Resource Access Management:Sync accounts from Alibaba Cloud IDaaS to Alibaba Cloud RAM using SCIM

Prerequisites

1. Your Alibaba Cloud account or RAM user must have the required permissions to create OAuth applications.

2. Your Alibaba Cloud account or RAM user must have the required permissions to grant authorization to a server application. You can grant authorization only to a server application that belongs to your account.

Step 1: Create and authorize an OAuth application in the RAM console

1. Log on to the RAM console.

2. In the navigation pane on the left, choose OAuth Applications Preview > Enterprise > Create Application

3. Enter the Application Name and Display Name. For Application Type, select Server Application.

4. Select /acs/scim in the Add OAuth Scopes section. Click OK.

5. Grant authorization to the OAuth application. On the Application OAuth Scopes tab, click Authorize. On the application authorization page, select Accesses Cross-Domain Identity Management, and then click Authorize.

6. On the App Secrets tab, click Create Secret. The system automatically generates a key pair that includes an AppSecretId and an AppSecretValue.

7. After the key is generated, click Download Secret to save the key file to a secure location. After you save the file, click Save.

   Important

   The secret is displayed only when it is created. You cannot retrieve it after you close the window.

Step 2: Configure SCIM synchronization in IDaaS

1. In the IDaaS instance console, navigate to the Applications page. Click Add Application to open the Marketplace. Select and add the Alibaba Cloud User-based SSO (International Site) application template.

2. Switch to the Account Sync tab. Set the scope and click Save.

3. Enable Synchronize IDaaS Account on Application.

4. Configure the basic configurations.

   1. Enter the client ID and client secret.

      1. Log on to the RAM console. In the navigation pane on the left, choose Integrations > OAuth Applications Preview.

      2. Find the application that you want to use for SCIM synchronization and click its name to open the details page.

      3. In the Basic Information section of the application details page, copy the Application ID (the client ID).

      4. Obtain the client secret from the AppSecretValue that you saved in the secret creation step in Step 1.

   2. Operation: You can subscribe to specific change events, such as user creation, updates, and deletions. When one of these changes occurs in IDaaS, the system automatically triggers a real-time synchronization push to the target application.

   3. Full Push Scope: If you select this option, all data within the defined scope is pushed to the application when you perform a one-click push.

5. Field Mapping: Customize the SCIM field mapping and attribute matching rules. After you make the adjustments, click Save to ensure accurate data synchronization.

   Important

   When synchronizing IDaaS accounts to RAM via SCIM, mapping of user mobile and email attributes is not supported.

6. After you complete the configuration, click Save. To verify the configuration is correct, click Test Connectivity.

   Use the one-click push feature to push all accounts within the synchronization scope to RAM at once.

Step 3: Perform synchronization in IDaaS

Click Push Now. The accounts within the synchronization scope are synced to RAM.

References

• If a RAM account cannot be deleted during synchronization, see What do I do if deleting a RAM account fails during IDaaS synchronization?