IDaaS OpenAPI authentication via STS Token and RAM role - Identity as a Service

If federated credentials such as PKCS#7 or OpenID Connect (OIDC) are unavailable, you can obtain an IDaaS client access token through Alibaba Cloud OpenAPI. This guide covers the required RAM permission configuration.

OpenAPI authentication requires an STS Token obtained by assuming a RAM role with IDaaS permissions. You then call the IDaaS OpenAPI with this STS Token to retrieve an access token for your application. The following steps use Function Compute as an example.

Create a permission policy

Log on to the RAM console.
In the navigation pane, choose Permissions > Policies.
Click Create Policy.
Click the JSON Editor tab and paste the following policy.
```
{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "eiam:GenerateOauthToken",
      "Resource": [
        "acs:eiam:<regionId>:<accountId>:instance/<InstanceId>/application/<ApplicationId>"
      ]
    }
  ]
}
```
Replace the Resource placeholders: <regionId> with the region ID of your IDaaS EIAM instance, <accountId> with your Alibaba Cloud account ID, <InstanceId> with your IDaaS EIAM instance ID, and <ApplicationId> with the target M2M client application ID.
Click OK and name the policy, for example, openapi-authentication-policy.

Create and authorize a RAM role

Log on to the RAM console.
In the navigation pane, choose Identities > Roles.
Click Create Role. Set Principal Type to Cloud Service and Principal Name to Function Compute / FC.
Click OK and name the role, for example, openapi-authentication-fc-role.
Find the role and click Actions in the Attach Policy column.
In the Policy field, select openapi-authentication-policy, and click OK.

Attach the RAM role

Log on to the Function Compute console.
In the navigation pane, choose Function Management > Function List.
Find the function and click Actions in the Configure column.
On the Function Details tab, click Modify next to Advanced Settings.
Under Permissions, select the openapi-authentication-fc-role role.
Click Deploy.

To configure function roles for cross-service access, follow Grant Function Compute permissions to access other cloud services by using a function role.