If Elastic Desktop Service is already connected to an enterprise AD, you can refer to this topic to configure SSO between AD FS and Elastic Desktop Service. After SSO is configured, when an end user uses AD credentials to log in to Elastic Desktop Service, they must be authenticated on the AD FS page to log in successfully.
Before you begin
You have integrated your enterprise AD with Elastic Desktop Service and created an enterprise AD office network. For more information, see Create and manage an AD-based office network.
Procedure
This topic uses Active Directory Federation Services (AD FS) on Windows Server 2012 R2 as an example to show how to configure SSO.
Step 1: Configure AD FS as a trusted IdP in Elastic Desktop Service
Obtain the IdP metadata file.
In a browser, enter the following URL to obtain the IdP metadata file.
The URL for the IdP metadata file is: https://<AD server>/FederationMetadata/2007-06/FederationMetadata.xml. Replace <AD server> with the domain name or IP address of your AD FS server.
Download the metadata file to your local computer.
Upload the IdP metadata file in the Elastic Desktop Service console.
Log on to the Elastic Desktop Service console.
In the navigation pane on the left, choose Networks & Storage > Office Network.
On the Office Network page, find the AD office network where you want to enable SSO and click its office network ID.
On the office network details page, in the navigation pane on the left, choose More Information.
In the More Information section, enable SSO and upload the IdP metadata file.
SSO: Turn on the switch to enable SSO.
SSO settings take effect only after you enable this option.
IdP Metadata: Click Upload to upload the metadata file provided by your enterprise IdP.
A status of Completed for IdP Metadata indicates that your enterprise IdP is configured as a trusted SAML IdP.
Step 2: Configure Elastic Desktop Service as a trusted SP in AD FS
Download the metadata file from Elastic Desktop Service.
Log on to the Elastic Desktop Service console.
In the navigation pane on the left, choose Networks & Storage > Office Network.
On the Office Network page, find the AD office network where you want to enable SSO and click its office network ID.
On the office network details page, in the navigation pane on the left, choose More Information.
In the More Information section, next to Application Metadata, click Download Application Metadata File.
Upload the metadata file in AD FS.
Log on to the server where AD FS is deployed and open Server Manager.
In the upper-right corner, choose Tools > AD FS Management.
In the navigation pane on the left of the AD FS window, choose Trust Relationships > Relying Party Trusts.
Add a Relying Party Trust.
In the Actions pane on the right, click Add Relying Party Trust.
Follow the wizard to add the Relying Party Trust.
When you select a data source, select Import data about the relying party from a file and import the SP metadata file that you downloaded.
Edit the claim rule.
In the list of relying party trusts, right-click the newly added Relying Party Trust and select Edit Claim Issuance Policy.
In the dialog box that appears, click Add Rule.
Follow the wizard to configure the rule.
Configure the rule as follows:
From the "Claim rule template" drop-down list, select Send LDAP Attributes as Claims.
Select Active Directory as the "Attribute store". Then, map the SAM-Account-Name or UPN LDAP attribute to the Name ID outgoing claim type.
Next steps
Before you use SSO to log on to the client, ensure that your local computer can access the domain name of your AD FS server.
With SSO configured, end users log on to the Alibaba Cloud Workspace client by entering an office network ID. They are then automatically redirected to the AD FS page, where they enter their enterprise AD username and password for verification. After successful verification, they are logged on.
FAQ
If an end user cannot log on after entering their AD username and password, the cause is likely an AD FS authentication failure. Possible causes and solutions are as follows:
The AD username or password is incorrect.
Log on to the AD domain server to verify the AD username or reset the password.
The AD FS configuration is incorrect. Log on to the AD FS server to check the Relying Party Trust and claim rule configurations.
When you reset a password, we recommend that you do not require the password to be changed at the next logon. If you create a new user or reset a user's password and require the password to be changed at the next logon, the user must log on to the Alibaba Cloud Workspace client with their AD username and password, change the password as prompted, and then use SSO.