Resource Access Management:Configure Alibaba Cloud as the SP in your IdP

Procedure

1. Copy the Alibaba Cloud SAML SP metadata URL.

   The SAML SP metadata URL is https://signin.alibabacloud.com/saml-role/sp-metadata.xml.

2. Create a SAML SP in your IdP and set Alibaba Cloud as the trusted party by using one of the following methods:

   • Use the SAML SP metadata URL that you copied in Step 1.

   • If your IdP does not support URL-based configuration, download the metadata file from the URL in Step 1 and upload it.

   • If your IdP does not support metadata file upload, manually configure the following parameters:

     • Entity ID: urn:alibaba:cloudcomputing:international

       Note

       If you need to configure multiple SSO applications in your IdP that all point to Alibaba Cloud RAM, and your IdP does not support using the same Entity ID for multiple applications, you can append a parameter to the Entity ID to distinguish them. For example, urn:alibaba:cloudcomputing:international#abc.123.

       The parameter must meet the following requirements:

       • The parameter starts with a hash sign (#) and consists of letters and digits.

       • Periods (.) can be used as separators.

       • A hash sign (#) cannot be directly followed by a period (.).

     • ACS URL: https://signin.alibabacloud.com/saml-role/sso

     • RelayState: Optional. If your IdP requires RelayState, set it to a URL that users are redirected to after SSO succeeds. If not set, users are redirected to the Alibaba Cloud console homepage.

       Note

       The RelayState URL must point to an Alibaba website. Valid domains: *.aliyun.com, *.hichina.com, *.yunos.com, *.taobao.com, *.tmall.com, *.alibabacloud.com, and *.alipay.com.