Create a RAM role for a trusted identity provider - Resource Access Management

A RAM role that trusts an identity provider (IdP) is for role-based single sign-on (SSO) between your enterprise IdP and Alibaba Cloud. Users from the trusted IdP can assume this role.

Create a RAM role for a SAML identity provider

For SAML 2.0-based SSO, you must create a RAM role that trusts a SAML identity provider.

Prerequisites

Ensure that you have created a SAML identity provider. For more information, see Manage SAML identity providers.

Procedure

Log on to the RAM console as a RAM administrator.
In the left-side navigation pane, choose Identities > Roles.
On the Roles page, click Create Role.
In the upper-right corner of the Create Role page, click Switch to Policy Editor.
In the policy editor, specify the SAML identity provider.

The editor provides two modes: Visual Editor and JSON editor. You can use either mode.
- Visual Editor
  
  In the Principal section, specify the SAML identity provider.
  
  Select the Identity Provider radio button and click the Edit button next to it to select the target identity provider. In the Action section, select sts:AssumeRole to grant the permission to assume the role.
  
  In the Add Principal dialog box, select Azure-AD from the Identity Provider list, and then click OK.
- JSON editor
  
  In the principal element, specify your SAML provider in the Federated field, and configure the condition.
```
{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "acs:ram::100*******0719:saml-provider/Azure-AD"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "saml:recipient": [
            "https://signin.alibabacloud.com/saml-role/sso"
          ]
        }
      }
    }
  ]
}
```

In the editor, configure conditions.

The following table describes the available service-level condition keys.

Condition key	Description	Required	Example
`saml:recipient`	Alibaba Cloud checks the value of this element to ensure that the SAML assertion is intended for Alibaba Cloud.	Yes	The value is fixed: `https://signin.alibabacloud.com/saml-role/sso`

In the Create Role dialog box, enter a Role Name and then click OK.

Create a RAM role for an OIDC identity provider

For OIDC-based SSO, you must create a RAM role that trusts an OIDC identity provider.

Prerequisites

Ensure that you have created an OIDC identity provider. For more information, see Create an OIDC identity provider.

Procedure

Log on to the RAM console as a RAM administrator.
In the left-side navigation pane, choose Identities > Roles.
On the Roles page, click Create Role.
In the upper-right corner of the Create Role page, click Switch to Policy Editor.
In the policy editor, specify the OIDC identity provider.

The editor provides two modes: Visual Editor and JSON editor. You can use either mode.
- Visual Editor
  
  In the Principal section, specify the OIDC identity provider.
  
  In the Add Principal dialog box, set Identity Provider Type to OIDC, select the target provider from the Identity Provider drop-down list, and then click OK.
- JSON editor
  
  In the principal element, specify your OIDC provider in the Federated field, and configure the condition.
```
{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "acs:ram::100*******0719:oidc-provider/xiyun****"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "oidc:iss": [
            "https://dev-xxxxxx.okta.com"
          ],
          "oidc:aud": [
            "0oa294vi1vJoClev****"
          ]
        }
      }
    }
  ]
}
```

In the editor, configure conditions.

The following table describes the available service-level condition keys.

Condition key	Description	Required	Example
`oidc:iss`	The OIDC issuer. To assume the role, the value of the `iss` claim in the OIDC token must match this condition. This condition must use the StringEquals operator. The value must be the issuer URL of the OIDC identity provider. This ensures that only tokens from a trusted issuer can be used to assume the role.	Yes	https://dev-xxxxxx.okta.com
`oidc:aud`	The OIDC audience. To assume the role, the value of the `aud` claim in the OIDC token must match this condition. This condition must use the StringEquals operator. The value can be one or more of the client IDs for the OIDC identity provider. This ensures that only OIDC tokens generated by a specified client ID can be used to assume the role.	Yes	0oa294vi1vJoClev****
`oidc:sub`	The OIDC subject. To assume the role, the value of the `sub` claim in the OIDC token must match this condition. You can use any string comparison operator for this optional condition and specify up to 10 subjects.	No	00u294e3mzNXt4Hi****

In the Create Role dialog box, enter a Role Name and then click OK.

Next steps

By default, a new RAM role has no permissions. You must grant permissions to the role. For more information, see Manage permissions for a RAM role.