Resource Access Management:Configure the SAML settings of Alibaba Cloud for user-based SSO

Procedure

1. Log on to the RAM console by using an Alibaba Cloud account.

2. In the left-side navigation pane, choose Integrations > SSO.

3. On the page that appears, click the User-based SSO tab and view the configuration in the Setup SSO section.

4. Click Edit. In the SSO Settings dialog box, modify the configuration.

   • SSO Status: Select Enabled or Disabled.

     Note

     The configuration of SSO Status applies only to RAM users of your Alibaba Cloud account and does not affect the logon of your Alibaba Cloud account. The configuration also does not affect AccessKey pair-based API calls.

     • By default, the Disabled option is selected for SSO Status. If the default configuration is retained, SSO settings do not take effect, and RAM users can use their passwords to log on to the system.

     • If you select the Enabled option for SSO Status, RAM users cannot use their passwords to log on to the system. Instead, the RAM users must log on to an IdP service for identity authentication. If you select the Disabled option again for SSO Status, password-based logon is automatically restored.

   • Metadata File: Click Upload File to upload the metadata file that is provided by your IdP.

     Note

     In most cases, the metadata file is provided in the XML format. The file contains the logon URL and X.509 public key certificate that is used to verify the validity of the SAML assertions issued by the IdP.

   • Auxiliary Domain Name: Optional. If you select the Enabled option, you can enter an auxiliary domain name.

     • After you enter an auxiliary domain name, you can use the auxiliary domain name as the suffix of the NameID element in SAML assertions.

     • If you select the Disabled option, you can use only the default domain name or domain alias of your Alibaba Cloud account as the suffix of the NameID element in SAML assertions.

     For more information about the values of the NameID element, see SAML response for user-based SSO.

     Note

     If you configure both a domain alias and an auxiliary domain name, only the domain alias or the default domain name can be used as the suffix of the NameID element.

5. Click OK.