Resource Access Management:Set up user-based SSO with Shibboleth

Before you begin

1. Install Shibboleth, Tomcat, and a Lightweight Directory Access Protocol (LDAP) server.

2. Configure the LDAP server.

   For this example, add an administrator account to LDAP with the distinguished name (DN) uid=admin,ou=system and the password secret.

   Add a test account to LDAP with the DN cn=Test User,ou=users,dc=wimpi,dc=net and the password secret. The account details are shown in the following figure.

   

   The user information fields are:

   • mail: Maps to the logon name of a RAM user in Alibaba Cloud.

   • memberof: Maps to a RAM role name in Alibaba Cloud.

   • samaccountname: The username used to log on to Shibboleth.

   • userpassword: The logon password.

3. Configure Shibboleth to connect to the LDAP server.

   Modify the following settings in the /opt/shibboleth-idp/conf/ldap.properties file:

   # LDAP authentication mode
   idp.authn.LDAP.authenticator = bindSearchAuthenticator
   
   # LDAP server address
   idp.authn.LDAP.ldapURL = ldaps://[LDAP-server-address]:389
   
   # Disable TLS and SSL
   idp.authn.LDAP.useStartTLS = false
   idp.authn.LDAP.useSSL = false
   
   # Base search directory
   idp.authn.LDAP.baseDN = dc=wimpi,dc=net
   idp.authn.LDAP.subtreeSearch = true
   # Logon matching rule. samaccountname is a field in the user data used for LDAP logon.
   idp.authn.LDAP.userFilter= (samaccountname={user})
   
   # Admin account and password
   idp.authn.LDAP.bindDN = uid=admin,ou=system
   idp.authn.LDAP.bindDNCredential = secret
   
   idp.attribute.resolver.LDAP.searchFilter =(samaccountname=$resolutionContext.principal)

Step 1: Get SAML SP metadata from Alibaba Cloud

1. Log on to the RAM console as a RAM administrator.

2. In the left-side navigation pane, choose Integrations > SSO.

3. Click the User-based SSO tab. In the SAML Service Provider Metadata URL section, copy the metadata URL for your Alibaba Cloud account.

4. Open the copied URL in a new browser window. Save the page as an XML file to /opt/shibboleth-idp/metadata/aliyun-ram-user-metadata.xml.

   Note

   Record the entityID attribute value from the EntityDescriptor element. You need this value for subsequent Shibboleth configuration.

Step 2: Register Alibaba Cloud with Shibboleth

Configure the /opt/shibboleth-idp/conf/metadata-providers.xml file to point to the metadata file from Step 1: Get SAML SP metadata from Alibaba Cloud. This registers Alibaba Cloud as a service provider in Shibboleth.

<!--
    <MetadataProvider id="LocalMetadata"  xsi:type="FilesystemMetadataProvider" metadataFile="PATH_TO_YOUR_METADATA"/>
-->

<!-- Find the commented-out code block above and replace it with the following code. -->

<MetadataProvider id="AliyunMetadata"  xsi:type="FilesystemMetadataProvider" metadataFile="%{idp.home}/metadata/aliyun-ram-user-metadata.xml"/>

Step 3: Configure user attributes returned by Shibboleth

1. Modify the /opt/shibboleth/conf/services.xml file.

   The default configuration uses attribute-resolver.xml, which has limited settings. Replace it with attribute-resolver-full.xml to enable the full configuration.

   <value>%{idp.home}/conf/attribute-resolver.xml</value>
   <!-- Find the code above and replace it with the following code. -->
   <value>%{idp.home}/conf/attribute-resolver-full.xml</value>

2. Modify the /opt/shibboleth/conf/attribute-resolver-full.xml file.

   1. Define the attributes to return in the user information. This example returns the mail attribute.

      <!-- ========================================== -->
      <!--      Attribute Definitions                 -->
      <!-- ========================================== -->
      
      <!-- Schema: Core schema attributes-->
      
      <!-- Find the commented-out code block above and add the following code after it. -->
      
      <AttributeDefinition xsi:type="Simple" id="mail">
          <InputDataConnector ref="myLDAP" attributeNames="mail" />
          <AttributeEncoder xsi:type="SAML1String" name="urn:mace:dir:attribute-def:mail" encodeType="false" />
          <AttributeEncoder xsi:type="SAML2String" name="urn:oid:0.9.2342.19200300.100.1.3" friendlyName="mail" encodeType="false" />
      </AttributeDefinition>

   2. In the same file, configure the LDAP connection using the settings from /opt/shibboleth/conf/ldap.properties.

      <!-- Example LDAP Connector -->
      <!--
      	<DataConnector id="myLDAP" xsi:type="LDAPDirectory"
      		ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"
      		baseDN="%{idp.attribute.resolver.LDAP.baseDN}"
      		principal="%{idp.attribute.resolver.LDAP.bindDN}"
      		principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"
      		useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS:true}"
      		...omitted...
      	</DataConnector>
      -->
      
      <!-- Find the example code block above and replace it with the following code. -->
      
