After you log on to the CloudSSO user portal, you can view the accounts that you can access in your resource directory and access the resources of the accounts as a Resource Access Management (RAM) role or RAM user.
Step 1: Obtain the URL of the CloudSSO user portal
Log on to the CloudSSO console as a CloudSSO administrator.
In the left-side navigation pane, click Overview.
In the User Logon URL section on the right side of the Overview page, view or copy the logon URL.
NoteIf you enable the accelerated URL feature, CloudSSO users can use the accelerated URL when they log on to the CloudSSO user portal. For more information, see Accelerate access from outside the Chinese mainland.
Step 2: Log on to the CloudSSO user portal
Enter the URL that is obtained from Step 1 in your browser.
Log on to the CloudSSO user portal based on a specified logon method.
Single sign-on (SSO)
Click Redirect to go to the logon page of the enterprise identity provider (IdP).
Use the username and password of the enterprise IdP to log on to the CloudSSO user portal.
Username-password logon
Enter the username and password of the CloudSSO user and click Log On.
Optional. If multi-factor authentication (MFA) is enabled, complete MFA verification.
If this is your first time to log on to the CloudSSO user portal, you must bind an MFA device. For more information, see Bind the first MFA device.
If an MFA device is bound, enter the verification code that is obtained from the mobile device and click Verify.
The logon session for a CloudSSO user is valid for 8 hours. After a CloudSSO user logs on to the CloudSSO user portal, the logon session starts, which is valid for 8 hours. If the logon session expires, the CloudSSO user must log on again.
Step 3: Access the resources of an account in your resource directory
RAM role-based logon
If the resources of a cloud service can be accessed as a RAM role and a CloudSSO user is assigned the access permissions on an account in your resource directory by using an access configuration, the CloudSSO user can access the resources of the account as a RAM role. This method is suitable for most cloud services.
On the Log on as RAM Role tab, click the required account in your resource directory and click Show Details in the Permissions column.
You can select one of the accounts from the account list and access resources of the account based on your business requirements.
NoteIf no data is available in the list, you have no access permissions on the accounts in your resource directory.
In the access configuration list that appears, find the access configuration that you want to use to access resources and click Log On in the Actions column.
You can select one of the access configurations from the list and access the resources of the account based on your business requirements.
NoteIf no data is available in the list, you do not have permissions to access the resources of the account.
Access the resources of the account as a RAM role.
You can move the pointer over the profile picture in the upper-right corner of the console to view the current logon identity.
RAM user-based logon
If a cloud service cannot be accessed as a RAM role and you create a RAM user provisioning for an account in your resource directory by using CloudSSO, you can access the resources of the account as a RAM user.
On the Log on as RAM User tab, find the required account in your resource directory and click Log On in the Actions column.
You can select one of the accounts from the account list and access resources of the account based on your business requirements.
NoteIf no data is available in the list, you have no access permissions on the accounts in your resource directory.
Access the resources of the account as a RAM user.
You can move the pointer over the profile picture in the upper-right corner of the console to view the current logon identity.
