI generates the AccessKey pair for the account. Sample command output:
        You have logged in.
        used account: test-account(191585963325****)
        used access configuration: TestAC(ac-x08xz11covd3cyzd****)
        {
          "mode": "StsToken",
          "access_key_id": "STS.****",
          "access_key_secret": "****",
          "sts_token": "****"
        }

      After you log on to the user portal, the selected account and access configuration are cached for the profile option. The cached account and access configuration are used for the next logon.

    • Force logon
      acs-sso login --force

      After you log on to the user portal, the logon information is automatically cached. If you do not want to use the cached information for logons, you can use the --force option to forcibly start a logon session.

    • Logon by using logon profiles
      acs-sso login --profile sso

      If you want to configure logon information for multiple accounts in your resource directory and access configurations at a time, you can specify a logon profile to use a specific account and its access configuration. In this case, logon profiles are used to distinguish multiple accounts in your resource directory and their access configurations. You can use the --profile option to specify different logon profiles. The preceding command specifies that the logon profile is sso.

      If you do not use the --profile option to specify the logon profile, the logon profile named default is used.

Step 3: Configure CLI credentials

Sample request:

aliyun configure --mode External --profile sso
Configuring profile 'sso' in 'External' authenticate mode...
Process Command []: acs-sso login --profile sso
Default Region Id []: cn-shanghai
Default Output Format [json]: json (Only support json)
Default Language [zh|en] en: 
Saving profile[sso] ...Done.

acs-sso login --profile sso in Process Command specifies that the logon profile is sso. We recommend that you specify the same profile for both Alibaba Cloud CLI and CloudSSO CLI. This way, if multiple logon profiles are configured, you can configure CLI credentials multiple times and match the CLI credentials with different logon profiles.

Sample success response:

Configure Done!!!
..............888888888888888888888 ........=8888888888888888888D=..............
...........88888888888888888888888 ..........D8888888888888888888888I...........
.........,8888888888888ZI: ...........................=Z88D8888888888D..........
.........+88888888 ..........................................88888888D..........
.........+88888888 .......Welcome to use Alibaba Cloud.......O8888888D..........
.........+88888888 ............. ************* ..............O8888888D..........
.........+88888888 .... Command Line Interface(Reloaded) ....O8888888D..........
.........+88888888...........................................88888888D..........
..........D888888888888DO+. ..........................?ND888888888888D..........
...........O8888888888888888888888...........D8888888888888888888888=...........
............ .:D8888888888888888888.........78888888888888888888O ..............

Run the following command to check whether Alibaba Cloud CLI is available:

aliyun sts GetCallerIdentity --profile sso