CloudSSO:Example: Shibboleth and CloudSSO single sign-on

Before you begin

Install Shibboleth, Tomcat, and an LDAP server.

Step 1: Get SAML SP metadata from Alibaba Cloud

1. Log on to the CloudSSO console.

2. In the left-side navigation pane, click Settings.

3. In the SSO Logon section, download the service provider (SP) metadata file and save it to /opt/shibboleth-idp/metadata/aliyun-cloudsso-metadata.xml.

   Save the Entity ID of the SP for later use.

Step 2: Register Alibaba Cloud with Shibboleth

Configure the /opt/shibboleth-idp/conf/metadata-providers.xml file to specify the metadata file from Step 1: Get SAML SP metadata from Alibaba Cloud and register Alibaba Cloud with Shibboleth.

<!--
    <MetadataProvider id="LocalMetadata"  xsi:type="FilesystemMetadataProvider" metadataFile="PATH_TO_YOUR_METADATA"/>
-->
<!-- Replace the preceding commented code with the following code. -->
<MetadataProvider id="AliyunMetadata"  xsi:type="FilesystemMetadataProvider" metadataFile="%{idp.home}/metadata/aliyun-cloudsso-metadata.xml"/>

Step 3: Configure user attributes from Shibboleth

1. Modify the /opt/shibboleth/conf/services.xml file.

   The default configuration uses the attribute-resolver.xml file, which is insufficient. To enable the complete configuration, replace it with attribute-resolver-full.xml.

   <value>%{idp.home}/conf/attribute-resolver.xml</value>
   <!-- Replace the preceding code with the following code. -->
   <value>%{idp.home}/conf/attribute-resolver-full.xml</value>

2. Modify the /opt/shibboleth/conf/attribute-resolver-full.xml file.

   1. In the file, configure which attributes are returned with user information. In this example, the mail attribute is returned.

      <!-- ========================================== -->
      <!--      Attribute Definitions                 -->
      <!-- ========================================== -->
      <!-- Schema: Core schema attributes-->
      <!-- Add the following code after the preceding comments. -->
      <AttributeDefinition xsi:type="Simple" id="mail">
          <InputDataConnector ref="myLDAP" attributeNames="mail" />
          <AttributeEncoder xsi:type="SAML1String" name="urn:mace:dir:attribute-def:mail" encodeType="false" />
          <AttributeEncoder xsi:type="SAML2String" name="urn:oid:0.9.2342.19200300.100.1.3" friendlyName="mail" encodeType="false" />
      </AttributeDefinition>

   2. In the file, read the settings from /opt/shibboleth/conf/ldap.properties to create the LDAP connection.

      <!-- Example LDAP Connector -->
      <!--
      	<DataConnector id="myLDAP" xsi:type="LDAPDirectory"
      		ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"
      		baseDN="%{idp.attribute.resolver.LDAP.baseDN}"
      		principal="%{idp.attribute.resolver.LDAP.bindDN}"
      		principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"
      		useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS:true}"
      		...
      	</DataConnector>
      -->
      <!-- Replace the preceding example code with the following code. -->
      <DataConnector id="myLDAP" xsi:type="LDAPDirectory"
      			   ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"
      			   baseDN="%{idp.attribute.resolver.LDAP.baseDN}"
      			   principal="%{idp.attribute.resolver.LDAP.bindDN}"
      			   principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"
      			   useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS}"
      			   connectTimeout="%{idp.attribute.resolver.LDAP.connectTimeout}"
      			   responseTimeout="%{idp.attribute.resolver.LDAP.responseTimeout}">
      	<FilterTemplate>
      		<![CDATA[
      				%{idp.attribute.resolver.LDAP.searchFilter}
      			]]>
      	</FilterTemplate>
      </DataConnector>

3. Modify the /opt/shibboleth/conf/attribute-filter.xml file to add an attribute filter.

   In the PolicyRequirementRule tag, replace the value attribute with the Alibaba Cloud entityID from Step 1: Get SAML SP metadata from Alibaba Cloud.

   <AttributeFilterPolicyGroup id="ShibbolethFilterPolicy"
   							xmlns="urn:mace:shibboleth:2.0:afp"
   							xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   							xsi:schemaLocation="urn:mace:shibboleth:2.0:afp http://shibboleth.net/schema/idp/shibboleth-afp.xsd">
   <!-- Add the following code after the preceding code. -->
   <AttributeFilterPolicy id="aliyun">
   	<PolicyRequirementRule xsi:type="Requester" value="[entityID]" />
   	<AttributeRule attributeID="mail">
   		<PermitValueRule xsi:type="ANY" />
   	</AttributeRule>
   </AttributeFilterPolicy>

Step 4: Configure the SAML NameID

1. Modify the /opt/shibboleth/conf/relying-party.xml file to configure the NameID for Alibaba Cloud.

   In the bean tag, replace the relyingPartyIds attribute with the Alibaba Cloud entityID from Step 1: Get SAML SP metadata from Alibaba Cloud.

