How do I configure a custom domain for the web client? - Elastic Desktop Service

Binding a custom domain to a web client delivers multiple benefits by enhancing brand recognition and professionalism through a branded URL, while also ensuring reliable accessibility for end users. The custom domain simplifies access with a memorable web address and can help meet compliance or security requirements. This topic provides step-by-step instructions for binding and configuring a custom domain.

Background information

Benefits of binding a custom domain to a web client:

Strengthen brand identity: A custom domain reinforces your brand, enhances professionalism, and increases user trust.
Guarantee reliable access: A custom domain avoids blocks on the default domain and ensures seamless access for users, even if the default URL changes.
Simplify user experience: A shorter, memorable domain makes it easier for users to visit and share the web client.
Meet compliance requirements: For cloud resources (e.g., cloud computers) hosted in regions like China (Hong Kong) or regions outside China, a custom domain is mandatory per regulatory standards.

Prerequisites

A registered second-level domain is registered. You can bind a domain registered outside Alibaba Cloud. If you haven't registered a domain yet, you can do so on the Alibaba Cloud Domains service platform. For more information, see Register a domain name on Alibaba Cloud.
(Optional) To enable HTTPS secure access, you need to complete certificate hosting first. For more information, see Upload a certificate.

Usage restrictions

When you connect to a cloud computer via a custom domain, the file transfer feature is unavailable.

Note

To lift this restriction, submit Domain Information Query (WHOIS)a ticket.

Step 1: Enter a custom domain

First, provide a custom domain that has already completed ICP filing.

Log on to the EDS Enterprise console.
In the left-side navigation pane, choose Terminals > Web Clients.
On the Web Client page, click Bind Domain Name.
In the Enter Domain Name step of the Bind Domain Name wizard, enter your custom domain (e.g., workspace.example.com) and click Next.
Note
Requirements for the custom domain name:
- Must be in the correct format.
- Must have completed ICP filing.
- Must not be bound to any Alibaba Cloud account.

Step 2: Verify domain ownership and bind

To verify your ownership of the custom domain name, you need to add a TXT record on your domain hosting provider's website.

Note

If you are not sure which service provider your domain belongs to, you can query it on the page.

In the Verify Domain Name Ownership and Bind Web Client step, copy the Hostname and Record Value of the TXT record.
Add the TXT record in your domain hosting provider's DNS settings.

For domains registered with Alibaba Cloud

Log on to the Alibaba Cloud DNS product console by using the Alibaba Cloud account that registered the custom domain.
In the left navigation pane, choose Public DNS Resolution > Authoritative DNS Resolution.
On the Authoritative Domain Names tab, click your custom domain.
On the DNS Settings tab, click Add DNS Record.
In the Add DNS Record dialog box, configure the following parameters and click OK:
- Record Type: Select TXT.
- Hostname: Paste the Hostname copied from the EDS Enterprise console.
- DNS Request Source: Select Default.
- Record Value: Paste the Record Value copied from the EDS Enterprise console.
- TTL Period: Specify a cache duration. A lower value speeds up record updates (default: 10 minutes).
On the DNS Settings tab, locate the newly added record, click Validity Detection in the Actions column, and verify the status on the Network Detect Tool page.

For domains registered with other providers

Add the following TXT record in your domain provider's DNS management platform:

Hostname: Paste the Hostname copied from the EDS Enterprise console.
Record Value: Paste the Record Value copied from the EDS Enterprise console.

In the Verify Domain Name Ownership and Bind Web Client step, click Verify Domain Name Ownership and Bind Web Client at the bottom.

If verification succeeds, you'll see a confirmation message indicating that the domain is bound but not yet active. Click Next to proceed.

Step 3: Bind and configure the Domain

To make your bound custom domain name take effect, you need to add a CNAME record on your domain hosting provider's website.

In the Create CNAME Record step, copy the Hostname and Record Value of the CNAME record.
Add a CNAME record on your domain hosting provider's website.

For domains registered with Alibaba Cloud

Log on to the Alibaba Cloud DNS product console by using the Alibaba Cloud account that registered the custom domain.
In the left navigation pane, choose Public DNS Resolution > Authoritative DNS Resolution.
On the Authoritative Domain Names tab, click your custom domain.
On the DNS Settings tab, click Add DNS Record.
In the Add DNS Record dialog box, configure the following parameters and click OK:
- Record Type: Select CNAME.
- Hostname: Paste the Hostname copied from the EDS Enterprise console.
- DNS Request Source: Select Default.
- Record Value: Paste the Record Value copied from the EDS Enterprise console.
- TTL Period: Specify a cache duration. A lower value speeds up record updates (default: 10 minutes).
On the DNS Settings tab, locate the newly added record, click Validity Detection in the Actions column, and verify the status on the Network Detect Tool page.

For domains registered with other providers

Add the following CNAME record on your domain provider's DNS platform:
- Hostname: Paste the Hostname copied from the EDS Enterprise console.
- Record Value: Paste the Record Value copied from the EDS Enterprise console.
Run the nslookup command to verify the CNAME resolution result.
1. Replace workspace.example.com with your custom domain and run the following command:
```
nslookup -type=CNAME workspace.example.com
```
2. If the resolution result shows the ALB cluster's domain name, the CNAME record for your custom domain has taken effect. Example of a successful return:
```
Server:  ****
Address:  30.XX.XX.XX

Non-authoritative answer:
workspace.example.com   canonical name = alb-m4dpda8wob66fj****.cn-hangzhou.alb.aliyuncs.com
```

In the Create CNAME Record step, click Check whether the domain name takes effect at the bottom.

If the check passes, a completion prompt will appear. Click OK.

Note

Upon completion of the process, navigate back to the Web Clients page and click the refresh icon located at the top-right of the custom domain list to reload the data.

(Optional) Next step: Enable certificate hosting

After you complete the steps above, end users can access the web client via your configured custom domain. However, since HTTP is used by default, browsers will mark the domain as "Not Secure." To enable secure HTTPS access, you only need to host a certificate.

Log on to the EDS Enterprise console.
In the left-side navigation pane, choose Terminals > Web Clients.
On the Web Clients page, locate your bound custom domain and click Certificate Hosting in the Actions column.
In the Certificate Hosting panel, select the certificate you uploaded in the Certificate Management Service console from the Certificate Name dropdown list and click Upload Certificate.
After successful configuration, your custom domain will automatically upgrade to HTTPS for secure connections.

FAQ

What should I do if an SSO logon interception occurs when I access the web client?

Symptom

The error occurs during SSO logon to a custom-domain-configured web client.

Cause

The logon failure occurs because the SSO callback address is misconfigured. To work around this, users must initially authenticate through the default domain (https://wuying.aliyun.com) before they can successfully log on via SSO.

Solution

To resolve this, access your Identity Provider (IdP) management console and modify the EDS SP's SSO URL by appending the redirect parameter: ?redirectUri=https://<your custom domain>.

Note

This solution exclusively supports organization ID-based authentication and is incompatible with office network ID-based logons. When implementing this solution, ensure you replace <your custom domain> with your specific web client domain (for example, workspace.example.com).