Alibaba Cloud RAM Access Control Data Synchronization

Overview

This article describes how to synchronize user data from BambooCloud IDaaS to the Alibaba Cloud RAM Access Control platform, realizing data flow from BambooCloud IDaaS to the Alibaba Cloud RAM Access Control platform.

Prerequisites

You have administrator permissions for the BambooCloud IDaaS Enterprise Center platform. You have administrator permissions for the Alibaba Cloud RAM Access Control platform.

Synchronization Configuration

Alibaba Cloud RAM Access Control Platform

1. Use the administrator account to log in to the Alibaba Cloud RAM Access Control platform.

   

2. Go to RAM Access Control > Users > Create User, and check Console Access and OpenAPI Call Access.

   

3. Save the user and obtain the user's AccessKeyId and AccessKeySecret.

   

4. Click the created account > select Permission Management > Add Authorization > select AliyunRAMFullAccess and AliyunRAMReadOnlyAccess to enable permissions.

   

5. Click Overview > copy the Default Domain Name parameter.

   

BambooCloud IDaaS Configuration

1. Log in to the BambooCloud IDaaS Enterprise Center platform, choose Resources > Applications, add the pre-integrated application Alibaba Cloud RAM, and configure application parameters. Key parameters are as follows.

   

   Parameter	Description
   accessKeyId	The key ID used to identify the user. You can choose an Alibaba Cloud account or RAM account. Based on resource security, it is recommended to use the RAM account accessKeyId. Enter the RAM console, select Identity Management > Users. Click the target RAM user name, and create an AccessKey in the User AccessKey area. Then, in Permission Management > Authorization, add the AliyunRAMFullAccess system policy permission to this RAM account.
   accessKeySecret	The key used to verify the user. You can choose an Alibaba Cloud account or RAM account. Based on resource security, it is recommended to use the RAM account accessKeySecret. Enter the RAM console, select Identity Management > Users. Click the target RAM user name, and create an AccessKey in the User AccessKey area. Then, in Permission Management > Authorization, add the AliyunRAMFullAccess system policy permission to this RAM account.

2. In Application Account Model > Mapping Definition, change the transformation method to Script Expression, and configure the following script. The default Alibaba Cloud address needs to be replaced.

   TIP

   var result = null; result = user.userName + "@Alibaba Cloud default address"; result;

   

3. After configuration is complete, enter the application details, switch to the Authorization Management > Application Account page, click Authorization Policy to enable automatic user authorization, select the user scope, click the Save button, and then click Execute Add.

   

4. After successful execution, switch to the Authorization Management > Synchronization Events page to view the corresponding synchronization event results.

   

   TIP

   • Currently, only user synchronization is supported.