Resource Access Management (RAM) uses the OAuth 2.0 and OAuth 2.1 protocols to enable applications to obtain authorized access to Alibaba Cloud resources on behalf of a user. This topic provides an overview of the core concepts, use cases, and OAuth scopes of the Alibaba Cloud OAuth service.
Core concepts
Concept | Description |
User (resource owner) | The entity that grants an application permission to access their resources. A resource owner can be an Alibaba Cloud account, a RAM user, or a RAM role. Note Support for RAM roles as resource owners is available for OAuth applications created after September 10, 2024. To enable this feature for older applications, submit a ticket. |
Alibaba Cloud OAuth service | The Alibaba Cloud OAuth service acts as an authorization server. It authenticates the resource owner, obtains their consent, and issues access tokens to the client application. |
First-party application | An application created within your Alibaba Cloud account. Users within the same account can access the application without an explicit authorization step, while users from other Alibaba Cloud accounts must first install and authorize the application. You can create the following types of first-party applications:
|
Third-party application | An application developed by a different Alibaba Cloud account that you install and authorize to access your resources. |
Official application | An application published by an Alibaba Cloud service that all Alibaba Cloud accounts can install. Because this type of application is not owned by your account, an official application is a type of third-party application. |
OAuth scope | A mechanism to limit an application's access to a user's account. An application can request one or more scopes, and the access token issued to the application will be limited to the scopes granted. The following scopes are supported:
|
Token | A security credential issued by the OAuth service that represents the authorization granted by the user.
|
Alibaba Cloud API | The API that an application can call to access Alibaba Cloud resources. |
Use cases
ID token claims
When a user grants consent for the openid, aliuid, and profile scopes, the returned ID token can contain the following claims.
Claim | Description | Example | Required scope |
exp | The token's expiration time, represented as a UNIX timestamp. | 1517539523 | openid |
sub | The subject identifier for the authenticated user. This is a unique, non-recyclable identifier that does not contain any personally identifiable information (PII). Note For an assumed RAM role, the sub value is a concatenation of the role ID and role session name ( | 123456789012**** | openid |
aud | The audience of the token, which is the client ID of your OAuth application. | 4567890123456**** | openid |
iss | The issuer of the token. The value is | https://oauth.aliyun.com | openid |
iat | The time when the token was issued, represented as a UNIX timestamp. | 1517533200 | openid |
aid | The ID of the Alibaba Cloud account to which the authenticated user belongs. | 177242285274**** | aliuid |
uid | The unique ID of the authenticated user. Valid values:
| 20124982101502**** | aliuid |
type | The type of the authenticated user. Valid values:
| user | profile |
login_name | The logon name of the Alibaba Cloud account. Note This claim is returned only for Alibaba Cloud accounts. | Alice | profile |
upn | The logon name of the RAM user. Note This claim is returned only for RAM users. | Bob@examplecompany.onaliyun.com | profile |
name | The name of the authenticated user. Valid values:
Note This claim is returned only for RAM users and roles. | Bob | profile |