Alibaba Cloud IDaaS SAML
Create SAML application in Alibaba Cloud IDaaS
Login to the Alibaba Cloud management console, search and go to the Application Indentity Service (IDentity-as-a-Service, IDaaS).
Click EIAM Instance List and open the free version.
An instance will be created and run automatically after opening. Click on the instance name or the Manage button to enter the IDaaS management console.
After entering the IDaaS management console, click Add Application, search for SAML, and click Add Application.
Click Add SigningKey.
Fill in all required information and submit.
Select the added SigningKey.
Fill in all the required information below and submit.
- IDP IdentityId: Keep the same as Issuer URL in Casdoor.
- SP Entity ID & SP ACS URL (SSO Location): Use placeholders for now; after configuring Casdoor, set both to
https://<your-casdoor-domain>/api/acs. - Assertion Attribute: Directly fill in as username.
- Account Association Mode: Account Association
The ACS URL (/api/acs) only accepts POST requests. Ensure your IdP is configured to use HTTP POST binding.
Account authorization & association
After the application is successfully added, an authorization prompt will pop up. Do not authorize it now, add an account and then authorize it.
Go to Organizations and Groups and click on New Account.
Fill in all required information and submit.
Go to Application Authorization, select the accounts you want to authorize and click Save.
Go to the Application List, click View application sub-accounts, and then click Add account association.
Fill in the primary and sub accounts that need to be associated and click Save.
The primary account exists in IDaaS, and the sub account is the ID of the user in Casdoor.
Export IDaaS Metadata
Go to the Application List, click View Application Details and click Export IDaaS SAML Metadata.
Configure in Casdoor
Create a new provider in Casdoor.
Set Category to SAML, Type to Alibaba Cloud IDaaS. Copy the content of metadata and paste it to the Metadata input. The values of Endpoint, IdP and Issuer URL will be generated automatically after clicking the Parse button.
Copy the SP ACS URL and the SP Entity ID and click the Save button.
Edit the application you want to configure in Casdoor. Select the provider just added and click the button Save.
Modify SAML application in Alibaba Cloud IDaaS
Disable the application and then click Modify Application.
Fill in SP Entity ID and SP ACS URL(SSO Location) with the content copied in Casdoor. Submit and enable application.
Test
Open the application’s login page; an IDaaS icon appears. Click it to sign in via Alibaba Cloud IDaaS; after success you are logged into Casdoor.
