CloudSSO:Example: Single sign-on with Okta and CloudSSO

Step 1: Get SP metadata from CloudSSO

1. Log on to the CloudSSO console.

2. In the left-side navigation pane, click Settings.

3. In the SSO Logon section, copy the service provider's (SP) ACS URL and Entity ID.

Step 2: Create an application in Okta

1. Log on to the Okta portal.

2. In the upper-right corner, click your account icon, and then click Your Org.

3. In the left-side navigation pane, choose Applications > Applications.

4. On the Applications page, click Browse App Catalog.

5. Search for the Alibaba Cloud CloudSSO application.

6. On the application's page, click Add integration.

7. Configure the application settings.

   1. On the General Settings page, enter CloudSSODemo as the application name, and then click Done.

   2. On the Sign on tab, in the settings section, click Edit.

      • Default RelayState: The Alibaba Cloud page that users are redirected to after a successful SSO logon. If you leave this empty, users are redirected to the CloudSSO user portal by default.

        Note

        For security reasons, you can only enter a URL in the *.alibabacloudsso.com domain. Otherwise, the configuration will be invalid.

      • ACS URL: Paste the ACS URL that you copied in Step 1: Get SP metadata from CloudSSO.

      • Entity ID: Paste the Entity ID that you copied in Step 1: Get SP metadata from CloudSSO.

      • Application username: Select Okta username.

   3. Click Save.

Step 3: Get IdP metadata from Okta

1. On the details page of the CloudSSODemo application, click the Sign On tab.

2. In the SAML Signing Certificates section, from the Actions drop-down list, select View IdP metadata, and then save the metadata to your computer.

Step 4: Assign users to the application

1. On the details page of the CloudSSODemo application, click the Assignments tab.

2. Click Assign and select an assignment method.

   • Assign to People: Assigns the application to individual users. This tutorial uses this method.

   • Assign to Groups: Assigns the application to a user group.

3. In the Assign CloudSSODemo to People dialog box, click Assign next to the target user.

4. Verify or modify the User Name, and then click Save and Go Back.

5. Repeat steps 3 to 4 to assign other users.

6. Click Done.

Step 5: Enable single sign-on in CloudSSO

1. In the left-side navigation pane of the CloudSSO console, click Settings.

2. In the SSO Logon section, click Configure IdP.

3. In the Configure IdP panel, select Upload Metadata File.

4. Click Upload File to upload the IdP metadata file that you saved in Step 3: Get IdP metadata from Okta.

5. Turn on the SSO logon switch.

   Note

   After you enable SSO logon, username and password logon is disabled. This means CloudSSO users can no longer sign in with their platform credentials. Once enabled, all users must sign in through your identity provider.

Step 6: Synchronize or create users

Synchronize users from Okta to CloudSSO, or create users in CloudSSO with the same usernames.

• Synchronize users from Okta to CloudSSO (Recommended): This method is suitable if you have a large number of users in Okta. For more information, see Tutorial: Synchronize users and groups from Okta by using SCIM.

• Create users in CloudSSO with matching names: This method is suitable if you have only a few users in Okta. For more information, see Create a user.

  Note

  Usernames are used for logon. When you use SSO, the CloudSSO username must match the username configured in the "Application username" field in Okta. For more information, see Step 2: Create an application in Okta.

(Optional) Step 7: Grant permissions to users

To let users access resources in member accounts after logon, create an access configuration and grant them permissions on the RD account.

1. Create an access configuration and define a policy in CloudSSO.

   For more information, see Create an access configuration.

2. Grant permissions to users on the RD account.

   For more information, see Grant permissions on an RD account.

Verify the results

After completing the configuration, you can initiate SSO from either Alibaba Cloud or Okta.

• Initiate SSO from Alibaba Cloud (SP-initiated)

  1. On the Overview page of the CloudSSO console, copy the user logon URL.

  2. Open the user logon URL in a new browser window.

  3. Click Redirect. You are redirected to the SSO Login page. Click Redirect to go to the Okta login page.

  4. Log on with your Okta username and password.

     You are automatically logged on and redirected to the page specified in Default RelayState. In this tutorial, Default RelayState was left empty, so you are redirected to the CloudSSO user portal.

• Initiate SSO from Okta (IdP-initiated)

  1. Log on to the Okta portal as an Okta user.

  2. Click the CloudSSODemo application.

     You are automatically logged on and redirected to the page specified in Default RelayState. In this tutorial, Default RelayState was left empty, so you are redirected to the CloudSSO user portal.

Related documents

• Tutorial: Synchronize users and groups from Okta by using SCIM

• Log on to the CloudSSO user portal and access Alibaba Cloud resources