CloudSSO:Use CLI to access CloudSSO and Alibaba Cloud resources

Step 1: Install CLI

You must install Alibaba Cloud CLI and CloudSSO CLI:

• Install Alibaba Cloud CLI

  • Install CLI (Windows)

  • Install CLI (Linux)

  • Install CLI (macOS)

• Install CloudSSO CLI

  1. Install Node.js.

     Install the npm package management tool when you install Node.js.

     Note

     The version of Node.js must be 7.6.0 or later. We recommend that you use the latest LTS version.

  2. Run the following command to install the CloudSSO CLI:

     npm i @alicloud/sso-cli -g

  For more information, see CloudSSO CLI.

Step 2: Configure information about access to CloudSSO

1. Run the following command to configure information about access to CloudSSO:

   acs-sso configure

2. Enter the user logon URL signinUrl.

   Note

   How to obtain the user logon URL signinUrl: Log on to the CloudSSO console and obtain the User Logon URL on the right side of the Overview page.

   Sample request:

   acs-sso configure
   ? please input 'signinUrl': https://signin-******.alibabacloudsso.com/device/login

   Sample success response:

   configuration done!

Step 3: Log on to Alibaba Cloud as a CloudSSO user

The following list provides the commonly used commands:

• Default logon

  1. Run the following command:

     acs-sso login

  2. In the browser that appears, log on to the user portal. After you log on to the user portal, close the browser.

     If no browsers appear, copy the logon URL and user code that are provided in the CLI to log on to the user portal.

     Example:

     If your default browser is not opened automatically, please use the following URL to finish the signin process.
     Signin URL: https://signin-****.alibabacloudsso.com/device/code
     User Code: *********

  3. If the current user is assigned access permissions on multiple accounts in your resource directory, the CLI reminds you to select an account and the access configuration for the account. Then, the CLI generates the AccessKey pair for the account.

     Sample response:

     You have logged in.
     used account: test-account(191585963325****)
     used access configuration: TestAC(ac-x08xz11covd3cyzd****)
     {
       "mode": "StsToken",
       "access_key_id": "STS.****",
       "access_key_secret": "****",
       "sts_token": "****"
     }

  After the logon succeeds, the profile is attached to the account in a resource directory and the access configuration. The cached account and access configuration are used for the next logon.

• Specify the CloudSSO logon configuration name.

  acs-sso login --profile sso

  If you want to configure logon information for multiple accounts in your resource directory and access configurations at a time, you can specify a logon profile to use a specific account and its access configuration. In this case, logon profiles are used to distinguish multiple accounts in your resource directory and their access configurations. You can use --profile to specify different logon profiles for CloudSSO. The preceding command specifies that the logon profile is sso.

  If --profile is not specified, the default logon profile is default.

• Obtain logon configurations

  acs-sso profile --list

• Delete a specific logon configuration

  Run the following command to delete the default logon configuration:

  acs-sso profile --delete --profile default

  Run the following command to delete the logon configuration named sso:

  acs-sso profile --delete --profile sso

• Configure the mode of the output

  You can configure one of the following modes as needed:

  • External process mode (default): You can use this output mode when you use the external process (External) mode of Alibaba Cloud CLI.

    Sample response:

    {
      "mode": "StsToken",
      "access_key_id": "STS.NUyPeEoab****",
      "access_key_secret": "GBubpmh****",
      "sts_token": "CAIS****"
    }

  • Environment variable mode: You can use the --env parameter to configure the output in environment variable mode. For example: acs-sso login --profile user1 --env.

    Sample response:

    export ALIBABACLOUD_ACCESS_KEY_ID=STS.NUyPeEoab****
    export ALIBABACLOUD_ACCESS_KEY_SECRET=GBubpmh****
    export SECURITY_TOKEN=CAIS****

    Environment variables can be used together with Alibaba Cloud tools such as Terraform. For example: `acs-sso login --profile user1 --env` && terraform plan.

    Environment variables can be used together with Alibaba Cloud CLI. For example: `acs-sso login --profile user1 --env` && aliyun ecs DescribeRegions.

Step 4: Use Alibaba Cloud CLI

Sample request:

aliyun configure --mode External --profile sso
Configuring profile 'sso' in 'External' authenticate mode...
Process Command []: acs-sso login --profile sso
Default Region Id []: cn-shanghai
Default Output Format [json]: json (Only support json)
Default Language [zh|en] en: 
Saving profile[sso] ...Done.

In this example, Process Command uses the acs-sso login --profile sso command to specify that the logon profile for CloudSSO is sso. We recommend that you specify the same profile for both Alibaba Cloud CLI and CloudSSO CLI. This way, if multiple logon profiles are configured, you can configure CLI credentials multiple times and match the CLI credentials with different logon profiles.

Sample success response:

Configure Done!!!
..............888888888888888888888 ........=8888888888888888888D=..............
...........88888888888888888888888 ..........D8888888888888888888888I...........
.........,8888888888888ZI: ...........................=Z88D8888888888D..........
.........+88888888 ..........................................88888888D..........
.........+88888888 .......Welcome to use Alibaba Cloud.......O8888888D..........
.........+88888888 ............. ************* ..............O8888888D..........
.........+88888888 .... Command Line Interface(Reloaded) ....O8888888D..........
.........+88888888...........................................88888888D..........
..........D888888888888DO+. ..........................?ND888888888888D..........
...........O8888888888888888888888...........D8888888888888888888888=...........
............ .:D8888888888888888888.........78888888888888888888O ..............

Run the following command to check whether Alibaba Cloud CLI is available:

aliyun sts GetCallerIdentity --profile sso