A user pool is an identity management unit for end users of AI Agent applications. This topic describes how to create, view configurations of, and delete user pools in the Agent Identity console.
Prerequisites
Before you perform the following operations, we recommend that you assign the AliyunAgentIdentityFullAccess system policy to the RAM user or role that you use.
Create a user pool
Create a user pool to manage the end users of your AI Agent application.
-
Log on to the Agent Identity console.
-
In the left-side navigation pane, choose .
-
Click Create User Pool.
-
On the Create User Pool page, configure the following parameters:
-
User Pool Name: Enter a name for the user pool to identify it.
-
Description (Optional): Enter a description for the user pool.
-
Automatically create an inbound identity provider: If selected, the system automatically creates an inbound identity provider associated with the user pool. We recommend that you select this option so that you can directly use the user pool as the inbound identity provider for an agent.
-
-
Click Create User Pool.
After the user pool is created, it appears in the user pool list. You can click the user pool name to open the details page for further configuration.
View user pool configuration
After you create a user pool, the system automatically generates the following configuration information. You can use this information when you integrate external SAML identity providers and client applications.
-
In the user pool list, click the name of the target user pool.
-
On the General tab, view the following configuration information:
Login URL
The SSO login entry URL for the user pool. End users initiate the SAML SSO login process through this URL. You can integrate this URL into your AI Agent application as a unified login entry for users.
Metadata configuration
The configuration information of the user pool as an OIDC provider. This information includes the following fields:
-
Metadata URL: The OIDC standard discovery endpoint (Well-Known Configuration URL).
-
Issuer: The issuer identifier of the user pool.
-
Authorization Endpoint: The OAuth authorization endpoint.
-
Token Endpoint: The OAuth token endpoint, which is used to obtain ID tokens.
SAML identity provider configuration
When you configure an application in an external SAML identity provider (IdP), such as Microsoft Entra ID, you need to use the following configuration information of the user pool as a service provider. For more information about the configuration procedure, see Manage identity providers.
-
Entity ID (Identifier): The unique identifier of the user pool as a SAML Service Provider.
-
ACS URL (Reply URL): The URL of the SAML Assertion Consumer Service, which is the destination to which the external IdP sends the SAML response.
Delete a user pool
If a user pool is no longer needed, you can delete it to release resources.
Deleting a user pool also deletes all users, roles, SAML identity providers, and client applications within the user pool. This action is irreversible. However, the associated inbound identity providers are not automatically deleted. To clean up, go to and manually delete them.
-
Log on to the Agent Identity console.
-
In the left-side navigation pane, choose .
-
In the user pool list, find the target user pool and click Delete User Pool in the Actions column.
-
In the confirmation dialog box, enter the name of the user pool, and then click OK.