Configure single sign-on (SSO) for Elastic Desktop Service using Active Directory Federation Services (AD FS) so that end users can log on with their Active Directory (AD) credentials. Once configured, users who enter an AD office network ID are redirected to AD FS for authentication before accessing their cloud computers.
This guide uses AD FS on Windows Server 2012 R2 as an example.
Prerequisites
Before you begin, ensure that you have:
An enterprise AD system integrated with Elastic Desktop Service
An AD office network created
For instructions, see Create and configure an AD office network.
Overview
Completing SSO setup requires two steps performed in order:
Configure AD FS as a trusted SAML identity provider (IdP) in Elastic Desktop Service — upload the AD FS metadata file to the Elastic Desktop Service console.
Specify Elastic Desktop Service as a trusted SAML service provider (SP) in AD FS — import the Elastic Desktop Service metadata file into AD FS and configure claim rules.
This topic describes how to configure SSO for Elastic Desktop Service by using AD FS. In this topic, AD FS in Windows Server 2012 R2 is used as an example.
Step 1: Configure AD FS as a trusted SAML IdP in Elastic Desktop Service
1.1 Get the AD FS metadata file
Open a browser and navigate to the following URL, replacing
<AD server>with the domain name or IP address of your AD FS server:https://<AD server>/FederationMetadata/2007-06/FederationMetadata.xmlDownload the metadata file to your local computer.
1.2 Upload the metadata file to Elastic Desktop Service
Log on to the Elastic Desktop Service Enterprise console.
In the left-side navigation pane, choose Networks & Storage > Office Networks.
On the Office Networks page, click the ID of the AD office network for which you want to enable SSO.
In the left-side navigation pane of the office network details page, choose Other Information.
In the Other Information section, configure the following settings:
SSO: Enable SSO for the office network. > Note: SSO is disabled by default. Configurations take effect only after SSO is enabled.
Metadata File: Click Upload File and upload the AD FS metadata file.
Verify that the IdP Metadata status shows Completed. This confirms that AD FS is registered as a trusted SAML IdP.
Step 2: Specify Elastic Desktop Service as a trusted SAML SP in AD FS
2.1 Download the Elastic Desktop Service metadata file
Log on to the Elastic Desktop Service Enterprise console.
In the left-side navigation pane, choose Networks & Storage > Office Networks.
On the Office Networks page, click the ID of the AD office network for which SSO is enabled.
In the left-side navigation pane of the office network details page, choose Other Information.
In the Other Information section, click Download Metadata File next to Application Metadata to download the file to your local computer.
2.2 Import the metadata file into AD FS
Log on to the server where AD FS is installed and open Server Manager.
In the upper-right corner, choose Tools > AD FS Management.
In the left-side navigation pane of the AD FS window, choose Trust Relationships > Relying Party Trusts.
In the Actions section on the right, click Add Relying Party Trust and follow the wizard.
In the Select Data Source step, select Import data about the relying party from a file and import the Elastic Desktop Service metadata file downloaded in step 2.1.
2.3 Configure claim rules
In the list of relying party trusts, right-click the trust you added and select Edit Claim Issuance Policy.
In the dialog box, click Add Rule and follow the wizard:
Choose Rule Type: Select Send LDAP Attributes as Claims from the Claim rule template drop-down list.
Configure Claim Rule: Select Active Directory from the Attribute store drop-down list. In the Mapping of LDAP attributes to outgoing claim types section, map one of the following LDAP attributes to Name ID:
LDAP attribute Outgoing claim type SAM-Account-Name Name ID UPN Name ID
What's next
After SSO is configured, end users who enter the AD office network ID are redirected to the AD FS authentication page. After AD FS authenticates their credentials, users are logged on to their Alibaba Cloud Workspace clients and connected to their cloud computers.
Before end users log on using SSO, make sure they can access the AD FS domain name server.
Troubleshooting
End users cannot log on after entering valid AD credentials
The most common cause is an incorrect username or password. Log on to the AD domain server to verify the username or reset the password.
When resetting a password, do not select the User must change password at next logon check box. If this check box was selected when creating the AD user or resetting the password, complete the required password change before using SSO. After the password is reset, the user can log on with the updated credentials.
If the username and password are correct, check the relying party trust configurations and claim rules in AD FS.