All Products
Search

This Product

    Resource Access Management:AssumeRoleWithSAML

    Document Center

    Resource Access Management:AssumeRoleWithSAML

    Last Updated:Jan 19, 2023

    Obtains a Security Token Service (STS) token to assume a Resource Access Management (RAM) role during role-based single sign-on (SSO) by using Security Assertion Markup Language (SAML).

    Operation Description

    Prerequisites

    Authorization information

    There is currently no authorization information disclosed in the API.

    Request parameters

    Parameter Type Required Description Example
    SAMLProviderArn string Yes

    The Alibaba Cloud Resource Name (ARN) of the SAML IdP that is created in the RAM console.

    Format: acs:ram::<account_id>:saml-provider/<saml_provider_id>.

    You can view the ARN in the RAM console or by calling operations.

    		 acs:ram::123456789012****:saml-provider/company1
    RoleArn string Yes

    The ARN of the RAM role.

    The trust entity of the RAM role is a SAML IdP. For more information, see Create a RAM role for a trusted IdP or CreateRole.

    Format: acs:ram::<account_id>:role/<role_name>.

    You can view the ARN in the RAM console or by calling operations.

    		 acs:ram::123456789012****:role/adminrole
    SAMLAssertion string Yes

    The Base64-encoded SAML assertion.

    The value must be 4 to 100,000 characters in length.

    Note A complete SAML response rather than a single SAMLAssertion field must be retrieved from the external IdP.
    		base64_encoded_saml_assertion
    Policy string No

    The policy that specifies the permissions of the returned STS token. You can use this parameter to grant the STS token fewer permissions than the permissions granted to the RAM role.

    • If you specify this parameter, the permissions of the returned STS token are the permissions that are included in the value of this parameter and owned by the RAM role.
    • If you do not specify this parameter, the returned STS token has all the permissions of the RAM role.

    The value must be 1 to 2,048 characters in length.

    		 url_encoded_policy
    DurationSeconds long No

    The validity period of the STS token. Unit: seconds.

    Minimum value: 900. Maximum value: the value of the MaxSessionDuration parameter. Default value: 3600.

    You can call the CreateRole or UpdateRole operation to configure the MaxSessionDuration parameter. For more information, see CreateRole or UpdateRole.

    		 3600
    Note Anonymous users can call the AssumeRoleWithSAML operation because authentication for this operation is performed based on SAML assertions. Therefore, you do not need to specify the following common parameters: Signature, SignatureMethod, SignatureVersion, and AccessKeyId.

    Response parameters

    Parameter Type Description Example
    object

    The response parameters.
    RequestId string

    The ID of the request.

    		 6894B13B-6D71-4EF5-88FA-F32781734A7F
    SAMLAssertionInfo object

    The information in the SAML assertion.
    SubjectType string

    The Format attribute of the NameID element in the SAML assertion. If the Format attribute is prefixed with urn:oasis:names:tc:SAML:2.0:nameid-format:, the prefix is not included in the value of this parameter. For example, if the value of the Format attribute is urn:oasis:names:tc:SAML:2.0:nameid-format:persistent/transient, the value of this parameter is persistent/transient.

    		 persistent
    Subject string

    The value in the NameID sub-element of the Subject element in the SAML assertion.

    		 alice@example.com
    Issuer string

    The value in the Issuer element in the SAML assertion.

    		 http://example.com/adfs/services/trust
    Recipient string

    The Recipient attribute of the SubjectConfirmationData sub-element. SubjectConfirmationData is a sub-element of the Subject element in the SAML assertion.

    		 https://signin.aliyun.com/saml-role/SSO
    AssumedRoleUser object

    The temporary identity that you use to assume the RAM role.
    AssumedRoleId string

    The ID of the temporary identity that you use to assume the RAM role.

    		 34458433936495****:alice
    Arn string

    The ARN of the temporary identity that you use to assume the RAM role.

    		 acs:sts::123456789012****:assumed-role/AdminRole/alice
    Credentials object

    The access credentials.
    SecurityToken string

    The STS token.

    		 ********
    Expiration string

    The time when the STS token expires. The time is displayed in UTC.

    		 2015-04-09T11:52:19Z
    AccessKeySecret string

    The AccessKey secret.

    		 wyLTSmsyPGP1ohvvw8xYgB29dlGI8KMiH2pK****
    AccessKeyId string

    The AccessKey ID.

    		 STS.L4aBSCSJVMuKg5U1****

    Example

    Normal return example

    JSONFormat

    {
  "RequestId": "6894B13B-6D71-4EF5-88FA-F32781734A7F",
  "SAMLAssertionInfo": {
    "SubjectType": "persistent",
    "Subject": "alice@example.com",
    "Issuer": "http://example.com/adfs/services/trust",
    "Recipient": "https://signin.aliyun.com/saml-role/SSO"
  },
  "AssumedRoleUser": {
    "AssumedRoleId": "34458433936495****:alice",
    "Arn": "acs:sts::123456789012****:assumed-role/AdminRole/alice"
  },
  "Credentials": {
    "SecurityToken": "********",
    "Expiration": "2015-04-09T11:52:19Z",
    "AccessKeySecret": "wyLTSmsyPGP1ohvvw8xYgB29dlGI8KMiH2pK****",
    "AccessKeyId": "STS.L4aBSCSJVMuKg5U1****"
  }
}

    Error codes

    Http code Error code Error message
    500 InternalError STS Server Internal Error happened, please send the RequestId to us.
    500 InternalError STS Server Internal Error happened, please send the RequestId to us.

    For a list of error codes, visit the API error center.