Resource Access Management:Implement user-based SSO by using Shibboleth

Preparations

1. Install Shibboleth, Apache Tomcat, and a Lightweight Directory Access Protocol (LDAP)-authenticated server.

2. Configure the LDAP-authenticated server.

   Create two accounts for subsequent use. First, create an administrator account on the LDAP-authenticated server. The distinguished name (DN) of the administrator account is uid=admin,ou=system, and the password is secret.

   Then, create a test account on the LDAP-authenticated server. The DN of the test account is cn=Test User,ou=users,dc=wimpi,dc=net, and the password is secret. The following figure shows the detailed information.

   

   The following section describes the user information fields:

   • mail: the logon name of the Resource Access Management (RAM) user.

   • memberof: the name of the RAM role.

   • samaccountname: the username of the account that is used to log on to Shibboleth.

   • userpassword: the password of the account that is used to log on to Shibboleth.

3. Configure Shibboleth to connect to the LDAP-authenticated server.

   Modify the following content in the /opt/shibboleth-idp/conf/ldap.properties file:

   # The LDAP authentication mode.
   idp.authn.LDAP.authenticator = bindSearchAuthenticator
   
   # The address of the LDAP-authenticated server.
   idp.authn.LDAP.ldapURL=ldaps://[The address of the LDAP-authenticated server]:389
   
   # Disable Transport Layer Security (TSL) and Transport Layer Security (SSL).
   idp.authn.LDAP.useStartTLS = false
   idp.authn.LDAP.useSSL = false
   
   # The directory tree for search.
   idp.authn.LDAP.baseDN = dc=wimpi,dc=net
   idp.authn.LDAP.subtreeSearch = true
   # The logon matching rule. The user information field samaccountname is used to log on to the LDAP-authenticated server. 
   idp.authn.LDAP.userFilter= (samaccountname={user})
   
   # The username and password of the admin account that you created.
   idp.authn.LDAP.bindDN = uid=admin,ou=system
   idp.authn.LDAP.bindDNCredential = secret
   
   idp.attribute.resolver.LDAP.searchFilter =(samaccountname=$resolutionContext.principal)

Step 1: Download the SAML SP metadata file of Alibaba Cloud

1. Log on to the RAM console with your Alibaba Cloud account.

2. In the left-side navigation pane, choose Integrations > SSO.

3. On the SSO tab, click the User-based SSO tab.

4. In the Setup SSO section, copy the value of the SAML Service Provider Metadata URL parameter.

5. Open a new tab in your browser and paste the URL in the address bar. On the page that appears, right-click the page and select Save As to download the metadata file in the XML format and save the file as /opt/shibboleth-idp/metadata/aliyun-ram-user-metadata.xml.

   Note

   The XML file contains the information that is required to configure Alibaba Cloud as a Security Assertion Markup Language (SAML) service provider (SP). Record the value of entityID in the EntityDescriptor element for subsequent configurations in Shibboleth.

Step 2: Register Alibaba Cloud with Shibboleth

Configure the metadata file that you obtained in Step 1: Download the SAML SP metadata file of Alibaba Cloud in the /opt/shibboleth-idp/conf/metadata-providers.xml file to register Alibaba Cloud with Shibboleth.

<!--
    <MetadataProvider id="LocalMetadata"  xsi:type="FilesystemMetadataProvider" metadataFile="PATH_TO_YOUR_METADATA"/>
-->

<!-- Find the code that is displayed in the preceding line in the file and replace the code with the code that is displayed in the following line. -->

<MetadataProvider id="AliyunMetadata"  xsi:type="FilesystemMetadataProvider" metadataFile="%{idp.home}/metadata/aliyun-ram-user-metadata.xml"/>

Step 3: Configure the user attributes that are returned by Shibboleth

1. Modify the /opt/shibboleth/conf/services.xml file.

   The original configuration file contains the attribute-resolver.xml field and does not provide complete configuration information. You must replace the field with the attribute-resolver-full.xml field to provide complete configuration information.

   <value>%{idp.home}/conf/attribute-resolver.xml</value>
   <!-- Find the code that is displayed in the preceding line in the file and replace the code with the code that is displayed in the following line. -->
   <value>%{idp.home}/conf/attribute-resolver-full.xml</value>

2. Modify the /opt/shibboleth/conf/attribute-resolver-full.xml file.

   1. Configure the user attributes that are returned by Shibboleth in the /opt/shibboleth/conf/attribute-resolver-full.xm file. In this example, the mail field is used as an user attribute.

