Resource Access Management:Example: Configure user-based SSO with Okta

Step 1: Obtain SAML SP metadata from Alibaba Cloud

1. Log on to the Resource Access Management (RAM) console as a RAM administrator.

2. In the left-side navigation pane, choose Integrations > SSO.

3. Click the User-based SSO tab. In the SAML Service Provider Metadata URL section, copy the metadata URL for your Alibaba Cloud account.

4. Open the URL in a browser, then save the XML file locally.

   In the XML file, find and record the values of entityID and Location:

   • entityID: The entityID attribute of the <md:EntityDescriptor> element. Example: https://signin-intl.aliyun.com/57******81/saml/SSO.

   • Location: The Location attribute of the <md:AssertionConsumerService> element. Example: https://signin-intl.aliyun.com/saml/SSO.

Step 2: Create a SAML application in Okta

1. Log on to the Okta portal.

2. In the left-side navigation pane of the Okta Admin Console, choose Applications > Applications.

3. On the Applications page, click Create App Integration.

4. In the Create a new app integration dialog box, select SAML 2.0 and click Next.

5. On the General Settings page, enter an App name, such as AliyunSSODemo, and click Next.

6. On the Configure SAML page, set the following in the SAML Settings section, then click Next.

   • Single sign-on URL: Enter the Location value that you recorded in the previous step.

   • Audience URI (SP Entity ID): Enter the entityID value that you recorded in the previous step.

   • Default RelayState: URL that users are redirected to after SSO logon. If empty, users land on the Alibaba Cloud Management Console homepage.

     Note

     For security reasons, the value of Default RelayState must be a URL under an Alibaba-owned domain, such as *.aliyun.com, *.hichina.com, *.yunos.com, *.taobao.com, *.tmall.com, *.alibabacloud.com, or *.alipay.com. Otherwise, this setting is ignored.

   • Name ID format: Select Persistent.

   • Application username: Select Email.

7. On the Feedback page, select an application type and click Finish.

Step 3: Obtain the SAML IdP metadata from Okta

1. On the details page of the application that you created (AliyunSSODemo), click the Sign On tab.

2. In the Settings section, click Identity provider metadata and save the IdP metadata file to your computer.

Step 4: Enable user-based SSO in Alibaba Cloud

1. In the left-side navigation pane of the RAM console, choose Integrations > SSO.

2. Click the User-based SSO tab. In the SSO Status section, click Enabled.

   Note

   If you are a RAM user, complete all configuration steps, including creating the necessary RAM user, before enabling SSO to avoid being locked out. To reduce this risk, use your Alibaba Cloud account to perform the configuration.

3. In the Metadata File section, click Upload Metadata File and upload the IdP metadata file that you obtained in Step 3: Obtain the SAML IdP metadata from Okta.

4. In the Auxiliary Domain Name section, click Edit, enable the feature, and set the auxiliary domain name to the email suffix of your Okta usernames.

   Note

   If your Okta organization uses multiple email suffixes, only users whose suffix matches the configured value can SSO into Alibaba Cloud.

Step 5: Create a user and assign the application in Okta

1. In the left-side navigation pane of Okta, choose Directory > People.

2. Click Add Person.

3. On the Add Person page, enter the user's information, set Primary email to u2@example.com, and then click Save.

4. In the user list, find u2@example.com, click Activate in the Status column, and confirm the activation.

5. In the left-side navigation pane, choose Applications > Applications.

6. Click the name of your application (AliyunSSODemo). On the Assignments tab, choose Assign > Assign to People.

7. Click Assign next to the target user (u2@example.com).

8. Click Save and Go Back.

9. Click Done.

Step 6: Create a RAM user in Alibaba Cloud

1. In the left-side navigation pane of the RAM console, choose Identities > Users.

2. On the Users page, click Create User.

3. On the Create User page, enter the Logon Name and Display Name.

   Note

   The RAM user's logon name prefix must match the corresponding Okta username prefix. In this example, the prefix is u2.

4. In the Access Mode section, select Console Access and configure settings such as the logon password.

5. Click OK.

Verify the results

Verify the setup by initiating an SSO logon from either Alibaba Cloud or Okta.