All Products
Search

This Product

    Resource Access Management:AssumeRoleWithSAML

    Document Center

    Resource Access Management:AssumeRoleWithSAML

    Last Updated:Oct 26, 2026

    Obtains the temporary identity credentials (STS token) to assume a RAM role during SAML role-based SSO by calling the AssumeRoleWithSAML operation.

    Operation description

    Before you begin

    Try it now

    Try this API in OpenAPI Explorer, no manual signing needed. Successful calls auto-generate SDK code matching your parameters. Download it with built-in credential security for local usage.

    Test

    RAM authorization

    No authorization for this operation. If you encounter issues with this operation, contact technical support.

    Request parameters

    Parameter

    Type

    Required

    Description

    Example
    SAMLProviderArn

    string

    No

    The ARN of the SAML IdP created in RAM.

    Format: acs:ram::<account_id>:saml-provider/<saml_provider_id>.

    You can view the ARN of the IdP in the Resource Access Management (RAM) console or by calling API operations:

    acs:ram::123456789012****:saml-provider/company1
    RoleArn

    string

    No

    The ARN of the RAM role to assume.

    The trusted entity of this role is a SAML IdP. For more information, see Create a RAM role for a trusted IdP or CreateRole.

    Format: acs:ram::<account_id>:role/<role_name>.

    You can view the ARN of the role in the Resource Access Management (RAM) console or by calling API operations:

    acs:ram::123456789012****:role/adminrole
    SAMLAssertion

    string

    No

    The Base64-encoded SAML assertion.

    The assertion must be 4 to 100,000 characters in length.

    Note

    You must obtain the complete SAML response from the IdP. A separate SAML assertion field is not supported.

    base64_encoded_saml_assertion
    Policy

    string

    No

    An additional access policy that is attached to the STS token to further restrict the permissions of the STS token. Rules:

    • If this policy is specified, the final permissions of the STS token are the intersection of the permissions granted by the RAM role policy and this policy.

    • If this policy is not specified, the final permissions of the STS token are the permissions granted by the RAM role.

    The policy must be 1 to 2,048 characters in length.

    url_encoded_policy
    DurationSeconds

    integer

    No

    The validity period of the STS token. Unit: seconds.

    The minimum validity period is 900 seconds, and the maximum validity period is the value of MaxSessionDuration. The default value is 3,600 seconds.

    You can call the CreateRole or UpdateRole operation to set the maximum session duration (MaxSessionDuration) for the role. For more information, see CreateRole or UpdateRole.

    3600
    Note

    Because the AssumeRoleWithSAML operation uses SAML assertions for authentication and supports anonymous access, you do not need to provide the Signature, SignatureMethod, SignatureVersion, and AccessKeyId common request parameters. For more information about common request parameters, see Common request parameters.

    Response elements

    Element

    Type

    Description

    Example

    object

    The response elements.

    RequestId

    string

    The request ID.

    6894B13B-6D71-4EF5-88FA-F32781734A7F
    SAMLAssertionInfo

    object

    The partial information in the SAML assertion.

    SubjectType

    string

    The format of NameID in the SAML assertion. If the prefix is urn:oasis:names:tc:SAML:2.0:nameid-format:, the prefix is removed. Example: persistent/transient.

    persistent
    Subject

    string

    The value of the Subject - NameID field in the SAML assertion.

    alice@example.com
    Issuer

    string

    The value of the Issuer field in the SAML assertion.

    http://example.com/adfs/services/trust
    Recipient

    string

    The value of the Recipient attribute in the Subject - SubjectConfirmation - SubjectConfirmationData field of the SAML assertion.

    https://signin.alibabacloud.com/saml-role/SSO
    AssumedRoleUser

    object

    The temporary identity for role assumption.

    AssumedRoleId

    string

    The ID of the temporary identity.

    34458433936495****:alice
    Arn

    string

    The ARN of the temporary identity.

    acs:sts::123456789012****:assumed-role/AdminRole/alice
    Credentials

    object

    The access credentials.

    SecurityToken

    string

    The security token.

    Note

    The length of the security token is not fixed. We strongly recommend that you do not limit the maximum length of the security token.

    ********
    Expiration

    string

    The expiration time of the STS token in UTC.

    2015-04-09T11:52:19Z
    AccessKeySecret

    string

    The AccessKey secret.

    wyLTSmsyPGP1ohvvw8xYgB29dlGI8KMiH2pK****
    AccessKeyId

    string

    The AccessKey ID.

    STS.L4aBSCSJVMuKg5U1****
    SourceIdentity

    string

    The source identity information.

    When you assume a role, you can specify the source identity of the actor as the initial identity identifier for the session. The value of the source identity persists throughout the chained sessions of continuous role assumption and cannot be changed midway. This ensures the traceability and security of operations.

    If the source identity is not specified, this field is not returned.

    Alice

    Examples

    Success response

    JSON format

    {
  "RequestId": "6894B13B-6D71-4EF5-88FA-F32781734A7F",
  "SAMLAssertionInfo": {
    "SubjectType": "persistent",
    "Subject": "alice@example.com",
    "Issuer": "http://example.com/adfs/services/trust",
    "Recipient": "https://signin.alibabacloud.com/saml-role/SSO"
  },
  "AssumedRoleUser": {
    "AssumedRoleId": "34458433936495****:alice",
    "Arn": "acs:sts::123456789012****:assumed-role/AdminRole/alice"
  },
  "Credentials": {
    "SecurityToken": "********",
    "Expiration": "2015-04-09T11:52:19Z",
    "AccessKeySecret": "wyLTSmsyPGP1ohvvw8xYgB29dlGI8KMiH2pK****",
    "AccessKeyId": "STS.L4aBSCSJVMuKg5U1****"
  },
  "SourceIdentity": "Alice"
}

    Error codes

    HTTP status code

    Error code

    Error message

    Description
    500 InternalError STS Server Internal Error happened, please send the RequestId to us. STS server internal exception

    See Error Codes for a complete list.

    Release notes

    See Release Notes for a complete list.