The single sign-on (SSO) process requires interaction between IDaaS and your application, so you must configure both sides.
This topic uses the standard SAML 2.0 protocol as an example to describe the configuration procedure.
To learn about the SSO protocols that IDaaS supports, see Standard protocols.
Configure IDaaS
Shortcut: Upload an application configuration file
On the SSO configuration page, some applications let you download the metadata configuration file with one click and upload it to IDaaS. Other applications provide a public endpoint from which IDaaS can pull the configuration.
On the SSO configuration page of the application in IDaaS, an administrator can upload a metadata file or enter the public address of the application in the metadata URL field. IDaaS then retrieves all the information required to configure SSO and prefills the form. No manual configuration is required. Confirm the values and save to complete the setup.
IDaaS configuration parameters
| Parameter | Description | Example |
Basic settings (required) | Single sign-on URL ACS URL | The core SAML SSO endpoint of the application, which interacts with IDaaS to process single sign-on requests. | https://signin.example.com/1021*****4813/saml/SSO |
Application unique identifier SP Entity ID | The identifier of the application in IDaaS. You usually get this value from the application, and it is typically in the format of an application URI. If the application has no specific requirement, reuse the single sign-on URL. | https://signin.example.com/1021*****4813/saml/SSO | |
Application account | In the SAML protocol, the application account is called NameID. For more information, see Configure SAML accounts. | Select: Use IDaaS account name (Username) | |
Authorization scope | For more information, see Common single sign-on instructions. | Select: All users can access | |
Advanced settings (optional) | Default redirect URL Default RelayState | The address to which the application automatically redirects users after a successful IdP-initiated SSO login. In the SAML response, this address is passed in the | |
NameID format (NameIDFormat) | The format of the account identifier | Select: 1.1 Unspecified | |
Binding format Binding |
| Select: | |
Whether to sign the assertion Sign Assertion | IDaaS signs all SAML requests. This setting cannot be modified. | - | |
Signature algorithm Signing Algorithm | The asymmetric algorithm used for signing. Only RSA-SHA256 is supported, so you usually do not need to modify this parameter. | Select: RSA-SHA256 | |
Assertion attributes Attribute Statements | In the SAML response, you can return additional user fields, such as email address and display name, for the application to parse. For more information, see Specifications for SAML attribute statement values. | - | |
SSO initiator | Specifies whether user access is initiated only by the application, or whether the portal can also initiate it. | Only the application can initiate | |
Login initiation URL | If SSO initiator is set to support initiation from both the portal and the application, you can specify the login initiation URL. When a user accesses the application from the portal page, IDaaS redirects the user to this URL. The application must then immediately send a SAMLRequest login request to IDaaS. | - | |
Signature Verification Certificate | After you click Show Advanced Settings, you can configure this optional parameter. Upload or paste a public key certificate in PEM format to verify digital signatures. You can add up to two certificates. The certificate content must contain | -----BEGIN CERTIFICATE----- ... -----END CERTIFICATE----- | |
Logout Redirect URIs | After you click Show Advanced Settings, you can configure this optional parameter to specify the allowlisted application URL to which users are redirected after they log out of IDaaS. Parsing the application metadata can populate this field automatically. If the address is not empty, it must be a valid URL. If the host is not |
Configure the application
Shortcut: Upload an IDaaS configuration file
To simplify configuration on the application side, IDaaS lets you download its configuration information with one click.
On the Application Configuration Information page, to the right of IdP Metadata, click the Download link to download the SAML metadata configuration file of IDaaS.
When configuring SSO, some applications support metadata import. You can upload the IDaaS configuration file or enter the metadata address on the application side. The integration is then complete without manual configuration.
Application configuration parameters
To complete the integration, you must configure your application with information from IDaaS.
On the single sign-on configuration page, IDaaS lists all the information that the application may need in one place. The following table describes each parameter.
Parameter | Description | Example |
IdP unique identifier IDP Entity ID | The identifier of IDaaS in the application. You may need to enter this value in the SSO configuration of the application. | https://xxxxx.aliyunidaas.com |
IdP SSO URL IDP-init SSO URL | The SAML protocol supports SP-initiated single sign-on. You may need to enter this address in the application configuration. | https://xxxxx.aliyunidaas.com.cn/saml/idp/saml1 |
IdP SLO URL SLO URL | Only custom SAML 2.0 applications created with the standard protocol support single logout. In the Application Settings section, copy IdP SLO URL, and enter it in the SAML single logout configuration of the application. For SAML applications created from an application template, this feature is Not Supported. | |
Public key certificate Certificate | The single sign-on result that IDaaS sends automatically carries a digital signature. The application can use this public key to verify the signature and confirm that the result is authentic and came from IDaaS. | -----BEGIN CERTIFICATE----- MIIDEjCCAfqgAwIBAgIHAYnNmX60izANBgkqhkiG9w0BAQsFADApMRowGAYDVQQD..... |