Identity as a Service:Network access endpoints

Introduction

A network access endpoint provides network connectivity for an IDaaS EIAM instance. Endpoints are categorized into Dedicated Network Access Endpoint and Shared Network Access Endpoint. A Dedicated Network Access Endpoint must be purchased before use (Billing for dedicated network access endpoints), while a Shared Network Access Endpoint is free of charge.

Add a dedicated endpoint

On the Network Access Endpoint tab, perform the following steps:

1. Create a service-linked role (SLR)

   When you access the Network Access Endpoint page or click Add Dedicated Endpoint, if a service-linked role does not exist, you must create an IDaaS EIAM service-linked role. Only an Alibaba Cloud account or a RAM user that has the AliyunIDaaSEiamFullAccess permission can perform this operation.

   In the dialog box that appears, confirm that the role name is AliyunServiceRoleForEiam and the authorization policy is AliyunServiceRolePolicyForEiam, and then click Confirm Create.

2. Upgrade or scale up the instance

   You can create a Dedicated Network Access Endpoint only if the number of existing Dedicated Network Access Endpoint for your instance is less than Dedicated Network Access Endpoint quota. The quota for Dedicated Network Access Endpoint must be purchased separately.

   1. For a free or trial instance, upgrade the instance and purchase a quota for Dedicated Network Access Endpoint on the buy page.

   2. For an enterprise instance, scale up the instance and purchase a quota for Dedicated Network Access Endpoint on the buy page.

   Note

   Each IDaaS EIAM instance supports a maximum of one Dedicated Network Access Endpoint.

3. Select resources

   1. Click Add Dedicated Endpoint and configure the following parameters.

      • Display Name: The display name of the Dedicated Network Access Endpoint. This name is shown only in the console.

      • Select Region: The region where the VPC that you want to connect to is located.

      • Select VPC: The VPC in the selected region. If you require private network access to services such as AD, LDAP, or applications, select the VPC where these services reside or a VPC from which these services can be accessed.

      • Select vSwitch: A vSwitch in the selected VPC. The vSwitch must have more than two available IP addresses and cannot use the CIDR block 100.64.0.0/10. You can select up to two vSwitches.

      Important

      • After you add a Dedicated Network Access Endpoint, you cannot modify its region, VPC, or vSwitch. Verify your settings before you proceed.

      • We strongly recommend selecting two vSwitches in different availability zones to enhance fault tolerance.

   2. After you confirm the settings, click Confirm to start adding the Dedicated Network Access Endpoint.

      After the endpoint is created, you must complete the following configurations before you can use the Dedicated Network Access Endpoint:

      1. To enable dedicated private network access, see Authorize private network access.

      2. To enable dedicated public network access, see Configure a dedicated public egress IP address.

Authorize private network access

1. On the Network Access Endpoint tab, find the target Dedicated Network Access Endpoint and click Authorize Private Network Access in the Actions column.

2. Obtain the access rule. In the Authorize Private Network Access dialog box, copy the Authorization Object. The Authorization Object is a collection of all dedicated private egress IP addresses for the current Dedicated Network Access Endpoint.

3. Configure a security group access rule. Click Add to go to the Elastic Compute Service (ECS) > Security Group page. On this page, select the security group that contains the service requiring private network access.

   Note

   For AD, select your security group that contains the AD domain server, not the security group created by IDaaS EIAM. For information about supported configurations for different network topologies, see Dedicated private network access.

   1. Click the Security Group ID/Name to go to the Add. On the Security Group Details > Inbound tab, click Manually Add.

   2. In the new access rule, configure the following parameters and save the rule:

      • Action: Allow.

      • Priority: 1.

      • Protocol Type: Custom TCP.

      • Port Range: Enter the port range for your service. For AD or LDAP, use port 389 or 636.

      • Authorization Object: The dedicated private egress IP addresses that you copied in the previous step.

Configure a dedicated public egress IP

Configure an internet NAT gateway to enable your IDaaS EIAM instance to access the internet through a public IP address that you own. You can add this public IP address to the list of trusted IPs in WeCom to meet its verification requirements.

1. View the VPC region

   On the Network Access Endpoint tab, find the target Dedicated Network Access Endpoint and view its VPC Region.

2. Associate an elastic IP address

   1. Go to the VPC - Internet NAT Gateway console. In the same region as your VPC, select an internet NAT gateway and click Associate Now to start associating an EIP.

      If no internet NAT gateway is available, create one first. For more information, see Create an internet NAT gateway.

   2. You can select an existing EIP, or purchase and associate a new one.

   3. After the association is successful, go to the Internet NAT Gateway page and click the Instance ID/Name.

      If no SNAT entry exists for your instance, you must create one to enable public network access for the dedicated network access endpoint. For more information, see Create and manage SNAT entries.

      Warning

      If no SNAT entry is configured, the dedicated network access endpoint cannot access the internet.

3. On the Network Access Endpoint tab, click View in the Dedicated Outbound Public IP Address column to see the public IP address that is used by the Dedicated Network Access Endpoint.

Switch to a dedicated endpoint

1. Go to the IdPs page. Find the target IdPs, for example, an AD identity provider, and click Modify in the Actions column to edit its basic settings.

2. Configure the Dedicated Network Access Endpoint. In the Network Configurations > Network Access Endpoint section:

   1. Select the Dedicated Network Access Endpoint type.

   2. From the drop-down list, select an endpoint that has an associated Dedicated Outbound Public IP Address. The IP address can be from an ENI or an internet NAT gateway.

3. Submission validation. After you click Confirm, the system immediately performs validation:

   1. Verification requirement: All associated ENIs (up to two) must be able to successfully access the AD service.

   2. If verification passes: The system automatically switches to the Dedicated Network Access Endpoint.

   3. If verification fails: An error message is displayed. Check the network connectivity.

To view the gateway IP in use, click View for the dedicated public egress IP.

Modify a Dedicated Network Access Endpoint

You can modify only the Display Name of a Dedicated Network Access Endpoint. To modify other settings, you must delete the endpoint and create a new one.