   <!--
   	Override example that identifies a single RP by name and configures it
   	for SAML 2 SSO without encryption. This is a common "vendor" scenario.
   -->
   <!--
   <bean parent="RelyingPartyByName" c:relyingPartyIds="https://sp.example.org">
   	<property name="profileConfigurations">
   		<list>
   			<bean parent="SAML2.SSO" p:encryptAssertions="false" />
   		</list>
   	</property>
   </bean>
   -->
   <!-- Replace the preceding commented code with the following code. -->
   <bean parent="RelyingPartyByName" c:relyingPartyIds="[entityID]">
       <property name="profileConfigurations">
           <list>
               <bean parent="SAML2.SSO" p:encryptAssertions="false" p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" />
           </list>
       </property>
   </bean>

2. Modify the /opt/shibboleth/conf/saml-nameid.xml file to configure NameID generation.

   <!-- Uncomment the following two beans to enable them. -->
   <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
       p:omitQualifiers="true"
       p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
       p:attributeSourceIds="#{ {'mail'} }" />
   <bean parent="shibboleth.SAML1AttributeSourcedGenerator"
       p:omitQualifiers="true"
       p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
       p:attributeSourceIds="#{ {'mail'} }" />

3. Modify the /opt/shibboleth/conf/saml-nameid.properties file to configure NameID properties.

   idp.nameid.saml2.default = urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
   idp.persistentId.useUnfilteredAttributes = true
   idp.persistentId.encoding = BASE32

Step 5: Get SAML IdP metadata from Shibboleth

1. Restart Tomcat to apply your changes.

2. Access https://<your_server_address>/idp/shibboleth and save the metadata file to your local computer.

Step 6: Enable SSO in CloudSSO

1. In the left-side navigation pane of the CloudSSO console, click Settings.

2. In the SSO Logon section, click Configure IdP.

3. In the Configure IdP dialog box, select Upload Metadata File.

4. Click Upload File and upload the IdP metadata file from Step 5: Get SAML IdP metadata from Shibboleth.

5. Turn on the SSO switch to enable SSO.

   Note

   After you enable SSO logon, username and password logon is disabled. This means CloudSSO users can no longer sign in with their platform credentials. Once enabled, all users must sign in through your identity provider.

Step 7: Create a user in CloudSSO

Create a user in CloudSSO with the same name as the corresponding user in Shibboleth.

1. In the left-side navigation pane of the CloudSSO console, choose User Management > User.

2. On the User page, click Create User.

3. In the Create User panel, enter a Username.

   In this example, the username is testUser@testdomain.alicloud.com.

4. Set the user status to Enabled.

5. Click Close.

(Optional) Step 8: Assign permissions to the user

To allow users to access resources in specific Resource Directory member accounts after SSO, create a permission set and grant the user access to those accounts.

1. Create a permission set in CloudSSO to define policies.

   For more information, see Create a permission set.

2. Grant the user access to the member accounts.

   For more information, see Grant access to a member account.

Verify the result

You can initiate SSO from either Alibaba Cloud or Shibboleth.

• Initiate SSO from Alibaba Cloud

  1. On the Overview page of the CloudSSO console, copy the user logon URL.

  2. Open the URL in a new browser.

  3. Click Go. You are automatically redirected to the Shibboleth login page. The SSO Login page is displayed with the Enterprise Account Login URL field automatically filled in. Click the Go button to go to the identity provider login page.

  4. On the Shibboleth logon page, enter the username (testUser) and password, and then click Log On.

     The system automatically logs you on with SSO and redirects you to the CloudSSO user portal.

  5. Access the resources in the member accounts to which you have permissions.

• Initiate SSO from Shibboleth

  1. Access https://<your_server_address>/idp/profile/SAML2/Unsolicited/SSO?providerId=<entityID>.

     Replace <entityID> in the URL with the Alibaba Cloud entityID from Step 1: Get SAML SP metadata from Alibaba Cloud.

  2. On the Shibboleth logon page, enter the username (testUser) and password, and then click Log On.

     The system automatically logs you on with SSO and redirects you to the CloudSSO user portal.

  3. Access the resources in the member accounts to which you have permissions.

FAQ

If you encounter issues during verification, check the /opt/shibboleth-idp/logs/idp-process.log file. The following are common issues: