Application Real-Time Monitoring Service:Embed the Managed Service for OpenTelemetry console pages in a self-managed web application

Overview

Expected results

After you embed the Managed Service for OpenTelemetry console pages in your self-managed web application based on this topic, you can perform the following operations:

• You can log on to your system and view information about applications, application details, and traces on the embedded console pages.

• You can hide the top navigation bar and left-side navigation pane of the Managed Service for OpenTelemetry console pages.

• You can use Resource Access Management (RAM) to manage permissions on the Managed Service for OpenTelemetry console pages. For example, you can change full permissions to read-only permissions.

Access process

The following figure shows how to access the Managed Service for OpenTelemetry console pages.

Step 1: Create a RAM user and grant permissions to the RAM user

Use your Alibaba Cloud account to create a RAM user and authorize the RAM user to call the AssumeRole operation of Security Token Service (STS).

1. Log on to the RAM console by using an Alibaba Cloud account or a RAM user who has administrative rights.

2. In the left-side navigation pane, choose Identities > Users.

3. On the Users page, click Create User.

4. On the Create User page, configure the Logon Name and Display Name parameters in the User Account Information section. In the Access Mode section, select OpenAPI Access and click OK.

   

   Important

   RAM automatically generates an AccessKey pair for the RAM user. This way, the RAM user can call operations to access the Managed Service for OpenTelemetry console. For security reasons, you can view or download an AccessKey secret in the RAM console only once. Therefore, you must keep the AccessKey secret strictly confidential when you create an AccessKey pair.

5. On the Users page, find the required RAM user and click Add Permissions in the Actions column.

6. In the Select Policy section of the Add Permissions panel, enter a keyword in the search box to search for the AliyunSTSAssumeRoleAccess policy, click the policy to add it to the Selected list on the right, and then click OK.

   

7. Click OK.

8. Click Complete.

Step 2: Create a RAM role and grant permissions to the RAM role

Create a RAM role and authorize the RAM role to access the Managed Service for OpenTelemetry console. This way, the RAM user that you create can assume this RAM role to access the Managed Service for OpenTelemetry console.

1. Log on to the RAM console as a RAM user who has administrative rights.

2. In the left-side navigation pane, choose Identities > Roles.

3. On the Roles page, click Create Role.

4. On the Create Role page, perform the following operations:

   1. In the Select Role Type step, set the Select Trusted Entity parameter to Alibaba Cloud Account and click Next.

   2. In the Configure Role step, configure the RAM Role Name parameter and click OK.

   3. In the Finish step, click Add Permissions to RAM Role.

5. On the page that appears, click Grant Permission on the Permissions tab. In the Select Policy section of the Grant Permission panel, enter a keyword in the search box to search for the policy that you want to attach to the RAM role, click the policy to add it to the Selected list on the right, and then click OK.

   

   • To grant full permissions on Managed Service for OpenTelemetry to the RAM role, select the AliyunTracingAnalysisFullAccess policy.

   • To grant read-only permissions on Managed Service for OpenTelemetry to the RAM role, select the AliyunTracingAnalysisReadOnlyAccess policy.

6. In the Grant Permissions panel, view the authorization result and click Complete.

Step 3: Obtain a temporary AccessKey pair and STS token

Log on to the self-managed web application and call the AssumeRole operation of STS from the web application server to obtain a temporary AccessKey pair and STS token. You can call this operation by using one of the following methods:

• Use OpenAPI Explorer.

• Use RAM SDK for Java.

You must replace the values of the following parameters in the sample code with actual values:

String akId = "<accessKeyId>";
String ak = "<accessKeySecret>";
String roleArn = "<roleArn>";

Replace the <accessKeyId> and <accessKeySecret> variables with the AccessKey ID and AccessKey secret of the RAM user that you create in Step 1. For more information, see Create an AccessKey pair.

Replace the <roleArn> variable with the Alibaba Cloud Resource Name (ARN) of the RAM role that you create. You can obtain the ARN on the details page of the RAM role in the RAM console.

Step 4: Obtain a logon token

After you call the AssumeRole operation of STS to obtain the temporary AccessKey pair and STS token, call the GetSigninToken operation to obtain a logon token.

Sample request:

http://signin4service.aliyun.com/federation?Action=GetSigninToken
    &AccessKeyId=<The temporary AccessKey ID that is returned by STS>
    &AccessKeySecret=<The temporary AccessKey secret that is returned by STS>
    &SecurityToken=<The token that is returned by STS>

Step 5: Generate a logon-free URL

Use the obtained logon token and the URL of a Managed Service for OpenTelemetry console page that you want to embed to generate a logon-free URL. This URL can be used to access the console page from your self-managed web application. This way, you do not need to log on to the Managed Service for OpenTelemetry console.

1. In the Managed Service for OpenTelemetry console, obtain the URL of the console page that you want to embed. For example. the following URL is the URL of the Applications page for the China (Hangzhou) region:

   https://tracing-analysis.console.aliyun.com/?hideTopbar=true&hideSidebar=true#/appList/cn-hangzhou

   Note

   To hide the top navigation bar and the left-side navigation pane of the Managed Service for OpenTelemetry console page, set the hideTopbar and hideSidebar parameters to true.

2. Use the obtained logon token and the URL of the Managed Service for OpenTelemetry console page to generate a logon-free URL for the page. Sample request:

   http://signin.aliyun.com/federation?Action=Login
       &LoginUrl=<The URL to which you are redirected when the logon fails and the 302 HTTP status code is returned on your self-managed website>
       &Destination=<The URL of the Managed Service for OpenTelemetry console page>
       &SigninToken=<The obtained logon token>