Tutorial: How to Configure SAML with AWS
Overview
Access Server supports authentication using SAML with AWS as the identity provider. You can configure this in AWS with Access Server as your service provider using AWS IAM Identity Center.
The following steps walk you through enabling SAML authentication for users and groups from AWS to Access Server.
You need the following to get started:
A deployed Access Server.
With AWS, you must create a custom SAML application.
First, gather information about your Access Server as the service provider (SP).
Sign in to your Access Server Admin Web UI.
Select Authentication → SAML.
You'll need the following information:
SP Identity.
SP ACS.
Now that you have your SP information, you can create a new AWS SAML app and enter that information during app creation:
Sign into your AWS portal and open the IAM Identity Center console.
Under Application assignments, click Applications.
Click Add Application.
Under Custom application, click Add custom SAML 2.0 application, and click Next.
Under Display name, enter the name of your SAML custom app and an optional Description.
Under Application properties, and Application metadata, use the SP information from Access Server to enter the following into the AWS app:
Application ACS URL: Enter the Access Server SP ACS.
Application SAML audience: Enter the Access Server SP Identity.
Relay state - (optional): Enter ‘cws’ for the Client Web UI or ‘profile’ to provide users with a downloadable profile. (See “How to set up IdP-initiated flow” below for more details.)
Click Submit.
Click Assign Users.
Select your users and click Assign Users.
Option 1: Download the AWS metadata file for automatic configuration
Under Applications, click your SAML custom app.
Under the Actions tab, click edit configuration.
Under IAM Identity Center SAML metadata file, click Download.
Option 2: Copy the AWS SAML data for manual configuration
Under Applications, click your SAML custom app.
Under the Actions tab, click edit configuration.
Copy the content in IAM Identity Center sign-in URL, and IAM Identity Center SAML issuer URL.
Click Identity Center Certificate to download the certificate in PEM format.
The simplest way to set up AWS SAML for Access Server is by providing the metadata XML file (option 1), but you can also manually configure it (option 2).
Option 1: Upload the AWS metadata file in the Admin Web UI
Provide the downloaded metadata XML file to your Access Server through the Admin Web UI to automatically configure SAML:
Sign in to the Admin Web UI.
Select Authentication.
Select the SAML tab.
Set Enable SAML authentication to Enabled.
Under Configure Identity Provider (IdP), Select Configure using metadata URL/file.
The Configure using metadata modal displays.
Click Click to upload to select your XML file or drag and drop it into the modal window.
The Identity Provider data populates the corresponding fields.
Select Save and Restart.
Option 2: Manually configure AWS SAML
Sign in to the Admin Web UI.
Select Authentication.
Select the SAML tab.
Set Enable SAML authentication to Enabled.
Under Configure Identity Provider (IdP), manually enter the AWS configuration data into the appropriate fields:
Paste the AWS IAM Identity Center SAML issuer URL into Access Server’s IdP Entity ID.
Paste the AWS IAM Identity Center sign-in URL into Access Server’s SSO (Single Sign-On) Endpoint.
Paste the Okta AWS Identity Center Certificate into Access Server’s Certificate (PEM format).
Select Save and Restart.
You can now enable SAML as the global default authentication or for specific groups and users.
You can configure an IdP-initiated flow for signing into Access Server from AWS with the following steps:
Sign in to the AWS admin portal.
Under Applications, click your custom SAML app.
Under the Actions tab, click edit configuration.
Under Application properties, enter one of the following for Relay state - (optional):
cws: This directs your users to the Client Web UI after sign-in.
profile: This directs your users to a profile download after sign-in.
Save changes.
You can automate group assignments for access control rules using a post-authentication Python script.
Refer to the steps in this tutorial: