> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation.

# Role-based Alibaba Cloud

Role-based Alibaba Cloud allows an enterprise to manage users in IDaaS without the need to synchronize users from IDaaS to Alibaba and allows users of the enterprise to access Alibaba Cloud using a specific RAM role. See <https://www.alibabacloud.com/help/en/ram/user-guide/role-based-sso-by-using-saml/> for more information.

note

This procedure was tested using Identity as a Service 5.36 and Alibaba Cloud. Other versions of Alibaba Cloud may require integration and configuration steps that differ from those documented in this procedure. For newer versions of Alibaba Cloud, use this procedure as a starting point for integrating Alibaba Cloud. In the event of other issues, contact <support@entrust.com> for assistance.

## Prerequisites

Before you begin, open two browser windows: one for Alibaba Cloud and one for IDaaS.

## Step 1: Download the metadata file from Alibaba Cloud and create a role and Trusted Entity as an Identity Provider

1. Login into Alibaba Cloud as a RAM user. The **Overview** page appears. Use this [link](https://account.alibabacloud.com/login/login.htm?oauth_callback=https://ram.console.aliyun.com/?spm=a2c63.p38356.0.0.7de65064dCOA11&lang=en) to log in.
2. On the left side, click **SSO**. The **SSO** page appears.
3. Click the **Role-Based SSO** tab.
4. Click **Copy** to copy the SAML metadata and paste it in a text file, such as Notepad.
5. Save the file in XML format.
6. **Download File** to download the **Metadata File**.

Leave this page open to return to later in this procedure.

## Step 2: Add role-based Alibaba Cloud to Identity as a Service

1. In Identity as a Service, navigate to **Security** > **Applications**. The **Applications Lists** page appears.

2. Click **Add**. The **Select an Application Template** page appears.

3. Do one of the following:

   - Select **SAML Cloud Integrations** from the search drop-down list and scroll to find the application you want to add to IDaaS.
   - In the **Search bar**, enter a search option to filter for the application you want to add to IDaaS.

4. Click **Alibaba Cloud**. The **Add Alibaba Cloud** page appears.

5. Enter an **Application Name**.

6. Enter an **Application Description**.

7. Optional. Add a custom application logo.

   1. Click **Add** next to **Application Logo**. The **Upload Logo** dialog box appears.
   2. Click **Upload** to select an image file to upload.
   3. Browse to select your file and click **Open**. The **Upload Logo** dialog box reappears showing your selected image.
   4. If required, resize your image.
   5. Click **OK**.

8. Select the **Authentication Flow** that appears to users during login.

9. Click **Next**. The **General** page appears.

10. Click **Upload Metadata XML** and navigate to upload the metadata file you downloaded in _Step 1: Download the role-based metadata file from Alibaba Cloud._

11. Enter the **Max Authentication Age (seconds)** to set the maximum amount of time that can elapse before a user is required to reauthenticate during a new login attempt. This applies for both SP-initiated and IDP-initiated login. Set this field to -1 to disable this feature.

12. From the **SAML NameID Attribute** drop-down list, select **Email**.

13. Select the **SAML Signing Certificate** from the drop-down list.

14. From the **SAML NameID Encoding Format**, select **Transient**.

15. Optional: Select **Respond Immediately for Unsuccessful Responses** to return to the application immediately after a login failure, rather than allow user to try again with a different userID.

16. Deselect **Enable Go Back Button** if you do not want users to be able to go back to the Alibaba Cloud login page to log in.

17. Select **Show Default Assertion Consumer URL Service in the My Profile**. When selected, the Default Assertion Consumer URL appears in a user's My Profile page in addition to relay states and Alternative Assertion Consumer URLs.

18. Add three **SAML Attributes**, as follows:

    1. Add the role attribute, as follows:

       1. Click **Add**. The **Add Attribute** dialog box appears.

       2. In the **Name** field, enter: `https://www.aliyun.com/SAML-Role/Attributes/Role`.

       3. In the **Value** field, enter `acs:ram::$account_id:role/role1,acs:ram::$account_id:saml-provider/provider1`

    note
    You will edit this value after the adding IDaaS as an IdP to Alibaba.

    4. Click **Add** to return to the **Add Application page.**

    5. Add the user id attribute, as follows:

       1. Under **SAML Attributes**, click **Add**.
       2. In the **Name** field, enter `https://www.aliyun.com/SAML-Role/Attributes/RoleSessionName`.
       3. In the **Value** field, enter user_id.
       4. Click **Add** to return to the **Add Application** page.

