Application Real-Time Monitoring Service:Embed Managed Service for OpenTelemetry console pages in a self-managed web application

How it works

The embedding flow uses STS-based federated logon to grant temporary, scoped access to console pages:

Prerequisites

Before you begin, make sure that you have:

• An Alibaba Cloud account with RAM administrative privileges (or the AliyunRAMFullAccess policy)

• A self-managed web application with a backend capable of making HTTP requests

Step 1: Create a RAM user and grant the STS AssumeRole permission

Create a RAM user that your application backend uses to call the STS AssumeRole operation.

1. Log on to the RAM console.

2. In the left-side navigation pane, choose Identity > Users.

3. On the Users page, click Create User.

4. On the Create User page, configure the following settings:

   • In the User Account Information section, set Logon Name and Display Name.

   • In the Access Mode section, select Using permanent AccessKey to access.

5. Click OK.

   Important

   RAM automatically generates an AccessKey pair for the RAM user. The AccessKey pair is displayed only once. Copy and store the AccessKey ID and AccessKey secret before closing the page. For more information, see Create an AccessKey pair.

6. On the Users page, find the RAM user and click Add Permissions in the Actions column.

   To grant permissions to multiple RAM users at once, select the users and click Add Permissions at the bottom of the page.

7. In the Grant Permission panel, configure the following settings:

   1. Set Resource Scope:

      • Account: The permission applies to the current Alibaba Cloud account.

      • ResourceGroup: The permission applies to a specific resource group. See Use a resource group to grant a RAM user the permissions to manage a specific ECS instance.

      Important

      Before you set Resource Scope to ResourceGroup, confirm that the cloud service supports resource groups. See Services that work with Resource Group.

   2. Confirm the Principal (the RAM user you are granting permissions to). The system automatically selects the current RAM user as the principal.

   3. In the Policy section, select AliyunSTSAssumeRoleAccess.

   4. Click Grant permissions.

8. Click Close.

Step 2: Create a RAM role and grant Managed Service for OpenTelemetry permissions

Create a RAM role that defines what the embedded console session can access.

1. Create a RAM role for a trusted Alibaba Cloud account.

2. Grant permissions to the RAM role. Choose one of the following policies based on the access level you need:

   Policy	Access level
   AliyunTracingAnalysisFullAccess	Full read and write access to Managed Service for OpenTelemetry
   AliyunTracingAnalysisReadOnlyAccess	Read-only access to Managed Service for OpenTelemetry

   Important

   The RAM role permissions determine what data and operations are available in the embedded console.

Step 3: Get a temporary AccessKey pair and STS token

From your application backend, call the STS AssumeRole operation to get temporary credentials. Use one of the following methods:

• OpenAPI Explorer

• RAM SDK for Java

Replace the placeholders in the sample code with your actual values:

String akId = "<your-access-key-id>";
String ak = "<your-access-key-secret>";
String roleArn = "<your-role-arn>";

Step 4: Get a logon token

Call the GetSigninToken operation to exchange the temporary credentials from Step 3 for a logon token.

http://signin4service.alibabacloud.com/federation?Action=GetSigninToken
    &AccessKeyId=<temporary-access-key-id>
    &AccessKeySecret=<temporary-access-key-secret>
    &SecurityToken=<sts-token>
    &TicketType=mini

Step 5: Build a logon-free URL

Combine the logon token from Step 4 with the console page URL to build a logon-free URL.

1. Get the target console page URL. For example, the Applications page for the China (Hangzhou) region:

   https://trace4servims.console.alibabacloud.com/#/overview/cn-hangzhou

2. (Optional) Append layout parameters to the console page URL to hide navigation elements:

   Parameter	Effect	Example
   hideTopbar=true	Hides the top navigation bar	https://trace4servims.console.alibabacloud.com/#/overview/cn-hangzhou?hideTopbar=true
   hideSidebar=true	Hides the left-side navigation pane	https://trace4servims.console.alibabacloud.com/#/overview/cn-hangzhou?hideSidebar=true

   To hide both, combine the parameters: ?hideTopbar=true&hideSidebar=true

3. Build the logon-free URL:

   http://signin.alibabacloud.com/federation?Action=Login
       &LoginUrl=<your-login-failure-redirect-url>
       &SigninToken=<logon-token>
       &Destination=<console-page-url>

   Parameter	Description
   LoginUrl	The URL that users are redirected to if logon fails (returns HTTP 302)
   SigninToken	The logon token from Step 4
   Destination	The Managed Service for OpenTelemetry console page URL (with optional layout parameters)