Dataphin login settings - SSO CAS OAuth SAML - Dataphin - Alibaba Cloud Documentation Center

Background

Dataphin supports multiple account systems for login. Users can link various login methods to a single account. After SSO integration, bind your SSO account to the UID of your initial Dataphin account.

Limitations

Available only in Dataphin V6.0.0 and later for public cloud standalone, private cloud standalone, and public cloud dedicated instance (semi-managed) deployments.

Add a login method

In the top menu bar of the Dataphin Manager homepage, click System Configuration. In the left-side navigation pane, select Login Settings.
On the Login Settings page, click Add Logon Method.

Follow the setup wizard to complete the Protocol configuration and Account mapping.

Protocol configuration

Note

Each login method can be selected only once.

CAS protocol

Authentication service configuration

Parameter	Description
Select a login method	Select CAS Protocol.
System name	Display name on the login page. Default: CAS Login.
System icon	The icon for this login method on the login page. You can upload a PNG or JPG file smaller than 200 KB. If no image is uploaded, the default icon is used.
System description (Optional)	A brief description of the system.
CAS version	Select CAS2 or CAS3.
Authentication server URL	Enter the CAS authentication server URL, then click Test Network Connectivity. Proceed to Submit and Next only after the test succeeds.
Authentication server login URL	Enter the CAS authentication server login URL, then click Test Network Connectivity. Proceed to Submit and Next only after the test succeeds.
Authentication server logout URL	Enter the logout URL of your CAS authentication server.
Session timeout	Duration before re-authentication is required. Maximum: 1440 minutes (24 hours).

User information configuration

Parameter	Description
Key for user ID in source system	Enter the key for the user ID in the source system.
Key for username in source system	Enter the key for the username in the source system. If this key does not exist, use the key for the user ID.
Key for account in source system	Enter the key for the account in the source system. If this key does not exist, use the key for the user ID.
Key for mobile number in source system (Optional)	Enter the key for the mobile number in the source system.
Key for email address in source system (Optional)	Enter the key for the email address in the source system.

OAuth 2.0

Authentication service configuration

Parameter	Description
Select a login method	Select OAuth 2.0.
System name	Display name on the login page. Default: OAuth 2.0 Login.
System icon	The icon for this login method on the login page. You can upload a PNG or JPG file smaller than 200 KB. If no image is uploaded, the default icon is used.
System description (Optional)	A brief description of the system.
Grant type	Only the authorization code grant type is supported.
Authorization server login URL	URL for obtaining an authorization code. The system appends parameters such as client_id automatically. Enter the URL, then click Test Network Connectivity. Proceed to Submit and Next only after the test succeeds.
Authorization server logout URL (Optional)	Enter the logout URL of the authorization server.
Authentication platform type (Optional)	The Identity Provider (IdP) type, such as Keycloak. Note This field is required if you want to use the server logout feature.
client_id, client_secret	Enter the client ID and secret issued by the authorization server. These credentials authenticate your application.
URL for requesting access token	Endpoint for requesting an access token from the OAuth 2.0 authorization server.
Additional parameters for requesting access token (Optional)	Additional static parameters to include when requesting an access token.
Parameter passing method for requesting access token	Select URL or Body. The default is URL.
Authorization header type	Select Token or Bearer. The default is Token.
Session timeout	Duration before re-authentication is required. Maximum: 1440 minutes (24 hours).

User information configuration

Parameter	Description
URL for requesting user information	Enter the URL on the OAuth 2.0 authorization server for requesting user information.
Additional parameters for requesting user information (Optional)	Enter any additional parameters to include when requesting user information.
User account ID parsing	The JSONPath expression for extracting the account ID from the user information response, for example, `$.accountId`. The default is `$.id`.
User account name parsing	The JSONPath expression for extracting the account name from the user information response, for example, `$.accountName`. The default is `$.id`.
User nickname parsing	The JSONPath expression for extracting the user's nickname from the user information response, for example, `$.nickname`. The default is `$.id`.

SAML

Parameter	Description
Select a login method	Select SAML.
System name	Display name on the login page. Default: SAML Login.
System icon	The icon for this login method on the login page. You can upload a PNG or JPG file smaller than 200 KB. If no image is uploaded, the default icon is used.
System description (Optional)	A brief description of the system.
Authentication platform type	The Identity Provider (IdP) type, such as Azure, AD FS, or SAML. Default: saml.
Authentication platform configuration file	Upload the configuration file from your authentication platform. Only .xlsx files are supported.
Authentication platform login URL	Auto-parsed from the metadata file. No manual entry required.
Authentication platform logout URL
Authentication platform certificate	Auto-parsed from the metadata file. No manual entry required.
Dataphin service metadata (Optional)	Click Download Metadata File to get the Service Provider (SP) metadata, which contains the SP identifier, callback URL, and other IdP-required information.
Identity Provider name (Optional)	Enter the name or ID provided by your IdP. Some IdPs require this for authentication. Check your IdP documentation for the exact value.
Communication binding method (Optional)	Must match sp.xml. Default: `urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect`. Alternative: `urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST`.
Session timeout	Duration before re-authentication is required. Maximum: 1440 minutes (24 hours).

Alibaba Cloud RAM

Authentication service configuration

Parameter	Description
Select a login method	Select Alibaba Cloud RAM.
System name	Display name on the login page. Default: Alibaba Cloud RAM Login.
System icon	The icon for this login method on the login page. You can upload a PNG or JPG file smaller than 200 KB. If no image is uploaded, the default icon is used.
System description (Optional)	A brief description of the system.
Authorization server login URL	URL for obtaining an authorization code. Parameters such as client_id are appended automatically. Enter the URL, then click Test Network Connectivity. Proceed to Submit and Next only after the test succeeds.
Authorization server logout URL (Optional)	Enter the logout URL of the authorization server.
client_id, client_secret	Enter the ID and secret of the OAuth application from Alibaba Cloud RAM.
URL for requesting access token	The endpoint for requesting an access token. The default value is `https://oauth.aliyun.com/v1/token`.
Session timeout	Duration before re-authentication is required. Maximum: 1440 minutes (24 hours).

