Resource Access Management:Configure user-based SSO from Microsoft Entra ID

Prerequisites

• A Resource Access Management (RAM) administrator with the AliyunRAMFullAccess policy attached. For information about how to create a RAM user and grant permissions, see Create a RAM user and Grant permissions to a RAM user.

• A Microsoft Entra ID user the Global Administrator role. For information about how to create a user and assign it the administrator role, see the official Microsoft Entra ID documentation.

Step 1: Download the SAML SP metadata file from Alibaba Cloud

1. Log on to the RAM console as a RAM administrator.

2. In the left-side navigation pane, choose Integrations > SSO.

3. On the SSO page, click the User-based SSO tab.

4. In the SAML Service Provider Metadata URL section, copy the URL.

5. Open the metadata URL in a new browser tab. Right-click the page and save it as an XML file. This file contains the SAML service provider (SP) metadata for Alibaba Cloud.

   Note

   The XML file contains the information that is required to configure Alibaba Cloud as a SAML SP. Record the values of the entityID and Location attributes for later use.

Step 2: Create an application in Microsoft Entra ID

1. Log on to the Azure portal as the global administrator of Microsoft Entra ID.

2. In the upper-left corner of the homepage, click the icon.

3. In the left-side navigation pane, choose Microsoft Entra ID > Manage > Enterprise applications > All applications.

4. Click New application.

5. On the Browse Microsoft Entra App Gallery page, click Create your own application.

6. In the Create your own application panel, enter an application name such as AliyunSSODemo, and select Integrate any other application you don't find in the gallery (Non-gallery). Then, click Create.

Step 3: Configure SAML in Microsoft Entra ID

1. On the AliyunSSODemo details page, in the left-side navigation pane, choose Manage > Single sign-on.

2. In the Select a single sign-on method section, click SAML.

3. On the SAML-based Sign-on page, perform the following steps:

   1. In the upper-left corner of the page, click Upload metadata file, select your metadata file, then click Add.

      Note

      In this example, upload the XML file that you downloaded in Step 1.

   2. On the Basic SAML Configuration page, configure the following parameters, then click Save.

      • Identifier (Entity ID): The system automatically reads this value from the entityID attribute in the metadata file.

      • Reply URL (Assertion Consumer Service URL): The system automatically reads this value from the Location attribute in the metadata file.

      • Relay State: Enter the URL of the Alibaba Cloud service page to which an Azure AD user is redirected after a successful SSO logon.

        Note

        For security reasons, the URL for Relay State must belong to an Alibaba-owned domain name, such as *.aliyun.com, *.hichina.com, *.yunos.com, *.taobao.com, *.tmall.com, *.alibabacloud.com, or *.alipay.com. If you specify a URL from an unauthorized domain name, the Relay State will be ignored.

   3. In the SAML Certificates section, click Download on the right of Federation Metadata XML to download the IdP metadata file.

Step 4: Assign users in Microsoft Entra ID

1. On the AliyunSSODemo details page, in the left-side navigation pane, choose Manage > Users and Groups.

2. On the page that appears, click Add user/group.

3. On the Add Assignment page, select user u2 and click Select.

Step 5: Create a RAM user in Alibaba Cloud

1. In the left-side navigation pane of the RAM console, choose Identities > Users.

2. On the Users page, click Create User.

3. In the User Account Information section of the Create User page, configure the Logon Name and Display Name parameters.

   The prefix of the RAM user's logon name (the part before the @ symbol) must exactly match the Microsoft Entra ID username. In this example, because the Microsoft Entra ID username is u2@example.com, the RAM user's logon name must start with u2.

4. In the Access Mode section, select an access mode.

5. Click OK.

Step 6: Enable user-based SSO in Alibaba Cloud

1. In the left-side navigation pane of the RAM console, choose Integrations > SSO.

2. On the SSO page, click the User-based SSO tab.

3. Select Enabled on the right of SSO Status.

   Note

   This is a global setting that affects all RAM users. After you enable it, RAM users can no longer log on with a username and password. If you are logged on as a RAM user, do not enable SSO until you have verified the configuration is correct. To avoid being locked out, we recommend performing this configuration while logged on with your Alibaba Cloud account.

4. In the Metadata File section, click Upload Metadata File to upload the IdP metadata file obtained in Step 3.

5. Click Edit on the right of Auxiliary Domain Name. Enable the feature and enter the suffix of your Microsoft Entra ID username.

   In this example, the domain name is example.onmicrosoft.com because the Microsoft Entra ID username is u2@example.onmicrosoft.com.

Verify the SSO configuration

You can verify the configuration by initiating SSO from both Alibaba Cloud (SP-initiated) and Microsoft Entra ID (IdP-initiated).