This topic explains how to configure SAML, which allows users to sign in to Alibaba Cloud Drive for Team with third-party accounts through the SAML protocol. While this guide focuses on Microsoft Azure AD, the process is similar for other identity providers.
1. Get SP metadata from PDS
-
Go to admin console > exclusive logon configuration > SAML configuration.
-
Enable SAML configuration.
-
Download the service provider (SP) metadata file.
The service provider (SP) metadata file contains PDS's information as a SAML service provider. You will need this file to configure Microsoft Azure AD.
2. Get IdP metadata from Azure AD
Step 1: Create an Azure AD application
-
Sign in to the Microsoft Azure AD portal and click View.
-
In the left navigation pane, select enterprise applications > all applications.
-
Click new application.
-
On the Browse Azure AD Gallery page, click Create your own application.
-
On the Create your own application page, enter an application name (for example, PdsSamlDemo), select Integrate any other application you don't find in the gallery (Non-gallery), and then click Create.
Step 2: Configure SAML in Azure AD
-
On the PdsSamlDemo page, click Set up single sign-on.
-
On the Select a single sign-on method page, click SAML.
-
On the Set up single sign-on with SAML page, configure the following settings.
-
In the upper-left corner, click Upload metadata file, select the file, and then click Add.
Upload the SP metadata XML file that you downloaded from the SAML configuration page in PDS.
-
In the basic SAML configuration section, verify the following information and click Save.
-
identifier (entity ID): Azure AD automatically reads the entityID value from the metadata file.
-
reply URL (Assertion Consumer Service URL): Azure AD automatically reads the Location value from the metadata file.
-
-
In the SAML signing certificate section, click Download to obtain the Federation Metadata XML.
This Federation Metadata XML file is the metadata for the identity provider (IdP). You will need it to configure PDS.
Step 3: Assign users in Azure AD
-
On the PdsSamlDemo page, click assign users and groups.
-
In the upper-left corner, click Add user/group.
-
Click Users, select a user from the list, and then click Select.
-
In the lower-left corner, click Assign.
3. Configure the IdP metadata in PDS
-
Go to admin console > exclusive logon configuration > SAML configuration.
-
Click Configure and upload the IdP metadata XML file.
The IdP metadata file to upload is the Federation Metadata XML file you downloaded from Azure AD.
-
After the upload succeeds, the login settings status changes to Configured, which completes the setup.