---
title: 'Tutorial: How to Configure SAML with AWS'
canonical: https://openvpn.net/as-docs/v3/tutorials/tutorial--saml-aws/
product: Access Server Docs
description: How to set up SAML with AWS on Access Server. A step-by-step guide for the configuration of SAML on Access Server with AWS.
---

# Tutorial: How to Configure SAML with AWS

## Overview

Access Server supports authentication using SAML with AWS as the identity provider. You can configure this in AWS with Access Server as your service provider using AWS IAM Identity Center.

The following steps walk you through enabling SAML authentication for users and groups from AWS to Access Server.

## Prerequisites

You need the following to get started:

- [AWS IAM Identity Center](https://aws.amazon.com/iam/identity-center/).
- A deployed [Access Server](https://openvpn.net/quick-start-guide/).

> **Important**
>
> We recommend using all lowercase usernames when signing in with SAML.

## Step 1: Create the AWS SAML application

With AWS, you must create a custom SAML application.

First, gather information about your Access Server as the service provider (SP).

1. Sign in to your Access Server Admin Web UI.
2. Select **Authentication → SAML**.
3. You'll need the following information:
   1. **SP Identity**.
   2. **SP ACS**.

Now that you have your SP information, you can create a new AWS SAML app and enter that information during app creation:

1. Sign into your AWS portal and open the [IAM Identity Center console](https://console.aws.amazon.com/singlesignon).
2. Under **Application assignments**, click **Applications**.
3. Click **Add Application**.
4. Under **Custom application**, click **Add custom SAML 2.0 application**, and click **Next**.
5. Under **Display name**, enter the name of your SAML custom app and an optional **Description**.
6. Under **Application properties**, and **Application metadata**, use the SP information from Access Server to enter the following into the AWS app:
   1. **Application ACS URL:** Enter the Access Server **SP ACS**.
   2. **Application SAML audience:** Enter the Access Server **SP Identity**.
   3. **Relay state - (optional):** Enter ‘cws’ for the Client Web UI or ‘profile’ to provide users with a downloadable profile. (See “How to set up IdP-initiated flow” below for more details.)
7. Click **Submit**.
8. Click **Assign Users**.
9. Select your users and click **Assign Users**.

> **Important**
>
> In our testing, AWS SAML IdP produces invalid SAML assertions that violate the XML Schema Definition if no or only one SAML attribute is configured. We therefore recommend configuring two SAML attributes until this problem is fixed by Amazon.
>
> With the AWS SAML app, configure attribute mappings:
>
> 1. Under **Applications**, click your SAML custom app.
> 2. Under the **Actions** tab, click on **edit attribute mappings**.
> 3. Under **Maps to this string value or user attribute in IAM Identity Center**, enter **${user:AttributeName}** and map at least two attributes. For example: If you want your AWS IAM username as the SAML username, enter **${user:subject}**, or if you want your AWS IAM email address, enter **${user:email}**.
> 4. Click **Add new attribute mapping**.
> 5. Under **User attribute in the application**, enter **name**.
> 6. **Under Maps to this string value or user attribute in IAM Identity Center**, enter **email**.
> 7. Click **Save changes**.

### Option 1: Download the AWS metadata file for automatic configuration

1. Under **Applications**, click your SAML custom app.
2. Under the **Actions** tab, click **edit configuration**.
3. Under **IAM Identity Center SAML metadata file**, click **Download**.

### Option 2: Copy the AWS SAML data for manual configuration

1. Under **Applications**, click your SAML custom app.
2. Under the **Actions** tab, click **edit configuration**.
3. Copy the content in **IAM Identity Center sign-in URL**, and **IAM Identity Center SAML issuer URL**.
4. Click **Identity Center Certificate** to download the certificate in PEM format.

## Step 2: Configure AWS SAML data with Access Server

The simplest way to set up AWS SAML for Access Server is by providing the metadata XML file (option 1), but you can also manually configure it (option 2).

### Option 1: Upload the AWS metadata file in the Admin Web UI

Provide the downloaded metadata XML file to your Access Server through the Admin Web UI to automatically configure SAML:

1. Sign in to the Admin Web UI.
2. Select **Authentication**.
3. Select the **SAML** tab.
4. Set **Enable SAML authentication** to **Enabled**.
5. Under **Configure Identity Provider (IdP)**, Select **Configure using metadata URL/file**.
   - The **Configure using metadata** modal displays.
6. Click **Click to upload** to select your XML file or drag and drop it into the modal window.
   - The Identity Provider data populates the corresponding fields.
7. Select **Save** and **Restart**.

### Option 2: Manually configure AWS SAML

1. Sign in to the Admin Web UI.
2. Select **Authentication**.
3. Select the **SAML** tab.
4. Set **Enable SAML authentication** to **Enabled**.
5. Under **Configure Identity Provider (IdP)**, manually enter the AWS configuration data into the appropriate fields:
   - Paste the **AWS IAM Identity Center SAML issuer URL** into Access Server’s **IdP Entity ID**.
   - Paste the **AWS IAM Identity Center sign-in URL** into Access Server’s **SSO (Single Sign-On) Endpoint**.
   - Paste the Okta **AWS Identity Center Certificate** into Access Server’s **Certificate (PEM format)**.
6. Select **Save** and **Restart**.

## Step 3: Assign SAML as user authentication

You can now enable SAML as the [global default authentication](https://openvpn.net/as-docs/v3/tutorials/tutorial--saml-default-auth.md) or for [specific groups and users](https://openvpn.net/as-docs/v3/tutorials/tutorial--saml-users-groups.md).

## Optional: How to set up IdP-initiated flow

You can configure an IdP-initiated flow for signing into Access Server from AWS with the following steps:

1. Sign in to the AWS admin portal.
2. Under **Applications**, click your custom SAML app.
3. Under the **Actions** tab, click **edit configuration**.
4. Under **Application properties**, enter one of the following for **Relay state - (optional)**:
   - **cws:** This directs your users to the Client Web UI after sign-in.
   - **profile:** This directs your users to a profile download after sign-in.
5. Save changes.

## Optional: Map SAML group access control

You can automate group assignments for access control rules using a post-authentication Python script.

Refer to the steps in this tutorial:

- [Tutorial: How to Set Up SAML Group Mapping with a Post-Auth Script](https://openvpn.net/as-docs/v3/tutorials/tutorial--post-auth-saml-group-mapping.md)

---

Prev: [Tutorial: How to Configure SAML with Auth0](https://openvpn.net/as-docs/v3/tutorials/tutorial--saml-auth0.md)
Next: [Tutorial: How to Configure SAML with PingOne SSO](https://openvpn.net/as-docs/v3/tutorials/tutorial--saml-pingone.md)
Index: https://openvpn.net/as-docs/llms.txt