User information configuration

Parameter	Description
URL for requesting user information	The endpoint on the authorization server for requesting user information. The default value is `https://oauth.aliyun.com/v1/userinfo`.
Region for requesting user information (Optional)	Enter the region for requesting user information.
AccessKey ID for requesting user information, AccessKey Secret for requesting user information	Enter the AccessKey ID and AccessKey Secret for requesting user information.

Feishu

Parameter	Description
Select a login method	Select Feishu.
System name	Display name on the login page. Default: Feishu Login.
System icon	The icon for this login method on the login page. You can upload a PNG or JPG file smaller than 200 KB. If no image is uploaded, the default icon is used.
System description (Optional)	A brief description of the system.
Authorization server login URL	URL for obtaining an authorization code. Feishu default: `https://open.feishu.cn/open-apis/authen/v1/index`. Enter the URL, then click Test Network Connectivity. Proceed to Submit and Next only after the test succeeds.
App ID, App Secret	Enter the App ID and App Secret of your application.
Session timeout	Duration before re-authentication is required. Maximum: 1440 minutes (24 hours).

Third-party SSO

Authentication service configuration

Parameter	Description
Select a login method	Select Third-party SSO.
System name	Display name on the login page. Default: Third-party SSO Login.
System icon	The icon for this login method on the login page. You can upload a PNG or JPG file smaller than 200 KB. If no image is uploaded, the default icon is used.
System description (Optional)	A brief description of the system.
Integration documentation	How to integrate login with Dataphin by using third-party SSO.
Authentication server URL	Enter the authentication service URL, then click Test Network Connectivity. Proceed to Submit and Next only after the test succeeds.
Session validity check URL	Enter an endpoint to validate the ticket. The default request path is `/cookie/validCookie?ticket={ticket}`.
Logout URL	Enter the logout URL. The default request path is `/user/logout?ticket={ticket}`.
Redirect to Dataphin after successful login	Unauthenticated users are redirected to the return address from the session validity check endpoint. To redirect users back to Dataphin after login, append `?target-uri=xxxx` to the return address, where xxxx is the redirect destination.

User information configuration

Parameter	Description
URL for obtaining user information	Enter the URL for requesting user information. The default request path is `/user/getAllUser`.
Obtaining method	Select Full Synchronization, Paginated Synchronization, or Cursor-based Synchronization. The default is Full Synchronization. Note When you select Paginated Synchronization or Cursor-based Synchronization, you must also configure pagesize.
pagesize	Enter the number of users to retrieve per page.

Account mapping (Optional)

Maps Dataphin accounts to SSO accounts for data consistency. Unmapped users can manually associate their account when accessing Dataphin through this login method.

The member list shows username, initial account, Dataphin user ID, and source system user ID, and supports batch search, import, and export.
- Batch Search: Enter up to 1,000 Dataphin user IDs (one per line) for exact matching.
- Batch Import Mappings: Click Batch Import Mappings, download the current account data file (dataphin_account_mapping_sso.xlsx), then upload the configured mapping file.
  Note
  - The system downloads the first 500 user records by default. To export specific users, select them first.
  - Upload files must be in .xlsx format, with a maximum of 500 records. Records with blank source system IDs are skipped.
  - To clear a user's source system ID, you must edit it in the list.
  - After you click Start Import, the system validates the data. If some records fail to import, a dialog box appears with details about the failed imports.
- Batch Export: Select accounts and click Batch Export to download a dataphin_account_mapping_export_sso.xlsx file containing username, initial account, Dataphin user ID, and source system user ID.

Click OK. The system automatically validates the account mapping information. If errors occur, modify the information as prompted.

Manage login methods

The Login Settings page lists all configured login methods with their System Name, System Description, Logon Method, System Code, and Status. Drag the icon to reorder them.

Login method: Supported methods include CAS, OAuth 2.0, SAML, Alibaba Cloud RAM, Feishu, Dataphin built-in account, and third-party SSO. The 'Other' type represents a method from a previous version and cannot be edited or deleted. To add a new protocol, contact the Dataphin operations team.
System code: The account system code required in member-related OpenAPI calls to identify the source system of a user ID.

Note

After a version upgrade, the current method appears as 'Default Login' with description 'Default login method'.

The following management actions are supported for login methods.

Action	Description
Disable	Click the icon in the Actions column, then click OK to confirm. Users from the disabled system can no longer log in.
Enable	Login methods are enabled by default. To re-enable a disabled method, click the icon in the Actions column.
Edit	Click the icon in the Actions column for the target login method and follow the setup wizard. Editing a method does not affect its enabled status. Except for the Dataphin built-in account, the editable parameters are the same as those configured during creation. For more information, see Add a login method. When you edit the Dataphin built-in account login method, you can configure the following parameters: Allow regular users to create accounts: Enabled by default when the Dataphin built-in account method is active. All members can create built-in accounts in Management Center > Member Management. If disabled, only roles with 'Manage Tenant Members' permission can create accounts. Disable automatic logout upon browser closure, session timeout policy, password expiration, account lockout threshold, and account lockout duration: These settings match Management Center > System Settings > Login Security (Login security settings). When the Dataphin built-in account login method is active, configure them in either location.
Delete	Click the icon in the Actions column, then click OK to confirm. Deleted methods prevent users from the corresponding system from logging in. Note The Dataphin built-in account login method cannot be deleted.