Alibaba Cloud IDaaS Single Sign-On Example¶
Use Cases¶
Alibaba Cloud IDaaS (Yundun) is an identity and access management solution provider. Guance supports federated authentication based on SAML 2.0 (Security Assertion Markup Language 2.0), an open standard used by many identity providers (IdPs). You can integrate Yundun with Guance through SAML 2.0 federated authentication, enabling automatic login (single sign-on) with Yundun accounts to Guance platform and access the corresponding workspace resources, without having to create separate Guance accounts for your enterprise/team.
Configuration Steps¶
- Create an application in Alibaba Cloud IDaaS
Note: Before creating an application, you need to register an account and create your organization on the IDaaS platform (Yundun).
1) Open the IDaaS console, go to Add Application > Standard Protocol, and select to create a SAML 2.0 SSO application. (Here, take the Guance application as an example.)
2) After creating the application, click Manage to enter the application configuration interface. Before configuring single sign-on, you can configure the application account and authorization first.
① Add an application account
② In this example, all members are authorized by default. If special authorization is required, click Authorization to change the permission configuration.
1) After configuring the application account and authorization, go to the Single Sign-On page, locate the Application Configuration Information section, and click Download to obtain the IdP metadata file.
- Enable SSO in Guance and update the configuration in the IDaaS platform
1) Enable SSO single sign-on. In the Guance workspace, go to Management > Member Management > SSO Management, and click Enable.
Refer to Create SSO.
Note: For account security, Guance supports only one SSO configuration per workspace. If you have previously configured SAML 2.0, the last updated SAML 2.0 configuration will be used as the final single sign-on verification entry.
2) Upload the metadata document downloaded in Step 1, configure the domain name (email suffix domain), select the role, and you will obtain the Entity ID and Assertion Consumer Service URL of this identity provider. Download the Service Provider metadata data (you can access the link information via a browser, right-click, and save).
Note: The domain name is used to map the email domain between Guance and the identity provider for single sign-on. That is, the suffix domain of the user's email must be consistent with the domain added in Guance.
1) Update the single sign-on configuration of the application on the IDaaS side
① Import the Service Provider (SP) metadata file obtained in step 2.
② After importing the metadata, click Parse to automatically import the ACS URL and Entity ID parameters below.
③ Change the Application Account configuration to IDaaS Account / Email.
④ Expand Advanced Configuration. (In SaaS environments, assertion signing is enabled by default; in Deployment Plan (PaaS) environments, this parameter is disabled by default. After configuring the application information, you need to manually enable this parameter.)
⑤ Add an Assertion Attribute, Key = "Email", Value = "user.email".
⑥ Click Save Configuration.
- Obtain the single sign-on URL
1) Access https://auth.guance.com/login/sso through Single Sign-On and enter your email address to obtain the login link. As shown below:
2) Click the Login URL provided on the SSO login configuration details page to access. As shown below:
- Click the link to redirect to IDaaS, enter your username and password, and after verification is complete, you will be logged in to Guance. After logging in, as shown below:
1) Enter your username and password on the IDaaS platform to log in.
2) After successful login, the Guance page is displayed.
Note: If multiple workspaces have configured the same identity provider SSO single sign-on, after users log in to a workspace via SSO, they can click the workspace option in the upper left corner of Guance to switch between different workspaces and view data.