      <!-- ========================================== -->
      <!--      Attribute Definitions                 -->
      <!-- ========================================== -->
      
      <!-- Schema: Core schema attributes-->
      
      <!-- Find the code that is displayed in the preceding line in the file and append the code that is displayed in the following line. -->
      
      <AttributeDefinition xsi:type="Simple" id="mail">
          <InputDataConnector ref="myLDAP" attributeNames="mail" />
          <AttributeEncoder xsi:type="SAML1String" name="urn:mace:dir:attribute-def:mail" encodeType="false" />
          <AttributeEncoder xsi:type="SAML2String" name="urn:oid:0.9.2342.19200300.100.1.3" friendlyName="mail" encodeType="false" />
      </AttributeDefinition>

   2. Read the configuration information that is contained in /opt/shibboleth/conf/ldap.properties in the file to establish a connection to the LDAP server.

      <!-- Example LDAP Connector -->
      <!--
      	<DataConnector id="myLDAP" xsi:type="LDAPDirectory"
      		ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"
      		baseDN="%{idp.attribute.resolver.LDAP.baseDN}"
      		principal="%{idp.attribute.resolver.LDAP.bindDN}"
      		principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"
      		useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS:true}"
      		...
      	</DataConnector>
      -->
      
      <!-- Find the code that is displayed in the preceding line in the file and replace the code with the code that is displayed in the following line. -->
      
      <DataConnector id="myLDAP" xsi:type="LDAPDirectory"
      			   ldapURL="%{idp.attribute.resolver.LDAP.ldapURL}"
      			   baseDN="%{idp.attribute.resolver.LDAP.baseDN}"
      			   principal="%{idp.attribute.resolver.LDAP.bindDN}"
      			   principalCredential="%{idp.attribute.resolver.LDAP.bindDNCredential}"
      			   useStartTLS="%{idp.attribute.resolver.LDAP.useStartTLS}"
      			   connectTimeout="%{idp.attribute.resolver.LDAP.connectTimeout}"
      			   responseTimeout="%{idp.attribute.resolver.LDAP.responseTimeout}">
      	<FilterTemplate>
      		<![CDATA[
      				%{idp.attribute.resolver.LDAP.searchFilter}
      			]]>
      	</FilterTemplate>
      </DataConnector>

3. Add an attribute filter to the /opt/shibboleth/conf/attribute-filter.xml file.

   Replace the value attribute in the PolicyRequirementRule tag with the Entity ID that you obtained in Step 1: Download the SAML SP metadata file of Alibaba Cloud.

   <AttributeFilterPolicyGroup id="ShibbolethFilterPolicy"
   							xmlns="urn:mace:shibboleth:2.0:afp"
   							xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   							xsi:schemaLocation="urn:mace:shibboleth:2.0:afp http://shibboleth.net/schema/idp/shibboleth-afp.xsd">
   	
   <!-- Find the code that is displayed in the preceding line in the file and append the code that is displayed in the following line. -->
   	
   <AttributeFilterPolicy id="aliyun">
   	<PolicyRequirementRule xsi:type="Requester" value="[entityID]" />
   	<AttributeRule attributeID="mail">
   		<PermitValueRule xsi:type="ANY" />
   	</AttributeRule>
   </AttributeFilterPolicy>

Step 4: Configure the NameID attribute in the SAML response

1. Configure the NameID attribute in the /opt/shibboleth/conf/relying-party.xml file.

   Replace the relyingPartyIds attribute in the bean tag with the Entity ID that you obtained in Step 1: Download the SAML SP metadata file of Alibaba Cloud.

