A user pool (UserPool) is the identity management unit in Alibaba Cloud Agent Identity for users of AI agent applications. You can integrate external identity sources with a user pool to enable enterprise SSO sign-in and assign roles to users, and client applications then issue ID tokens for inbound authentication of agents. This topic describes the core concepts of a user pool and the inbound authentication workflow.
What is a user pool
A user pool is the starting point of the inbound authentication chain. When your AI agent application needs to identify end users, create a user pool to centrally manage their sign-in authentication and identity information.
A user pool provides the following core capabilities:
Identity source integration: Identity sources fall into three groups: external identity providers (DingTalk, Lark, and WeCom), protocol-based identity providers (SAML 2.0, OIDC, and generic SCIM user synchronization), and Alibaba Cloud identity (IDaaS Application Identity Service). These groups provide SSO sign-in, JIT provisioning, and user synchronization respectively. To authenticate enterprise employees with IDaaS, see Configure IDaaS as an inbound identity source for Agent Identity.
SAML/OIDC federation: Integrate generic enterprise identity providers through the standard SAML 2.0 or OIDC protocols. Employees can use enterprise SSO sign-in to access AI agent applications, and user information is automatically created and updated during sign-in (JIT Provisioning).
User management: Centrally manage the users in a user pool and their attributes. Users can be created automatically through JIT (Just-In-Time) provisioning from an identity source, or imported through user synchronization. Users in different user pools are isolated from one another.
Role management: Define application-level roles and assign them to users. Role information is written to the ID token and, together with Agent Identity policies, enables role-based access control (RBAC).
Client applications: Register OAuth/OIDC client applications and integrate them with a user pool to issue ID tokens to authenticated users. The client application uses the ID token to exchange for a Workload Access Token from Agent Identity and completes inbound authentication.
Key concepts
User pool identity source
An identity source is an external identity source integrated with a user pool. Identity sources fall into two types:
SSO identity source: Provides a sign-in entry point for end users. Supported types include SAML 2.0, OIDC, the IDaaS Application Identity Service, DingTalk, Lark, and WeCom.
User synchronization source: Synchronizes external users to a user pool in batches. Supported types include the IDaaS Application Identity Service, generic SCIM user synchronization, DingTalk, Lark, and WeCom. SAML 2.0 and OIDC identity sources can also create and update users through JIT provisioning.
Only one SSO identity source can be enabled in a user pool, and enabling a new SSO identity source might automatically disable the previous one. You can enable multiple user synchronization sources at the same time, and the SSO identity source and the user synchronization sources can be different types.
User pool SAML identity provider
A user pool SAML identity provider is an external enterprise identity source, such as Microsoft Entra ID or Okta, that you integrate with a user pool. It serves the following purposes:
Provides an SSO sign-in entry point for the user pool. End users sign in with their enterprise IdP credentials.
Automatically creates and updates users in the user pool based on the attributes in the SAML assertion (JIT Provisioning).
Inbound identity provider
An inbound identity provider is a core concept in Agent Identity. It represents a trusted identity issuer. When you create a user pool, you can choose to automatically create an associated inbound identity provider.
An identity provider can serve as an identity source that accesses an agent directly through OIDC. When you access an agent through user pool SSO, RBAC and identity-aware permission management capabilities are additionally provided.
Client application
A client application is an OAuth/OIDC application registered in a user pool. After a user authenticates through the SSO identity source of the user pool, the client application issues an ID token that contains the identity and role information of the user. The AI agent application uses this ID token to request a Workload Access Token from Agent Identity, which completes inbound authentication.
Inbound authentication workflow
The following is the complete inbound authentication workflow based on a user pool:
User SSO sign-in: An end user accesses the client application of the AI agent application and authenticates through the SSO identity source enabled for the user pool.
User creation and synchronization: The user pool automatically creates or synchronizes users based on the identity source. For example, a user is created through JIT (Just-In-Time) Provisioning during the first SSO sign-in, or imported through a user synchronization source.
Issue an ID token: After a successful sign-in, the client application in the user pool issues an ID token for the user. The token contains claims such as the identity and assigned roles of the user.
Exchange for a Workload Access Token: The AI agent application uses the ID token to request a Workload Access Token from the inbound identity provider of Agent Identity.
Enforce access control and complete inbound authentication: When an agent uses the Workload Access Token to call external resources through the AI gateway, the policy engine evaluates the policy set based on the identity and role information in the token and makes an allow or deny decision.
User pool feature navigation
Refer to the following topics for detailed instructions on each user pool feature module:
User pool management: Create, configure, and delete user pools.
SAML identity provider management: Import SAML Federation Metadata and configure SSO sign-in.
User management: View and manage users in a user pool.
Role management: Define roles and assign them to users to implement RBAC.
Client management: Register and manage OAuth/OIDC client applications.
Microsoft Entra ID: End-to-end configuration tutorial.
Configure IDaaS as an inbound identity source for Agent Identity: Authenticate enterprise employees with the IDaaS Application Identity Service and integrate it with a user pool.