---
title: 'Tutorial: How to Configure SAML with AWS'
canonical: https://openvpn.net/as-docs/tutorials/saml-aws/
product: Access Server Docs
description: How to set up SAML with AWS on Access Server. A step-by-step guide for the configuration of SAML on Access Server with AWS.
---

# Tutorial: How to Configure SAML with AWS

## Overview

Access Server 2.11 and newer supports authentication using SAML with AWS as the identity provider. You can configure this in AWS with Access Server as your service provider using AWS IAM Identity Center.

The following steps walk you through enabling SAML authentication for users and groups from AWS to Access Server.

## Prerequisites

You need the following to get started:

- [AWS IAM Identity Center](https://aws.amazon.com/iam/identity-center/).
- A deployed [Access Server](https://openvpn.net/quick-start-guide/).

> **Important**
>
> We recommend using all lowercase usernames when signing in with SAML.

## Step 1: Create the AWS SAML application

With AWS, you must create a custom SAML application.

First, gather information about your Access Server as the service provider (SP).

1. Sign in to your Access Server Admin Web UI.
2. Select **Authentication → SAML**.
3. You'll need the following information:
   1. **SP Identity**.
   2. **SP ACS**.

Now that you have your SP information, you can create a new AWS SAML app and enter that information during app creation:

1. Sign into your AWS portal and open the [IAM Identity Center console](https://console.aws.amazon.com/singlesignon).
2. Under **Application assignments**, click **Applications**.
3. Click **Add Application**.
4. Under **Custom application**, click **Add custom SAML 2.0 application**, and click **Next**.
5. Under **Display name**, enter the name of your SAML custom app and an optional **Description**.
6. Under **Application properties**, and **Application metadata**, use the SP information from Access Server to enter the following into the AWS app:
   1. **Application ACS URL:** Enter the Access Server **SP ACS**.
   2. **Application SAML audience:** Enter the Access Server **SP Identity**.
   3. **Relay state - (optional):** Enter ‘cws’ for the Client Web UI or ‘profile’ to provide users with a downloadable profile. (See “How to set up IdP-initiated flow” below for more details.)
7. Click **Submit**.
8. Click **Assign Users**.
9. Select your users and click **Assign Users**.

> **Important**
>
> In our testing, AWS SAML IdP produces invalid SAML assertions that violate the XML Schema Definition if no or only one SAML attribute is configured. We therefore recommend configuring two SAML attributes until this problem is fixed by Amazon.
>
> With the AWS SAML app, configure attribute mappings:
>
> 1. Under **Applications**, click your SAML custom app.
> 2. Under the **Actions** tab, click on **edit attribute mappings**.
> 3. Under **Maps to this string value or user attribute in IAM Identity Center**, enter **${user:AttributeName}** and map at least two attributes. For example: If you want your AWS IAM username as the SAML username, enter **${user:subject}**, or if you want your AWS IAM email address, enter **${user:email}**.
> 4. Click **Add new attribute mapping**.
> 5. Under **User attribute in the application**, enter **name**.
> 6. **Under Maps to this string value or user attribute in IAM Identity Center**, enter **email**.
> 7. Click **Save changes**.

### Option 1: Download the AWS metadata file for automatic configuration

1. Under **Applications**, click your SAML custom app.
2. Under the **Actions** tab, click **edit configuration**.
3. Under **IAM Identity Center SAML metadata file**, click **Download**.

### Option 2: Copy the AWS SAML data for manual configuration

1. Under **Applications**, click your SAML custom app.
2. Under the **Actions** tab, click **edit configuration**.
3. Copy the content in **IAM Identity Center sign-in URL**, and **IAM Identity Center SAML issuer URL**.
4. Click **Identity Center Certificate** to download the certificate in PEM format.

## Step 2: Configure AWS SAML data with Access Server

The simplest way to set up AWS SAML for Access Server is by providing the metadata XML file (option 1), but you can also manually configure it (option 2).

### Option 1: Upload the AWS metadata file in the Admin Web UI

Provide the downloaded metadata XML file to your Access Server through the Admin Web UI to automatically configure SAML:

1. Sign into your Access Server Admin Web UI.
2. Click **Authentication \> SAML**.
3. Click **Configure Identity Provider (IdP) Automatically via Metadata** to expand the section.
4. Click **Choose File** for **Select IdP Metadata File**.
5. Select your AWS metadata XML file, click **Upload**, and click **Update Running Server**.
6. The IdP fields are now populated under **Configure Identity Provider (IdP) Manually**.

### Option 2: Manually configure AWS SAML

1. Sign into your Access Server Admin Web UI.
2. Click **Authentication \> SAML**.
3. Click **Configure Identity Provider (IdP) Manually** to expand the section.
4. Paste the following from AWS to the Access Server fields:
   1. Paste the **AWS IAM Identity Center sign-in URL** into Access Server’s **Sign On Endpoint**.
   2. Paste the **AWS IAM Identity Center SAML issuer URL** into Access Server’s **IdP EntityId**.
   3. Paste the **AWS Identity Center Certificate** into Access Server’s **Certificate (PEM format)**.
5. Select **Save Settings** and **Update Running Server**.
   - The IdP fields save.

## Step 3: Assign SAML as user authentication

Once you’ve provided the SAML configuration for your IdP, you can enable it for users.

1. Sign in to the Admin Web UI.
2. Select **Authentication → SAML**.
3. Select the toggle to turn on **Enable SAML authentication**.
4. Select **Save Settings** and **Update Running Server**.

You can now enable SAML as the [global default authentication](https://openvpn.net/as-docs/tutorials/saml-default-auth.md) or for [specific groups and users](https://openvpn.net/as-docs/tutorials/saml-users-groups.md).

## Optional: How to set up IdP-initiated flow

You can configure an IdP-initiated flow for signing into Access Server from AWS with the following steps:

1. Sign in to the AWS admin portal.
2. Under **Applications**, click your custom SAML app.
3. Under the **Actions** tab, click **edit configuration**.
4. Under **Application properties**, enter one of the following for **Relay state - (optional)**:
   - **cws:** This directs your users to the Client Web UI after sign-in.
   - **profile:** This directs your users to a profile download after sign-in.
5. Save changes.

## Optional: Map group access control

You can automate group assignments for access control rules using a post-authentication Python script.

Refer to the steps in this tutorial:

- [Tutorial: How to Set Up SAML Group Mapping with a Post-Auth Script](https://openvpn.net/as-docs/tutorials/tutorial--post-auth-saml-group-mapping.md)

---

Prev: [Tutorial: How to Configure SAML with Auth0](https://openvpn.net/as-docs/tutorials/saml-auth0.md)
Next: [Tutorial: How to Configure SAML with PingOne SSO](https://openvpn.net/as-docs/tutorials/saml-pingone.md)
Index: https://openvpn.net/as-docs/llms.txt