Resource Access Management:User-based SSO with Google Workspace

Step 1: Get SAML provider metadata from Alibaba Cloud

1. Log on to the RAM console as a RAM administrator.

2. In the left-side navigation pane, choose Integrations > SSO.

3. Click the User-based SSO tab. In the SAML Service Provider Metadata URL section, copy the metadata URL for your Alibaba Cloud account.

4. Open the copied link in a new browser window and save the metadata XML file locally.

   Note

   The metadata XML contains Alibaba Cloud SAML service provider information. Record the value of the entityID attribute from the EntityDescriptor element and the value of the Location attribute from the AssertionConsumerService element. You need these values to configure Google Workspace.

Step 2: Create a SAML SSO app in Google Workspace

1. Log on to the Google Admin console as a super administrator.

2. In the left-side navigation pane, choose Apps > Web and mobile apps.

3. Click Add app, and then click Add custom SAML app.

4. On the Add custom SAML app page, create an application that supports SAML SSO.

   1. On the App details page, enter an app name, for example, AlibabaCloudUserSSO, and then click CONTINUE.

   2. On the Google Identity Provider details page, click DOWNLOAD METADATA to download the metadata, and then click CONTINUE.

   3. On the Service provider details page, enter the ACS URL and Entity ID, and then click CONTINUE.

      • ACS URL: The Location value that you recorded in Step 1: Get SAML service provider metadata from Alibaba Cloud.

      • Entity ID: The entityID value that you recorded in Step 1: Get SAML service provider metadata from Alibaba Cloud.

      • Start URL: The Alibaba Cloud page users are redirected to after successful SSO.

        Note

        Only URLs from Alibaba-owned domains are allowed for Default RelayState (*.aliyun.com, *.hichina.com, *.yunos.com, *.taobao.com, *.tmall.com, *.alibabacloud.com, and *.alipay.com). Invalid URLs are ignored. If empty, you are redirected to the Alibaba Cloud console homepage.

   4. On the Attribute mapping page, click FINISH.

5. On the details page of the created app, click User access.

6. Optional: In the Organizational Units section, select the organizational unit for which you want to enable SSO. By default, the app applies to the entire organization.

7. In the Service status section, select ON for everyone.

   Note

   If you specified an organizational unit in step 6, select ON.

8. Click SAVE.

Step 3: Enable user-based SSO in Alibaba Cloud

1. In the left-side navigation pane of the RAM console, choose Integrations > SSO.

2. Click the User-based SSO tab. In the SSO Status section, click Enabled.

   Note

   User-based SSO is a global feature. Once enabled, all RAM users must use SSO to log on. If you are logged on as a RAM user, keep SSO disabled until you create the required RAM users to avoid lockout from configuration errors. Alternatively, log on with your Alibaba Cloud account to perform the configuration.

3. In the Metadata File section, click Upload Metadata File and upload the IdP metadata that you downloaded from Google Workspace in Step 2: Create a SAML SSO app in Google Workspace.

4. In the Auxiliary Domain Name section, click Edit. Then, enable the auxiliary domain name and set it to the email suffix of the Google Workspace usernames.

   Note

   If your Google Workspace organization has users with multiple email suffixes, only users whose email addresses end with the specified suffix can log on to Alibaba Cloud.

Step 4: Create a user in Google Workspace

1. In the left-side navigation pane, choose Directory > Users.

2. Click Add new user.

3. On the User Information page, enter the First name, Last name, and Primary email (for example, u2@example.com). Select an Organizational unit, and then click ADD NEW USER.

   Note

   If you specified an organizational unit for the app in Step 2: Create a SAML SSO app in Google Workspace, select the same Organizational unit.

Step 5: Create a RAM user in Alibaba Cloud

1. In the left-side navigation pane of the RAM console, choose Identities > Users.

2. On the Users page, click Create User.

3. On the Create User page, enter the Logon Name and Display Name.

   Note

   Make sure the prefix of the RAM user's logon name matches the username prefix in Google Workspace. In this example, the prefix is u2.

4. In the Access Mode section, select Console Access and configure other parameters, such as the logon password.

5. Click OK.

Verify the result

After configuration, you can initiate SSO from either Alibaba Cloud or Google Workspace.