Identity as a Service:Custom domains

Step 1: Add an ESA site

Step 2: Add a DNS record (proxy acceleration)

1. In the navigation bar, click Websites and click the target site.

2. Choose DNS > Records and click Add Record.

For more information, see Manually add DNS records.

Step 3: Configure an HTTPS certificate

1. In the navigation bar, click Websites and click the target site.

2. Choose Edge Certificates and click Upload Custom Certificate.

For more information, see Configure edge certificates.

Step 4: Configure the back-to-origin host

1. In the navigation bar, click Websites and click the target site.

2. Choose Rules > Origin Rules and click Create Rule.

For more information, see Customize the origin Host.

Step 5: Configure back-to-origin request headers

1. In the navigation bar, click Websites and click the target site.

2. Choose Rules > Transform Rules. On the Modify request header tab, select the Apply to, click Modify Request Header, select the applicable resource Type and Operation, and enter the Request Header Name and Enter a request header value.

   1. First record: Type: Static; Action: Add; Header Name: X-IDaaS-Host; Header Value: $remote_addr.

   2. Second record: Type: Static; Action: Add; Header Name: X-IDaaS-Proxy-Token; Header Value: Custom domain name.

   3. Third record: Type: Dynamic; Action: Add; Header Name: X-IDaaS_Client-IP; Header Value: proxy_token from the proxy configuration.

   To find the required values, go to the IDaaS EIAM console, click Branding > Custom Domain Name in the left-side navigation pane, find the custom domain, and click Actions to open the Proxy Configuration tab.

   

For more information, see Modify outgoing request headers.

Step 1: Add a domain

Add a domain on the Domain Names page in the Alibaba Cloud DCDN console.

• Accelerated Domain Name: Your custom domain.

• Origin Info:

  • Set Origin Type to Origin Domain.

  • Enter the initial domain of your IDaaS EIAM instance (without the https:// prefix).

  • Select port 443.

After adding the domain, copy the CNAME record from DCDN and add it to your DNS provider's settings. For more information, see Configure a CNAME record.

Step 2: Configure an HTTPS certificate

In the Alibaba Cloud DCDN console, go to the Domain Names page, open the domain details page, and configure an HTTPS certificate in the HTTPS settings. For more information, see Configure an HTTPS certificate.

Step 3: Enable back-to-origin HOST

Still on the domain details page, go to the Back-to-origin Configuration settings and enable Origin Host.

Set Domain Type to Origin Domain. This automatically selects the initial domain of the IDaaS EIAM instance.

Step 4: Add back-to-origin HTTP headers

Still on the domain details page, go to the Back-to-origin Configuration settings and click Custom Back-to-Origin HTTPS Header to add the IP, Host, and Token information. These headers help prevent IP address spoofing and improve access security.

Step 1: Install Nginx

# Download the installation package
wget http://nginx.org/download/nginx-1.18.0.tar.gz

# Unpack the archive
tar -zxvf nginx-1.18.0.tar.gz
cd nginx-1.18.0

# Configure and specify the Nginx installation directory
./configure --prefix=/usr/local/nginx

# Compile and install
make && make install

# Verify the installation
cd /usr/local/nginx/sbin
./nginx -t 

# Install the EPEL repository (required for some systems)
sudo yum install epel-release -y

# Install Nginx
sudo yum install nginx -y

# Start the Nginx service
sudo systemctl start nginx

# Enable auto-start on boot
sudo systemctl enable nginx

# Check the service status
sudo systemctl status nginx

# Update the package list
sudo apt update

# Install Nginx
sudo apt install nginx -y

# Start the Nginx service
sudo systemctl start nginx

# Enable auto-start on boot
sudo systemctl enable nginx

# Check the service status
sudo systemctl status nginx

Step 2: Modify the Nginx configuration

1. Find the Nginx configuration file path.

   nginx -t

2. Configure the domain proxy.

   1. Edit the server block within the http block of the nginx.conf file.

   2. Configure the reverse proxy to forward requests from your custom domain, such as www.example.com, to the IDaaS domain *****.aliyunidaas.com.

      server {
          # Listen on the HTTPS port and enable SSL
          listen 443 ssl;
      
          # Configure the domain to forward (your custom domain)
          server_name www.example.com;
      
          location / {
              # Reverse proxy target (the IDaaS instance domain)
              proxy_pass https://*****.aliyunidaas.com;
      
          }
      }
      

3. Redirect HTTP to HTTPS.

   Redirect HTTP traffic for your custom domain to HTTPS to improve security and SEO.

   # HTTP server block (listens on port 80)
   server {
       listen 80;
       server_name www.example.com;
   
       # Redirect HTTP requests to HTTPS
       location / {
           return 301 https://$host$request_uri;
       }
   }

4. Configure the SSL certificate.

   1. Prepare your certificate files and upload them to the Nginx server.

   2. Edit the Nginx configuration file.

      server {
          # HTTPS server block (listens on port 443)
          listen 443 ssl;
          server_name www.example.com;
      
          # SSL certificate paths (replace with your actual paths)
          ssl_certificate      /usr/local/nginx/ssl/www.example.com.crt;
          ssl_certificate_key /usr/local/nginx/ssl/www.example.com.key;
      
          # SSL configuration (optional optimization)
          ssl_protocols TLSv1.2 TLSv1.3;
          ssl_ciphers HIGH:!aNULL:!MD5;
      
      }
      

5. Configure IDaaS back-to-origin request headers.

   

   1. Edit the server block within the http block of the nginx.conf file.

   2. Set the back-to-origin request headers using proxy_set_header.

          # Configure IDaaS back-to-origin request headers
          location / {
              proxy_pass https://***.aliyunidaas.com;
      
              # Pass the client's real IP address
              proxy_set_header X-IDaas-Client-IP $remote_addr;
      
              # Pass the host header (confirm the host value expected by the target service)
              proxy_set_header X-IDaas-Host eiam-idaas.idpsso.net;
      
              # Proxy authentication token (obtain the proxy token from the IDaaS console)
              proxy_set_header X-IDaas-Proxy-Token PTC<your-proxy-token>;
      
              # Preserve the original Host header (optional)
              proxy_set_header Host $host;
      
      
          }

Step 3: Restart Nginx

sudo /usr/local/nginx/sbin/nginx -s reload

sudo service nginx restart

sudo systemctl restart nginx