All Products
Search

This Product

    Identity as a Service:Alibaba Cloud MSE cloud-native gateway authentication

    Document Center

    Identity as a Service:Alibaba Cloud MSE cloud-native gateway authentication

    Last Updated:Mar 31, 2026

    Configure an Alibaba Cloud Microservices Engine (MSE) application in Identity as a Service (IDaaS) to enable gateway authentication. Once configured, unauthenticated users who access a protected route in MSE are automatically redirected to the IDaaS login page.

    image.png

    IDaaS includes a pre-integrated MSE application template to simplify setup. Create the MSE application in IDaaS, then complete the authentication configuration in MSE using the OpenID Connect (OIDC) protocol.

    Overview

    MSE is designed for mainstream open source microservice projects. It provides a registry and configuration center with native support for Nacos, ZooKeeper, and Eureka; a cloud-native gateway with native support for Ingress and Envoy; and microservice administration with native support for Spring Cloud, Dubbo, and Sentinel, compliant with OpenSergo service administration specifications.

    This guide covers three stages:

    1. Create an MSE application in IDaaS — register an OIDC client and collect the credentials that MSE requires.

    2. Configure gateway authentication in MSE — enable the authentication mechanism and publish the oauth2-proxy route.

    3. Verify the authentication flow — confirm that protected routes redirect unauthenticated users to IDaaS.

    Prerequisites

    Before you begin, ensure that you have:

    • An MSE cloud-native gateway instance. If you do not have one, create one in the MSE console.

    • Outbound internet access from the virtual private cloud (VPC) where your MSE instance resides. MSE must reach IDaaS to process authentication requests. Without outbound access, MSE may fall back to cached records and cause authentication failures. Use the VPC NAT gateway console to create an Internet NAT gateway if needed.

    • A domain name for the MSE gateway, or a local hosts file mapping. MSE does not accept an IP address as the callback address. If your gateway has no domain name, map its public IP to a local hostname in your hosts file — for example, 47.96.xxx.xxx a.example.com — and use that hostname throughout the setup.

    Step 1. Create an MSE application

    1. Log on to the IDaaS console.IDaaS console

    2. Select an IDaaS instance and click Manage.

      image

    3. In the navigation pane on the left, choose Applications > Add Application > Marketplace. Search for Alibaba Cloud - MSE Cloud-native Gateway and click Add Application.

    4. Confirm the application name. You are redirected to the Sign-In tab.

    5. Fill out the form:

      • Grant Types: Select only the Authorization Code checkbox. Do not select PKCE.

      • Redirect URIs: Enter your MSE gateway endpoint followed by /oauth2/callback. Format: <MSE gateway endpoint>/oauth2/callback Example: if the MSE gateway endpoint is http://a.example.com, enter http://a.example.com/oauth2/callback. > Important: This value must exactly match the Redirect URL you enter later in the MSE authentication configuration. Only domain names are accepted — IP addresses are not allowed.

      • Authorize: Select All Users for now. To grant access to specific accounts, see Application authorization.

    6. Click Save.

    7. Copy the following values — you need them in Step 2:

      ValueWhere to find it
      IssuerApplication configuration information at the bottom of the current page
      client_idGeneral tab of the application management page
      client_secretGeneral tab of the application management page

    The IDaaS configuration is complete. Next, configure authentication in MSE.

    Step 2. Configure gateway authentication in MSE

    Configuration changes may take 3 to 5 minutes to take effect due to caching.

    Open gateway management

    1. Log on to the MSE console.

    2. In the navigation pane on the left, choose Cloud-native Gateway > Gateways.

    3. Click the name of the gateway you want to protect.

    Create a test route (optional)

    To test the full authentication flow end to end, add a mock route before enabling authentication. This gives you a known URL to verify against.

    For setup instructions, see Manage services in MSE Nacos using a cloud-native gateway. After configuration, the /mock path is available for testing.

    If you already have a route, skip this step and use that route's path in the next section instead.

    Configure authentication

    1. In the navigation pane on the left, choose Security > Authentication.

    2. Click Create Authentication and fill out the form. The following table shows an example configuration:

      FieldValueNotes
      Authentication NameAny descriptive name—
      Authentication TypeOIDCThe IDaaS option corresponds to an older version of IDaaS. For the current version, select OIDC.
      IssuerThe Issuer URLCopied from the application configuration information at the bottom of the IDaaS application page (Step 1)
      Redirect URLhttp://a.example.com/oauth2/callback (or your gateway domain)Must exactly match the Redirect URI set in IDaaS. Domain names only — IP addresses are not accepted.
      Client-IDThe client_id valueCopied from the General tab of the IDaaS application management page (Step 1)
      Client-SecretThe client_secret valueCopied from the General tab of the IDaaS application management page (Step 1)
      Cookie-Domaina.example.com (or your gateway domain, without the path)Same domain as the Redirect URL, omitting the /oauth2/callback path
      Scopeopenid—
      AuthorizationSelect Blacklist Mode for testing, then click Add Rule Condition and specify that /mock requires authenticationBlacklist Mode means only explicitly listed paths require authentication. image.png

      image.png

    3. Click Enable after the rule is created.

    Publish the oauth2-proxy route

    When you enable gateway authentication, MSE automatically creates an OIDC callback route named oauth2-proxy. This route starts in the Unpublished state and must be published manually.

    1. In the navigation pane on the left, click Route Configuration.

    2. Find the oauth2-proxy route.

    3. Click Edit, click Next, and then click Save and Publish.

    All configurations are now complete.

    Step 3. Verify the authentication flow

    Access the protected route

    Open http://a.example.com/mock (or the path you configured) in a browser.

    MSE detects that the route requires authentication. If you are not already logged in to IDaaS, you are redirected to the IDaaS login page.

    image.png

    Log in

    Use any authentication method enabled in IDaaS — for example, SMS verification codes, DingTalk QR code scanning, or Active Directory (AD) login. Administrators can also enable multi-factor authentication (MFA) in IDaaS for additional security.

    Confirm success

    After logging in, the browser redirects back to the address you originally requested and displays the expected response. This confirms that the authentication flow is working correctly.

    image.png
    Tip: If the page does not load as expected after logging in, check the following: - The oauth2-proxy route status is Published (not Unpublished). - The Redirect URL in MSE exactly matches the Redirect URI in IDaaS. - The VPC where your MSE instance resides has outbound internet access.