RAM supports OpenID Connect (OIDC) federation. Applications can exchange an OIDC token from a trusted identity provider (IdP) for temporary Alibaba Cloud credentials, granting role-based access to your cloud resources.
Use cases
OIDC role-based SSO replaces long-term AccessKey pairs with temporary credentials. Common use cases:
-
Enterprise applications: Register internal applications with your corporate IdP (Okta, Google Workspace, or any OIDC-compliant system). The application obtains an OIDC token and exchanges it for temporary Alibaba Cloud credentials.
-
Third-party and mobile applications: Build applications that let users authenticate with external identity systems. If the provider supports OIDC, your application uses the issued token to assume a RAM role and access Alibaba Cloud services on the user's behalf.
How role-based OIDC SSO works
Establish trust between your IdP and Alibaba Cloud, then exchange tokens for temporary credentials.
-
Configure trust: Create an OIDC IdP in the RAM console and a RAM role that trusts this IdP.
-
Request OIDC token: Your application authenticates a user against the external IdP and requests an OIDC token.
-
Exchange for STS token: Your application calls the AssumeRoleWithOIDC API operation of STS, providing the OIDC token and the ARN of the target RAM role.
-
Validate and issue STS token: STS validates the token's signature, issuer, and audience (client ID). If valid, STS returns temporary credentials (an STS token).
-
Access resources: Your application uses the STS token to call Alibaba Cloud APIs with the permissions of the assumed RAM role.
Key concepts
|
Concept |
Description |
|
OIDC |
OIDC is an identity layer on top of OAuth 2.0. It lets clients verify a user's identity through an authorization server and obtain basic profile information. |
|
OIDC token (ID token) |
A JSON Web Token (JWT) containing claims about the authentication event: the user's ID, token issuer, and intended client. |
|
Client ID |
A unique identifier for an application registered with an OIDC IdP. Included as the audience ( |
|
Issuer URL |
The URL identifying the OIDC IdP. Included as the issuer ( |
|
Thumbprint (Fingerprint) |
Identifies the root CA certificate of an OIDC IdP's server, used to verify the authenticity of the IdP's public keys. For more information, see Obtain an OIDC IdP thumbprint with OpenSSL. Note
Before rotating your IdP's certificate, add the new thumbprint to the OIDC provider configuration in RAM. After confirming federation works with the new certificate, remove the old thumbprint. |
|
STS token |
A temporary credential from Alibaba Cloud Security Token Service (STS). In federated SSO, applications exchange a SAML assertion or OIDC token for an STS token to authenticate API calls. |
Configuration tutorial
For a step-by-step guide, see Example: Use OIDC for role-based SSO.
Service quotas
|
Resource |
Maximum |
|
OIDC IdPs per Alibaba Cloud account |
100 |
|
Client IDs per OIDC IdP |
50 |
|
Thumbprints per OIDC IdP |
5 |