Identity as a Service:Custom domain names

Step 1: Add a domain name

Add a domain name on the Domain Names page of the Alibaba Cloud DCDN console.

• Accelerated Domain Name: Your custom domain name.

• Origin Info:

  • Set Origin Type to Origin Domain Name.

  • Enter the domain name from the origin information on the proxy configuration page. This is the initialization domain name of your IDaaS EIAM instance. Do not include the https:// protocol header.

  • Set Port to 443.

After you add the domain name, copy the CNAME record provided by DCDN. Then, add this CNAME record to your domain's DNS settings. For more information, see Configure a CNAME record.

Step 2: Configure an HTTPS certificate

In the Alibaba Cloud DCDN console, from the Domain Names page, navigate to the Domain Details Page. On the SSL Certificate tab, configure an HTTPS certificate. For more information, see Configure an HTTPS certificate.

Step 3: Enable back-to-origin HOST

On the domain details page, on the Origin Fetch tab, enable Origin HOST.

Set Domain Name Type to Origin Domain Name. The initialization domain name of the IDaaS EIAM instance is automatically selected.

Step 4: Add a back-to-origin HTTP header

On the domain details page, on the Origin Fetch tab, click Custom Request Header. Add the IP, Host, Token, and other information provided by IDaaS EIAM. This information helps prevent IP address spoofing and improves access security.

After the configuration is complete, you can use the Test Connectivity feature in the IDaaS EIAM console to simulate access to your custom domain name. Note that you can set access policies for the domain itself, such as allowing access only from specific IP addresses. Therefore, the test results from IDaaS EIAM are for reference only. You must test the setup in a simulated user environment.

After the test is successful, confirm and adjust the relevant configurations based on the affected features. Then, roll out the custom domain name to your users. If you expect users to continue accessing the initialization domain name, enable automatic redirection.

Step 1: Install a self-managed Nginx service

# Download the installation package
wget http://nginx.org/download/nginx-1.18.0.tar.gz

# Decompress the package
tar -zxvf nginx-1.18.0.tar.gz
cd nginx-1.18.0

# Configure: Specify the Nginx installation directory
./configure --prefix=/usr/local/nginx 

# Compile and install
make && make install

# After installation, verify that it was successful
cd /usr/local/nginx/sbin
./nginx -t 

# Install the EPEL repository (required for some systems)
sudo yum install epel-release -y

# Install Nginx
sudo yum install nginx -y

# Start the Nginx service
sudo systemctl start nginx

# Enable Nginx to start on boot
sudo systemctl enable nginx

# Check the service status
sudo systemctl status nginx

# Update the package list
sudo apt update

# Install Nginx
sudo apt install nginx -y

# Start the Nginx service
sudo systemctl start nginx

# Enable Nginx to start on boot
sudo systemctl enable nginx

# Check the service status
sudo systemctl status nginx

Step 2: Modify the Nginx configuration file

1. View the path of the Nginx configuration file.

   nginx -t

2. Configure the domain proxy.

   1. Modify the server node under the http node in the nginx.conf configuration file.

   2. Modify the reverse proxy configuration to forward requests from the custom domain name, such as www.example.com, to the IDaaS EIAM initialization domain name *****.aliyunidaas.com.

      server {
          # Listen on the HTTPS port and enable SSL
          listen 443 ssl;
      
          # Domain configuration (the domain to be forwarded, which is the user's custom domain name)
          server_name www.example.com;
      
          location / {
              # Reverse proxy target address (the configured IDaaS user portal domain address)
              proxy_pass https://*****.aliyunidaas.com;
              
          }
      }
      

3. Configure HTTP to HTTPS redirection.

   This automatically redirects HTTP access to your custom domain name to HTTPS, which improves security and search engine optimization (SEO).

   # HTTP server block (listens on port 80)
   server {
       listen 80;
       server_name www.example.com;
   
       # Configure redirection of HTTP requests to HTTPS
       location / {
           return 301 https://$host$request_uri;
       }
   }

4. Configure an SSL certificate.

   1. Prepare the certificate file and upload it to the Nginx server.

   2. Modify the Nginx configuration file.

      server {
          # HTTPS server block (listens on port 443)
          listen 443 ssl;
          server_name www.example.com;
      
          # SSL certificate path (replace with the actual path)
          ssl_certificate      /usr/local/nginx/ssl/www.example.com.crt;
          ssl_certificate_key /usr/local/nginx/ssl/www.example.com.key;
      
          # SSL configuration (optional optimization)
          ssl_protocols TLSv1.2 TLSv1.3;
          ssl_ciphers HIGH:!aNULL:!MD5;
      
      }
      

5. Configure IDaaS EIAM back-to-origin request headers.

   

   1. Modify the server node under the http node in the nginx.conf configuration file.

   2. Use proxy_set_header to set the back-to-origin request headers.

          # Configure IDaaS back-to-origin request headers
          location / {
              proxy_pass http://***.aliyunidaas.com;
             
              # Pass the client's real IP address
              proxy_set_header X-IDaas-Client-IP $remote_addr;
      
              # Pass the host header (confirm the Host value expected by the target service)
              proxy_set_header X-IDaas-Host eiam-idaas.idpsso.net;
      
              # Proxy authentication token (must be consistent with the IDaaS server-side configuration)
              proxy_set_header X-IDaas-Proxy-Token PTC*****************************6j;
      
              # Preserve the original Host header (optional)
              proxy_set_header Host $host;
              
              
          }

Step 3: Restart the Nginx service

sudo /usr/local/nginx/sbin/nginx -s reload

sudo service nginx restart

sudo systemctl restart nginx