The single sign-on (SSO) process involves interaction between IDaaS and your application, requiring configuration on both sides.
This document uses the SAML 2.0 protocol to illustrate the configuration process.
To learn about the SSO protocols that IDaaS supports, see Standard protocols.
Configure IDaaS
Shortcut: Upload application file
Some applications allow you to download a metadata file from their SSO configuration page and upload it to IDaaS. Others provide a public endpoint that allows IDaaS to pull the configuration metadata.
On the application's SSO configuration page in IDaaS, upload the metadata file or enter the application's public metadata URL. IDaaS automatically retrieves the required SSO information and pre-populates the form. Review the pre-populated values and save to complete the setup.
IDaaS configuration parameters
Parameter | Description | Example | |
Basic settings (Required) | ACS URL | The application's Assertion Consumer Service (ACS) URL. This endpoint receives and processes SAML assertions from IDaaS. | https://signin.example.com/1021*****4813/saml/SSO |
SP Entity ID | The application's unique identifier, which is the service provider (SP) entity ID. This value is typically provided by the application. It is usually a URI. If your application does not require a specific value, you can reuse the ACS URL. | https://signin.example.com/1021*****4813/saml/SSO | |
NameID | In the SAML protocol, NameID represents the user's account within the application. For more information, see SAML application account configuration. | Select: Use IDaaS username | |
Authorization scope | For more information, see Single sign-on overview. | Select: All users | |
Advanced settings (Optional) | Default RelayState | The URL to which the application redirects users after a successful IdP-initiated SSO. This address is passed in the | |
NameID Format | The format of the | Select: 1.1 Unspecified | |
Binding | The | Select: | |
Sign assertion | IDaaS signs all SAML assertions. This setting cannot be modified. | - | |
Signing algorithm | The asymmetric algorithm used to sign the assertion. Currently, only RSA-SHA256 is supported, so you can typically keep the default setting. | Select: RSA-SHA256 | |
Attribute Statements | In the SAML response, you can return additional user attributes, such as email or display name, for the application to parse. For more information, see SAML Attribute Statements value specifications. | - | |
SSO initiator | Specifies whether SSO can be initiated only by the application (SP-initiated SSO) or can also be initiated from the IDaaS portal (IdP-initiated SSO). | Application only | |
Login initiation URL | If SSO initiator is set to allow IdP-initiated SSO, you can specify this URL. When a user starts an SSO flow from the portal, IDaaS redirects them to this URL. The application at this URL must then automatically trigger a SAML request to IDaaS. | - |
Configure the application
Shortcut: Upload IDaaS file
To simplify application configuration, IDaaS provides its configuration metadata for one-click download.
On the Application Configuration Information page, click the Download link next to IdP Metadata to download the SAML metadata configuration file from IDaaS.
Some applications support metadata import for SSO configuration. You can upload the IDaaS configuration file or enter the metadata URL in your application to complete the integration automatically.
Application configuration parameters
To complete the integration, you must configure your application with information from IDaaS.
The following table describes the IDaaS parameters required for your application's configuration.
Parameter | Description | Example |
IdP Entity ID | The identifier for IDaaS within your application. You may need to enter this value in your application's SSO configuration to identify IDaaS as the identity provider (IdP). | https://xxxxx.aliyunidaas.com |
IdP Sign-in URL | For an SP-initiated SSO, your application uses this URL to redirect users to IDaaS for authentication. | https://xxxxx.aliyunidaas.com.cn/saml/idp/saml1 |
SLO URL | The endpoint for single logout (SLO). This feature is not currently supported by IDaaS. | - |
Public key certificate | IDaaS digitally signs the SAML assertions it sends to your application. Your application uses this public key certificate to verify the signature, ensuring the assertion is authentic and originated from IDaaS. | -----BEGIN CERTIFICATE----- MIIDEjCCAfqgAwIBAgIHAYnNmX60izANBgkqhkiG9w0BAQsFADApMRowGAYDVQQD..... |