All Products
Search

This Product

    Identity as a Service:Log on to third-party applications by using AD/LDAP authentication

    Document Center

    Identity as a Service:Log on to third-party applications by using AD/LDAP authentication

    Last Updated:Oct 22, 2026

    This topic describes how to use IDaaS to log on to third-party applications with AD domain accounts.

    Scenario

    IDaaS provides AD domain data synchronization and delegated authentication capabilities. You can quickly use AD/LDAP authentication to log on to hundreds of applications.

    First, synchronize AD accounts to IDaaS. Then, connect the applications for which you want to enable single sign-on to IDaaS. After these two steps are complete, your enterprise can use AD domain accounts to log on to third-party applications.

    Note

    The scenario described in this topic uses Alibaba Cloud Single Sign-On for Users as the third-party application. All IDaaS capabilities used in this scenario are free of charge.

    In practice, whether a feature is free of charge depends on whether the third-party application that you connect uses a free template. For more information, see Features of each edition.

    Procedure

    Step 1: Activate an IDaaS instance

    Before you start to configure applications, you must create an IDaaS instance. For more information, see Activate a free instance.

    Step 2: Synchronize AD data to IDaaS

    You can use AD or OpenLDAP account authentication to log on. Before you can use this authentication method, you must pull the accounts into IDaaS. This topic uses AD as an example. When you set up the integration, select the directory that suits your enterprise:

    Synchronize AD accounts to IDaaS: Connect to AD.

    Synchronize OpenLDAP accounts to IDaaS: Connect to OpenLDAP.

    Important

    Make sure that the delegated authentication feature is enabled.

    After the synchronization is complete, you can view the synchronized accounts on the Accounts page.

    ​

    Step 3: Create an IDaaS application

    Create an IDaaS application and configure single sign-on. This topic uses Alibaba Cloud Single Sign-On for Users as an example.

    For more information about how to configure and use Alibaba Cloud Single Sign-On for Users, see Alibaba Cloud user SSO.

    Note

    When you bind a Resource Access Management (RAM) user, use the AD account that is imported into IDaaS as the IDaaS account name. Use the prefix of the Alibaba Cloud RAM user as the application account.

    Step 4: Authorize the IDaaS application

    Authorize the accounts that need to access the IDaaS application. You can set the application to be accessible to all users in Single Sign-On, or grant access by account or organization in Authorize. Only accounts that have the required permissions can access the application.

    When you integrate a Security Assertion Markup Language (SAML) application such as Alibaba Cloud RAM, you can specify the application account in Single Sign-On. IDaaS passes the IDaaS account name of the user or the specified application account name to the application. The application uses that name to find the corresponding account and complete the logon. If existing accounts are already in use, make sure that they correspond to the IDaaS accounts. If they cannot be mapped, create the accounts in the application in advance. For more information, see Common single sign-on instructions.

    Step 5: Configure the logon method

    1. In the IDaaS console, click Sign-In.

    2. Enable AD delegated authentication.

    3. (Optional) Set the priority logon method.

      If you want to use AD accounts to log on by default, set the priority logon method to the AD account logon method.

    Step 6: Initiate single sign-on

    SP-initiated

    1. Go to the RAM user logon page, enter the username of the RAM user, and then click Next.

    2. Click Log On with Enterprise Account to go to the IDaaS logon page.

    3. If you have configured AD as the priority logon method, the page for entering your AD username and password is displayed directly. If you have not configured it, manually switch to the authentication source that corresponds to AD.

    IdP-initiated

    1. Go to the IDaaS user portal.

    2. If you have configured AD as the priority logon method, the page for entering your AD username and password is displayed directly. If you have not configured it, manually switch to the authentication source that corresponds to AD.

    3. Log on to the IDaaS application portal and click the icon of the application that you want to access.