CloudSSO:Configure single sign-on from Microsoft Entra ID to CloudSSO

Prerequisites

• All configuration operations in Microsoft Entra ID must be performed by an administrator with global administrator permissions.

  For more information about how to create a user and grant administrator permissions in Microsoft Entra ID, see the Microsoft Entra ID documentation.

• Synchronize users from Microsoft Entra ID to CloudSSO, or create users in CloudSSO with the same usernames.

  • Synchronize users from Microsoft Entra ID to CloudSSO (Recommended): This method is suitable for scenarios with many users in Microsoft Entra ID. For more information, see Example of synchronizing users or groups from Microsoft Entra ID using SCIM.

  • Create users with the same names in CloudSSO: This method is suitable for scenarios with only a few users in Microsoft Entra ID. For more information, see Create a user.

    Note

    Usernames are used for logon. When you configure SSO, the CloudSSO username must match the value of the field used for SSO in Microsoft Entra ID. For more information, see Step 3: Configure SAML in Microsoft Entra ID.

• Create an access configuration in CloudSSO and grant permissions on accounts in your resource directory to define the access permissions for CloudSSO users.

  For more information, see Create an access configuration and Grant permissions on accounts in a resource directory.

Step 1: Obtain the SP metadata file in the CloudSSO console

1. Log on to the CloudSSO console.

2. In the navigation pane on the left, click Settings.

3. In the SSO Logon section, download the service provider (SP) metadata file.

Step 2: (Optional) Create an application in Microsoft Entra ID

1. Log on to the Azure portal as a Microsoft Entra ID administrator.

2. In the upper-left corner of the homepage, click the icon.

3. In the navigation pane on the left, choose Microsoft Entra ID > Manage > Enterprise Applications > All Applications.

4. Click New Application.

5. On the Browse Microsoft Entra Gallery page, click Create Your Own Application.

6. On the Create Your Own Application page, enter an application name, such as CloudSSODemo, select the Integrate Any Other Application You Don't Find In The Gallery (Non-gallery) option, and click Create.

Step 3: Configure SAML in Microsoft Entra ID

1. In the navigation pane on the left of the CloudSSODemo page, choose Manage > Single Sign-on.

2. In the Select a single sign-on method section, click SAML.

3. On the Set up Single Sign-On with SAML page, perform the following steps:

   1. In the upper-left corner, click Upload metadata file. Then, select the SP metadata file that is obtained in Step 1 and click Add.

   2. In the Basic SAML Configuration panel, configure the following parameters and click Save.

      • Identifier (Entity ID): required. After the SP metadata file is imported, the value of this parameter is automatically displayed.

        Note

        If the value is not automatically displayed, go to the Settings page of the CloudSSO console and copy the value of Entity ID in the SSO Logon section.

      • Reply URL (Assertion Consumer Service URL): required. After the SP metadata file is imported, the value of this parameter is automatically displayed.

        Note

        If the value is not automatically displayed, go to the Settings page of the CloudSSO console and copy the value of ACS URL in the SSO Logon section.

      • Relay State: optional. This parameter specifies the URL of a page that is displayed after a user logs on to the Alibaba Cloud Management Console using SSO. If you do not configure this parameter, the user is redirected to the CloudSSO user portal by default.

        Note

        To ensure security, you are allowed to enter only a URL that contains *.alibabacloudsso.com. If you enter a URL that does not contain this domain name, the configuration is invalid.

   3. In the Attributes & Claims section, click Edit. Set the value of Unique User Identifier (Name ID) to user.userprincipalname or another field that can uniquely identify a user.

      Note

      • You can set any field that uniquely identifies a user, such as user.userprincipalname or user.mail, as the value of NameID in the SAML assertion. Because CloudSSO requires the incoming NameID value to match the CloudSSO username, create users in CloudSSO based on this field value to ensure a successful SSO logon.

      • If you also configure SCIM synchronization, you must configure the userName property for SCIM with the same field (for example, user.userprincipalname).

   4. In the SAML Certificates section, click Download for Federation Metadata XML.

Step 4: (Optional) Assign users in Microsoft Entra ID

1. In the navigation pane on the left of the CloudSSODemo page, choose Manage > Users and groups.

2. In the upper-left corner, click Add User/group.

3. Select users.

4. Click Assign.

Step 5: Enable SSO in the CloudSSO console

1. In the navigation pane on the left of the CloudSSO console, click Settings.

2. In the SSO Logon section of the Settings page, click Configure IdP.

3. In the Configure IdP dialog box, select Upload Metadata File.

4. Click Upload to upload the IdP metadata file that is obtained in Step 3.

5. Turn on the switch for SSO to enable SSO.

   Note

   After SSO is enabled, username-password logon is automatically disabled. SSO takes effect on all users. After you enable SSO, all users must use the SSO logon method.

Verify the configuration results

After you configure SSO, you can initiate SSO from Alibaba Cloud or Microsoft Entra ID.

References

• Example: Synchronizing Microsoft Entra ID users or user groups using SCIM

• Log on to the CloudSSO user portal and access Alibaba Cloud resources