Identity as a Service:AK-free access configuration process (with Alibaba Cloud RAM)

Create an OIDC identity provider

1. Log on to the RAM console as a RAM administrator.

2. In the left-side navigation pane, choose Integrations > SSO.

3. On the Role-based SSO tab, click the OIDC tab, and then click Create IdP.

4. On the Create IdP page, configure the parameters for the identity provider.

   Parameter	Description
   Identity Provider Name	The name must be unique within your Alibaba Cloud account and comply with RAM naming conventions. It is not associated with IDaaS.
   Issuer URL	The issuer URL is a unique identifier that the external identity provider (IdP) assigns to the M2M application. Protocols such as OAuth 2.0 use this URL to verify the source of tokens. Alibaba Cloud IDaaS uses this URL to validate tokens from the external IdP. This URL corresponds to the Issuer field for the M2M client application in IDaaS.
   Fingerprint	After you enter the Issuer URL, you can click Get Fingerprint. Alibaba Cloud automatically calculates the fingerprint by accessing the issuer URL. We recommend that you also calculate the fingerprint on your on-premises device (for example, by using OpenSSL) and compare it with the fingerprint calculated by Alibaba Cloud. If the fingerprints do not match, the issuer URL may be compromised. You must verify the issuer URL and enter a correct fingerprint. Note If you plan to rotate your IdP certificate, add the new certificate's fingerprint to your OIDC identity provider configuration in Alibaba Cloud before the rotation. Wait at least one day before rotating the certificate. After confirming that you can obtain STS credentials using the new certificate, you can delete the old fingerprint.
   Client ID	This unique identifier is generated for your application when you register it with an external IdP. The IdP must include this client ID in the aud claim of the OIDC token. To ensure secure role assumption, RAM verifies that the aud claim in the token matches this client ID when you request STS credentials. A single OIDC identity provider supports a maximum of 50 client IDs. This is suitable for scenarios where multiple applications need to access Alibaba Cloud resources. In machine-to-machine (M2M) application scenarios, the client ID corresponds to the ResourceServer Identifier configured in the IDaaS M2M application for server-to-server authentication.
   Earliest Issuance Time Limit	RAM rejects OIDC tokens issued before this time. Default: 12 hours. Valid range: 1 to 168 hours.
   Description	The description of the identity provider.

5. Click Create IdP.

Use a curl command

• Replace the following placeholder parameters with your application's configuration and run the curl command to obtain the token.

  # <YOUR_SERVER_ISSUER_ENDPOINT>: The issuer. Find the endpoint in the "Resource Server application > General configuration > Issuer" and replace the placeholder.
  # <YOUR_APP_CLIENT_ID>: The client ID. Find the client_id in "Client application > General configuration > Credential management" and replace the placeholder.
  # <YOUR_APP_CLIENT_SECRET>: The client secret. Find the client_secret in "Client application > General configuration > Credential management" and replace the placeholder.
  # <YOUR_SERVER_AUD_IDENTIFIER>: The server-side audience identifier. Find the audience identifier in "Resource Server application > Server-side permission grant > Permission application > Audience Identifier" and replace the placeholder.
  #
  curl --location --request POST 'https://<YOUR_SERVER_ISSUER_ENDPOINT>.aliyunidaas.com/api/v2/iauths_system/oauth2/token' \
       --header 'Content-Type: application/x-www-form-urlencoded' \
       --data-urlencode 'client_id=<YOUR_APP_CLIENT_ID>' \
       --data-urlencode 'client_secret=<YOUR_APP_CLIENT_SECRET>' \
       --data-urlencode 'grant_type=client_credentials' \
       # .all is a predefined scope identifier in Alibaba Cloud IDaaS. It requests all available permissions under the specified audience.
       --data-urlencode 'scope=<YOUR_SERVER_AUD_IDENTIFIER>|.all'

• A successful request returns a response similar to the following:

  xxx ~ % curl --location --request POST 'https://xxx.aliyunidaas.com/api/v2/iauths_system/oauth2/token' \
      --header 'Content-Type: application/x-www-form-urlencoded' \
      --data-urlencode 'client_id=app_xxx4y54' \
      --data-urlencode 'client_secret=CSHoxxx5ZQ6' \
      --data-urlencode 'grant_type=client_credentials' \
      --data-urlencode 'scope=xxx.all'
  {
      "token_type": "Bearer",
      "access_token": "eyJrxxxi5rg",
      "expires_in": 3600,
      "expires_at": 1741336113
  }

Use Postman

• Replace the parameters with your application configuration values and send a request in Postman to obtain the token.

  Send a POST request to https://<IDaaS instance domain>.aliyunidaas.com/api/v2/iauths_system/oauth2/token. In the request body, select x-www-form-urlencoded and include the following parameters: client_id, client_secret, grant_type (with the value client_credentials), and scope. A successful request (200 OK) returns a JSON response in the following format:

  {
    "token_type": "Bearer",
    "access_token": "eyJrxxx...xxxDiCw",
    "expires_in": 3600,
    "expires_at": 1741331524
  }

  The access_token value is the Bearer token, which is valid for 3,600 seconds.

Use OpenAPI Explorer

• Go to OpenAPI Explorer and find the AssumeRoleWithOIDC operation.

  Note

  This topic provides a demonstration. For complete details about the AssumeRoleWithOIDC operation, see AssumeRoleWithOIDC - Obtain temporary identity credentials to assume a role for OIDC role-based SSO.

• Enter the required parameters and click Initiate Call to obtain the STS credentials.

  Important

  • OIDCProviderArn: Go to the Basic Information page of the OIDC identity provider role. Obtain the value from the Trust Policy.

  • RoleArn: Go to the Basic Information page of the OIDC identity provider role and copy the ARN.

  • OIDCToken: Enter the M2M token.

  • RoleSessionName: A custom string to identify the role session.