IAMUser GuideIdentitiesSingle Sign-onRole SSOSAML Response for Role SSO
Copy page
Download PDF
Role SSO
SAML Response for Role SSO
Copy page
Download PDF
SAML Response for Role SSO
This article introduces the basic requirements for Volcano Engine to configure SAML Response parameters at the IDP when completing SAML 2.0-based role SSO.
SSO basic flow Please refer to: Roles SSO Overview .
The SAML response is sent by the IDP to Volcano Engine when the user logs into the IDP and requests to log into Volcano Engine. Volcano Engine realizes safe and fast SAML SSO login for users by verifying the signature in the SAML response and parsing the current user identity information passed in the SAML response.
The Issuer value must be the same as the EntityID element in the user SSO SAML metadata file that you upload in the Volcano Engine console settings. Volcano Engine needs to verify this field to ensure that the identity provider requesting login is an identity provider that has completed the trust configuration.
Signature
Based on the protocol specification, Volcano Engine requires that SAML responses must be signed and can be validated based on the security certificate information in the IDP metadata file to ensure the security and trustworthiness of the response content. Please sign in the corresponding position of the Response example. The Signature must contain the signature value, signature algorithm, and other information.
Subject
Subject must contain the following elements:
There is one and only one NameID element, and the Volcano Engine role SSO has no requirement for the NameID value, which is usually used to identify the identity of the enterprise user. You can specify the NameID value according to the SAML protocol specification.
In the SubjectConfirmation element, the following fields need to contain unique valid values:
NotOnOrAfter: used to specify the assertion valid period, UTC time.
Recipient：Volcano Engine needs to verify that it is indeed the recipient of the current response based on Recipient, which must be https://signin.volcengine.com/saml/sso
Within the Conditions element, you must include an AudienceRestriction element that contains a uniquely valid Audience element that specifies the audience for the response. It must contain a fixed value that matches the value of the EntityID in the role SSO SAML metadata file provided by Volcano Engine in the format https://www.volcengine.com/
Example of the Conditions element:
In the AttributeStatement element, the following two Attribute elements must be included:
Identity attributes
The Name of the property is a fixed value https://www.volcengine.com/SAML/Attributes/Identity
The value of the attribute is used to declare information about the IAM role used for SSO login. Contains at least one attribute value and can contain multiple attribute values, that is, an enterprise user can map multiple roles, and if there are more, they will be listed on the login page for selection. The value is the character Trn, and the format is:
trn:iam::${AccountID}:role/${RoleName},trn:iam::${AccountID}:saml-provider/${SAMLProviderName}。
   Where AccountID is your Volcano Engine account ID, RoleName is the IAM role name, and SAMLProviderName is the identity provider name.
Session name property. This property must be included.
The Name of the property is a fixed value https://www.volcengine.com/SAML/Attributes/SessionName
The value of the property is used to specify the session name. You must include a property value that can be customized for name display and auditing after login.
Session duration properties. Optionally include this attribute, and at most one.
The value of the property is used to specify the duration of the role login. If this attribute is not passed, the maximum login time for the default role is 3600 seconds. If you pass this property, you must include a property value between 900 and 43200 seconds, which is used to specify the login time of the role.
IAM
Copy page
Download PDF