Use an STS Token to call Alibaba Cloud OpenAPI and obtain an access token for an IDaaS M2M client. This method is for scenarios where authentication with a federated credential is not available. - Identity as a Service

When you cannot use a federated credential, such as PKCS#7 or OpenID Connect (OIDC), for authentication, IDaaS lets you get a client access token by using Alibaba Cloud OpenAPI. This topic describes how to configure the required RAM permissions for OpenAPI authentication.

To use OpenAPI authentication, you must first obtain an STS Token by assuming a RAM role. Then, use this STS Token to call the IDaaS OpenAPI and get an access token for your application. The RAM role must have the necessary permissions to access the IDaaS application. This topic uses Function Compute as an example.

Create a permission policy

Log on to the RAM console.
In the navigation pane, choose Permissions > Policies.
Click Create Policy.
Click the JSON Editor tab and paste the following permission policy into the editor.
```
{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "eiam:GenerateOauthToken",
      "Resource": [
        "acs:eiam:<regionId>:<accountId>:instance/<InstanceId>/application/<ApplicationId>"
      ]
    }
  ]
}
```
Replace the placeholders in the Resource field with your actual values. Replace <regionId> with the region ID of your IDaaS EIAM instance, <accountId> with your Alibaba Cloud account ID, <InstanceId> with your IDaaS EIAM instance ID, and <ApplicationId> with the application ID of the IDaaS M2M client that you want to access.
Click OK and enter a name for the policy. For example, openapi-authentication-policy.

Create and authorize a RAM role

Log on to the RAM console.
In the navigation pane, choose Identities > Roles.
Click Create Role. Set Principal Type to Cloud Service and Principal Name to Function Compute / FC.
Click OK and enter a name for the role. For example, openapi-authentication-fc-role.
Find the role you created and, in the Attach Policy column, click Actions.
In the Policy field, select openapi-authentication-policy, and click OK.

Attach the RAM role

Log on to the Function Compute console.
In the navigation pane, choose Function Management > Function List.
Find the function instance and, in the Configure column, click Actions.
On the Function Details tab, click Modify next to Advanced Settings.
Under Permissions, select the openapi-authentication-fc-role role.
After you finish the configuration, click Deploy.

For more information, see Grant Function Compute permissions to access other cloud services by using a function role.