    6. Add the session duration attribute, as follows:

       1. Under **SAML Attributes**, click **Add**.
       2. In the **Name** field, enter: `https://www.aliyun.com/SAML-Role/Attributes/SessionDuration`.
       3. In the **Value** field, enter 1800.
       4. Click **Add** to return to **the** Add Application page.

19. Leave the remaining settings at the default values.

20. Leave this page open. You need to return to it.

## Step 3: Download the metadata from Identity as a Service

1. In Identity as a Service, navigate to **Security** > **Applications**. The **Applications List** page appears.
2. Do one of the following:
   - Click the **Download** icon next to the application you are integrating with Identity as a Service.
   - Click the **More Options** menu next to the application you are integrating with Identity as a Service and select **SAML IDP Metadata**.
3. The **SAML Application Metadata** dialog box appears.
4. **Select the certificate to include in the SAML IDP Metadata file** from the drop-down list.
5. If applicable, **Select the domain to include in the SAML IDP Metadata** file from the drop-down list.
6. Enter the **Lifetime, in days, for the SAML IDP Metadata file**. The value must be between 2 and 730.
7. Do one of the following, as required:
   - Copy the **Public Endpoint** to paste into your SAML application being used Identity Provider authentication.
   - Click **Download**.

note

If you are using multiple domains, you must download each domain's metadata file separately because the values in the metadata file vary for each domain.

## Step 4: Configure role-based Alibaba Cloud with IDaaS

To configure role-based Alibaba Cloud for SSO with IDaaS, you need to create a role and add IDaaS as a Trusted Entity.

1. Return to the page you left open in _Step 1: Download the metadata file from Alibaba Cloud_.

2. Click **Add IdP**. The **Add IdP** page appears.

3. Enter an **IdP Name**. For example, IDaaS.

4. Click **Upload Metadata File** and browse to upload the metadata file you downloaded in _Step 4: Download the metadata from Identity as a Service_.

5. Click **OK**.

6. In the left tab, click **Roles**. The **Roles** page appears.

7. Click **Create Role**. The **Create Role** page appears.

8. Select **IdP** as the **Trusted Entity**.

9. Click **Next** to **Configure the role**.

10. Enter the **RAM Role Name**. For example, IDaaStrole.

11. From the **IdP Type** drop-down list, select **SAML**.

12. From the **Select IdP** drown-down list, select the IDP you created in step 2 above.

13. Click **OK**.

14. Click **Add Permissions to Role**. The **Edit Role** page appears.

15. Click the **Grant Permissions** tab. The **Grant Permission** dialog box appears.

16. Expand **Policy** and select **AdministratorAccess**.

17. Click **Grant Permission**.

18. Click **Close**.

19. Refresh your browser to apply the changes.

20. In the left pane, click **SSO**.

21. Click the name of your new IdP. For example, IDaaS. The **IdP Details** page appears. The **IdP Details** displays an **ARN** value. For example:

    > `acs:ram::123456789009:saml-provider/IDaaS`

22. Open a text file, such as Notepad, and copy the following values from the ARN:

    - The numeric value for the ARN. For example, 123456780004. This value replaces $account_id.
    - The IDP name, for example, IDaaS. This value replaces provider1.
    - Record the name of the role you created in this step, for example, IDaaSRole. This value replaces role1.

23. You add these values to IDaaS in the next step.

24. Close the **IdP Details** page.

## Step 5: Add the ARN values to IDaaS

1. Return to the **Add Alibaba Cloud** page you left open in _Step 2: Add Alibaba Cloud to IDaaS_.

2. Go to the **Value** you added for the role SAML attribute. It appears as follows:

   > `acs:ram::$account_id:role/role1,acs:ram::$account_id:saml-provider/provider1`

3. Edit the **Value** with the following changes:

   - Replace both instances of $account*id with the ARN numeric value you copied in \_Step 4: Configure role-based Alibaba Cloud for SSO with IDaaS*.
   - Replace provider1 with the name of the IDP you created in _Step 4: Configure role-based Alibaba Cloud with IDaaS_.
   - Replace role1 with the name of the role you created in _Step 4: Configure role-based Alibaba Cloud with IDaaS_.

4. Click **Submit**.

## Step 6: Add a resource rule

See [Create resource rules](/docs/authentication-and-security/create-and-manage-resource-rules.md).

## Step 7: Test the integration

### Testing Identity as a Service redirect log in

1. Log in to your Identity as a Service account.
2. Go to your **My Profile** page if you are not already there.
3. Under **Applications**, click **Alibaba Cloud**.
4. Respond to the second-factor authentication challenge. If you respond successfully, you are logged in to role-based Alibaba Cloud.