      <DataConnector id="myLDAP" xsi:type="LDAPDirectory"
      			   ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"
      			   baseDN="%{idp.attribute.resolver.LDAP.baseDN}"
      			   principal="%{idp.attribute.resolver.LDAP.bindDN}"
      			   principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"
      			   useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS}"
      			   connectTimeout="%{idp.attribute.resolver.LDAP.connectTimeout}"
      			   responseTimeout="%{idp.attribute.resolver.LDAP.responseTimeout}">
      	<FilterTemplate>
      		<![CDATA[
      				%{idp.attribute.resolver.LDAP.searchFilter}
      			]]>
      	</FilterTemplate>
      </DataConnector>

3. Modify the /opt/shibboleth/conf/attribute-filter.xml file to add an attribute filter.

   Replace the value attribute in the PolicyRequirementRule tag with the Alibaba Cloud entityID from Step 1: Get SAML SP metadata from Alibaba Cloud.

   <AttributeFilterPolicyGroup id="ShibbolethFilterPolicy"
   							xmlns="urn:mace:shibboleth:2.0:afp"
   							xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   							xsi:schemaLocation="urn:mace:shibboleth:2.0:afp http://shibboleth.net/schema/idp/shibboleth-afp.xsd">
   	
   <!-- Find the code above and add the following code after it. -->
   	
   <AttributeFilterPolicy id="aliyun">
   	<PolicyRequirementRule xsi:type="Requester" value="[entityID]" />
   	<AttributeRule attributeID="mail">
   		<PermitValueRule xsi:type="ANY" />
   	</AttributeRule>
   </AttributeFilterPolicy>

Step 4: Configure the SAML NameID

1. Modify the /opt/shibboleth/conf/relying-party.xml file to set up the NameID configuration for Alibaba Cloud.

   Replace the relyingPartyIds attribute in the bean tag with the Alibaba Cloud entityID from Step 1: Get SAML SP metadata from Alibaba Cloud.

   <!--
   	Override example that identifies a single RP by name and configures it
   	for SAML 2 SSO without encryption. This is a common "vendor" scenario.
   -->
   <!--
   <bean parent="RelyingPartyByName" c:relyingPartyIds="https://sp.example.org">
   	<property name="profileConfigurations">
   		<list>
   			<bean parent="SAML2.SSO" p:encryptAssertions="false" />
   		</list>
   	</property>
   </bean>
   -->
   
   <!-- Find the commented-out code block above and replace it with the following code. -->
   
   <bean parent="RelyingPartyByName" c:relyingPartyIds="[entityID]">
       <property name="profileConfigurations">
           <list>
               <bean parent="SAML2.SSO" p:encryptAssertions="false" p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" />
           </list>
       </property>
   </bean>

2. Modify the /opt/shibboleth/conf/saml-nameid.xml file to configure how the NameID is generated.

   <!-- Find the two code blocks below and uncomment them to apply the configuration. -->
   
   <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
       p:omitQualifiers="true"
       p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
       p:attributeSourceIds="#{ {'mail'} }" />
   
   <bean parent="shibboleth.SAML1AttributeSourcedGenerator"
       p:omitQualifiers="true"
       p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
       p:attributeSourceIds="#{ {'mail'} }" />

3. Modify the /opt/shibboleth/conf/saml-nameid.properties file to configure NameID-related properties.

   idp.nameid.saml2.default = urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
   idp.persistentId.useUnfilteredAttributes = true
   idp.persistentId.encoding = BASE32

Step 5: Get the SAML IdP metadata from Shibboleth

1. Restart Tomcat to apply the configurations.

2. Access https://<your-server-address>/idp/shibboleth and save the metadata file to your local computer.

Step 6: Enable user-based SSO in Alibaba Cloud

1. In the left-side navigation pane of the RAM console, choose Integrations > SSO.

2. Click the User-based SSO tab. In the SSO Status section, click Enabled.

   Note

   User-based SSO is a global feature. After you enable it, all RAM users must log on by using SSO. If you are configuring SSO as a RAM user, keep this feature disabled for now. You must create the required RAM users first to avoid being locked out due to misconfiguration. Alternatively, use your Alibaba Cloud account to configure SSO and avoid this issue.

3. In the Metadata File section, click Upload Metadata File and upload the IdP metadata file that you obtained in Step 5: Get the SAML IdP metadata from Shibboleth.

4. In the Auxiliary Domain Name section, click Edit, then enable the auxiliary domain name and set it to the suffix of the user's email in Shibboleth.

   In this example, the value is testdomain.alicloud.com.

Step 7: Create a RAM user in Alibaba Cloud

1. In the left-side navigation pane of the RAM console, choose Identities > Users.

2. On the Users page, click Create User.

3. On the Create User page, enter a Logon Name and a Display Name.

   Note

   Ensure the RAM user's logon name prefix matches the user's email prefix in Shibboleth. In this example, the prefix is testUser.

4. In the Access Mode section, select Console Access and set the logon password and other parameters.

5. Click OK.

Verify the results

After you complete the configuration, you can initiate an SSO logon from either Alibaba Cloud or Shibboleth.

FAQ

If you encounter issues during verification, check /opt/shibboleth-idp/logs/idp-process.log for the cause. Common issues include: