Alibaba Cloud Console and BambooCloud IDaaS Authentication Integration (User-Based)
Overview
This article describes how to log in to the Alibaba Cloud console through BambooCloud IDaaS (based on Alibaba Cloud console users).
Reference document: SAML Configuration of Alibaba Cloud SP for User SSO
Prerequisites
The administrator has an Alibaba Cloud account.
The administrator has access to the BambooCloud IDaaS Enterprise Center.
Authentication Configuration
Alibaba Cloud System Configuration
DANGER
After User SSO is enabled, RAM account login will redirect to the identity provider login page. Except for the main account, logging in through RAM account password is not possible.
Log in to the Alibaba Cloud Console as an administrator, go to RAM Access Control > SSO Management > User SSO.
Edit the SSO login settings, upload the IDP metadata provided by IDaaS (saved as an XML file). To download the BambooCloud IDaaS IDP metadata, visit https://{your_domain}/api/v1/saml2/idp/metadata.
Copy the SAML service provider metadata URL, open the link, copy the webpage content, and save it as an sp.xml file.
BambooCloud IDaaS Configuration
Log in to the BambooCloud IDaaS Enterprise Center Resources > Applications > Pre-integrated Applications, and search for Alibaba Cloud.
Import the sp.xml saved in the above step.
Click the application icon Authentication Configuration > Mapping Configuration > Add Mapping, and add a mapping.
Switch to the Authorization Management > Application Account tab to add an account. The account name should be consistent with the sub-user name in Alibaba Cloud.
Login Verification
The following two login methods are available:
Authorized users log in to the BambooCloud IDaaS User Center, click the Alibaba Cloud logo, and single sign-on into the Alibaba Cloud system.
Visit Alibaba Cloud, select RAM account login, enter the account, click Enterprise Account Login, jump to the BambooCloud IDaaS login interface, enter credentials, and log in to Alibaba Cloud.
