CloudSSO:Configure single sign-on from AD FS to CloudSSO

Background

An enterprise uses Active Directory (AD) for on-premises user management and has a multi-account structure in Alibaba Cloud Resource Directory. AD users need SSO access to designated resources in specific member accounts.

This example uses AD FS on a Windows Server 2012 R2 ECS instance. AD FS serves as the identity provider (IdP) and CloudSSO as the service provider (SP).

Prerequisites

Before you configure SSO, complete the following tasks:

1. Deploy the following services on a Windows Server 2012 R2 ECS instance.

   • Active Directory Domain Services (AD DS): Manages domain objects such as users and devices.

   • Active Directory Federation Services (AD FS): Handles SSO relying party configuration and authentication.

     Important

2. Create users and configure permissions in CloudSSO.

   1. Create a user in CloudSSO with a username that matches the AD FS SSO field.

      For more information, see Create a user.

      Note

      The CloudSSO username must match the AD FS SSO field. For more information, see Step 3: Configure SAML assertion attributes in AD FS.

   2. Create an access configuration to define permission policies.

      For more information, see Create a permission set.

   3. Assign access permissions on resource directory accounts.

      For more information, see Assign access to a member account.

Step 1: Obtain the SP metadata from CloudSSO

1. Log on to the CloudSSO console.

2. In the left-side navigation pane, click Settings.

3. In the SSO Logon section, click the download link to save the service provider (SP) metadata file to your local machine.

Step 2: Add Alibaba Cloud as a relying party in AD FS

1. Log on to the ECS instance where AD FS is deployed.

2. Open Server Manager.

3. In the left-side navigation pane, click AD FS.

4. In the upper-right menu bar, choose Tools > AD FS Management.

5. In the AD FS Management console, add Alibaba Cloud as a relying party.

   1. In the left-side navigation pane, right-click Relying Party Trusts, and then click Add Relying Party Trust.

   2. In the Add Relying Party Trust Wizard, select Claims aware, and then click Start.

   3. Select Import data about the relying party from a file, click Browse to import the SP metadata file obtained in Step 1: Obtain the SP metadata from CloudSSO, and then click Next.

   4. Enter a display name for the relying party, and then click Next.

      This example uses CloudSSODemo.

   5. Select an access control policy, and then click Next.

      This example uses Permit everyone.

   6. Review your settings, and then click Next.

   7. Click Close.

Step 3: Configure SAML assertion attributes in AD FS

In this example, the NameID field in the SAML assertion is set to the User Principal Name (UPN) of the AD user, which CloudSSO uses to identify the user.

1. Right-click the CloudSSODemo relying party, and then click Edit Claim Issuance Policy.

2. Click Add Rule.

   Note

   An issuance transform rule maps a user attribute to a SAML assertion attribute. Add a rule to issue the AD FS user UPN as NameID.

3. In the Add Transform Claim Rule Wizard, set Claim rule template to Transform an Incoming Claim, and then click Next.

4. Configure the claim information.

   

   1. Enter a custom claim rule name.

   2. In the Incoming claim type drop-down list, select UPN.

   3. In the Outgoing claim type drop-down list, select Name ID.

   4. In the Outgoing name ID format drop-down list, select Email.

   5. Select Pass through all claim values.

   6. Click Finish.

5. Click OK.

Step 4: Obtain the IdP metadata from AD FS

On the AD FS server, access the following URL to download the IdP metadata file: https://<ADFS-server>/federationmetadata/2007-06/federationmetadata.xml.

Step 5: Enable SSO in CloudSSO

1. In the left-side navigation pane of the CloudSSO console, click Settings.

2. In the SSO Login section, click Configure IdP Information.

3. In the Configure IdP Information dialog box, select Upload Metadata File.

4. Click Upload File to upload the IdP metadata file obtained in Step 4: Obtain the IdP metadata from AD FS.

   Note

   If the metadata file exceeds the size limit, try removing all content within <fed:ClaimTypesRequested> and <fed:ClaimTypesOffered>.

5. Turn on SSO.

   Important

   After you enable SSO, username-and-password logon is automatically disabled for all CloudSSO users. This is a global setting — once enabled, all users must authenticate through SSO.

Verify the configuration

You can initiate SSO from either Alibaba Cloud or AD FS.

• Initiate SSO from Alibaba Cloud

  1. On the Overview page of the CloudSSO console, copy the user portal URL.

  2. Open the URL in a new browser window.

  3. Click Redirect to go to the AD FS logon page.

  4. Enter the username and password of an AD user.

     You are automatically signed in to the CloudSSO user portal.

  5. On the Logon as RAM Role tab, click Show Details in the Permissions column for the target resource directory account.

     

  6. In the permissions panel, click Log On in the Actions column for the target permission.

  7. Access your authorized resources in the member account.

• Initiate SSO from AD FS

  1. Go to the AD FS SSO portal.

     The SSO portal URL is https://<ADFS-server>/adfs/ls/IdpInitiatedSignOn.aspx.

     Note

     • Replace <ADFS-server> with the domain name or IP address of the AD FS server.

     • If the SSO portal page is unavailable, run the following PowerShell command to enable it: Set-AdfsProperties -EnableIdpInitiatedSignonPage $True.

  2. Select the CloudSSODemo site created in Step 2: Add Alibaba Cloud as a relying party in AD FS, and then click Sign in.

  3. Enter the username and password of an AD user, and then click Sign in.

     You are automatically signed in to the CloudSSO user portal.

  4. On the Logon as RAM Role tab, click Show Details in the Permissions column for the target resource directory account.

     

  5. In the permissions panel, click Log On in the Actions column for the target permission.

  6. Access your authorized resources in the member account.