   <!--
   	Override example that identifies a single RP by name and configures it
   	for SAML 2 SSO without encryption. This is a common "vendor" scenario.
   -->
   <!--
   <bean parent="RelyingPartyByName" c:relyingPartyIds="https://sp.example.org">
   	<property name="profileConfigurations">
   		<list>
   			<bean parent="SAML2.SSO" p:encryptAssertions="false" />
   		</list>
   	</property>
   </bean>
   -->
   
   <!-- Find the code that is displayed in the preceding line in the file and replace the code with the code that is displayed in the following line. -->
   
   <bean parent="RelyingPartyByName" c:relyingPartyIds="[entityID]">
       <property name="profileConfigurations">
           <list>
               <bean parent="SAML2.SSO" p:encryptAssertions="false" p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" />
           </list>
       </property>
   </bean>

2. Configure the generation method of the NameID attribute in the /opt/shibboleth/conf/saml-nameid.xml file.

   <!-- Find the following code. Comment out the code to make the configuration into effect.-->
   
   <bean parent="shibboleth.SAML2AttributeSourcedGenerator"
       p:omitQualifiers="true"
       p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
       p:attributeSourceIds="#{ {'mail'} }" />
   
   <bean parent="shibboleth.SAML1AttributeSourcedGenerator"
       p:omitQualifiers="true"
       p:format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"
       p:attributeSourceIds="#{ {'mail'} }" />

3. Configure information about the NameID attribute in /opt/shibboleth/conf/saml-nameid.properties.

   idp.nameid.saml2.default = urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress
   idp.persistentId.useUnfilteredAttributes = true
   idp.persistentId.encoding = BASE32

Step 5: Obtain the metadata file of the SAML IdP in Shibboleth

1. Restart Apache Tomcat to allow the preceding configurations to take effect.

2. Access https://<The IP address of the LDAP server>/idp/shibboleth and save the metadata file to your computer.

Step 6: Enable user-based SSO in the Alibaba Cloud Management Console

1. In the left-side navigation pane of the RAM console, choose Identities > Roles.

2. On the SSO tab, click the User-based SSO tab.

3. Click Edit to the right of Setup SSO.

4. In the SSO Status section of the SSO Settings panel, click Enabled.

   Note

   User-based SSO takes effect on all RAM users in your Alibaba Cloud account. If you enable this feature, all RAM users in your Alibaba Cloud account must log on to the Alibaba Cloud Management Console by using SSO. If you use a RAM user, set the SSO Status parameter to Disabled in this step. Before you enable user-based SSO, you must complete the SSO settings for the RAM user. Otherwise, you cannot log on as the RAM user. To avoid this issue, you can also use your Alibaba Cloud account to configure user-based SSO.

5. In the Metadata File section, click Upload File to upload the metadata file that you obtained in Step 5: Obtain the metadata file of the SAML IdP in Shibboleth.

6. Select Enabled for Auxiliary Domain Name. In the field that appears, enter the domain name of the email address that you use as the Shibboleth username.

   In this example, enter testdomain.alicloud.com.

7. Click OK.

Step 7: Create a RAM user in the Alibaba Cloud Management Console

1. In the left-side navigation pane of the RAM console, choose Identities > Users.

2. On the Users page, click Create User.

3. On the Create User page, configure the Logon Name and Display Name parameters.

   Note

   Make sure that the logon name and Shibboleth username must contain the same prefix. In this example, the prefix of the logon name is testUser.

4. In the Access Mode section, select Console Access and configure the parameters.

5. Click OK.

Verify the configuration results

After you complete the preceding configurations, you can initiate SSO from Alibaba Cloud or Shibboleth.

• Initiate SSO from Alibaba Cloud

  1. Log on to the RAM console with your Alibaba Cloud account. On the Overview page, copy the logon URL of a RAM user.

  2. Move the pointer over the profile picture in the upper-right corner of the page and click Log Out. Then, paste the logon URL in the address bar of your browser and press Enter. You can also access the URL on a new tab.

  3. Click Login with Organization Account. You are redirected to the logon page of Shibboleth.

  4. On the logon page of Shibboleth, enter the username testUser and its password and click Log On.

     After the logon succeeds, you are redirected to the homepage of the Alibaba Cloud Management Console.

• Initiate SSO from Shibboleth

  1. Access https://<The IP address of the LDAP server>/idp/profile/SAML2/Unsolicited/SSO?providerId=<entityID>.

     Replace <entityID> with the Entity ID that you obtained in Step 1: Download the SAML SP metadata file of Alibaba Cloud.

  2. On the logon page of Shibboleth, enter the username testUser and its password and click Log On.

     After the logon succeeds, you are redirected to the homepage of the Alibaba Cloud Management Console.

FAQ

If issues occur when you verify the configuration results, you can identify the issues by using the /opt/shibboleth-idp/logs/idp-process.log file. The following section provides answers to some frequently asked questions: