All Products
Search

This Product

    Resource Access Management:Manage SAML identity providers

    Document Center

    Resource Access Management:Manage SAML identity providers

    Last Updated:May 27, 2026

    Role-based SSO with SAML requires a SAML identity provider. You can create, view, modify, and delete SAML identity providers in the RAM console.

    Create a SAML identity provider

    Before you create a SAML identity provider, obtain the metadata document from your enterprise identity provider (IdP). This XML document contains the IdP sign-in service URL, public key for signature verification, and assertion format.

    1. Log on to the RAM console as a RAM administrator.

    2. In the left-side navigation pane, choose Integrations > SSO.

    3. On the Role-based SSO tab, click the SAML tab, and then click Create IdP.

    4. On the Create IdP page, enter an IdP Name and a Note.

    5. In the Metadata File section, click Upload Metadata File and upload the metadata document.

    6. Click Create IdP.

    View a SAML identity provider

    1. Log on to the RAM console as a RAM administrator.

    2. In the left-side navigation pane, choose Integrations > SSO.

    3. On the Role-based SSO tab, click the SAML tab, and then click the name of the target identity provider.

    4. In the Basic Information section, view the IdP Name, IdP Type, Created At, Updated At, ARN, Note, and Metadata File.

    Modify a SAML identity provider

    You can modify only the description and metadata document.

    1. Log on to the RAM console as a RAM administrator.

    2. In the left-side navigation pane, choose Integrations > SSO.

    3. On the Role-based SSO tab, click the SAML tab, and then click the name of the target identity provider.

    4. Update the identity provider.

      • Click Note next to Edit to modify the description.

      • Click Metadata File next to Replace Metadata File to upload a new metadata document.

        Warning

        Uploading an incorrect metadata document causes SSO failures.

    Delete a SAML identity provider

    1. Log on to the RAM console as a RAM administrator.

    2. In the left-side navigation pane, choose Integrations > SSO.

    3. On the Role-based SSO tab, click the SAML tab. Find the identity provider that you want to delete and click Delete IdP in the Actions column.

    4. In the Delete IdP dialog box, click Delete IdP.

      Warning

      Deleting a SAML identity provider disables role-based SSO between your enterprise IdP and Alibaba Cloud.