DocsICP FilingConsole
Documentation
Home Page Identity as a Service EIAM User Guide Application Management Standard Applications Common application configurations AWS SSO

AWS SSO

Updated at:
Copy as MD
Product
My Favorites

Configure single sign-on for AWS users in IDaaS.

Procedure

1. Configure IDaaS

  1. Create an AWS application.

    1. Log on to the IDaaS console, select an IDaaS instance, and click Console below the Actions column.

    2. Go to Applications > Add Application > Marketplace, search for AWS IAM Identity Center SSO, and click Add Application.

    3. Confirm the application name, and then click Add.

  2. Configure single sign-on for the application. On the Sign-In > SSO tab, configure the following parameters.

    Parameter

    Description

    SSO

    Set to Enabled.

    AWS SSO Sign-in URL

    Enter the AWS access portal sign-in URL provided by AWS IAM Identity Center.

    AWS SSO ACS URL

    Enter the IAM Identity Center Assertion Consumer Service (ACS) URL provided by AWS IAM Identity Center.

    AWS SSO Issuer URL

    Enter the IAM Identity Center Issuer URL provided by AWS IAM Identity Center.

    Application User

    Select an option based on your business requirements. This topic uses Prefer Application Username and Use IDaaS Username as Backup as an example.

    Scope

    Select Manually or All Users based on your business requirements. If this is only for testing, set Scope to All Users to skip assigning access permissions to IDaaS accounts.

  3. Obtain identity provider information. Complete the configuration by using either method.

    1. Method 1: In the Application Settings section, download IdP Metadata to configure the AWS identity provider's IdP SAML metadata.

    2. Method 2: Obtain the IdP SSO URL and IdP Entity ID addresses to configure the AWS identity provider's IdP sign-in URL and IdP Issuer URL.

  4. Public key certificate. Download or copy the certificate, and then import or paste it into the AWS application.

  5. Assign user access permissions. Under Application User, click Add Application User.

    Important

    For the application account created here, the identity name used to access the application must exactly match the username configured on the AWS platform.

2. Configure AWS

  1. Log on to the AWS platform.

  2. In the upper-right corner, click My Account, and then click Management Console.

  3. In the search bar, enter IAM, and then select IAM Identity Center.

  4. On the dashboard, go to Configuration. Select Identity Providers, and then click Actions > Change Identity Source.

  5. Change the identity source to External identity provider, and then click Next.

  6. Enter the service provider metadata AWS access portal sign-in URL, IAM Identity Center Assertion Consumer Service (ACS) URL, and IAM Identity Center Issuer URL into the IDaaS application fields AWS SSO Sign-in URL, AWS SSO ACS URL , and AWS SSO Issuer URL, respectively.

  7. Enter the IDaaS application values IdP SSO URL and IdP Entity ID into the AWS identity provider's IdP sign-in URL and IdP Issuer URL fields, respectively. Alternatively, upload the IdP Metadata downloaded from the IDaaS application to IdP SAML metadata. For the IdP certificate, click Select File and select the Certificate file downloaded from IDaaS. After the configuration is complete, click Next.

  8. Review and confirm Change Identity Source.

  9. Create a user. In the left-side menu bar, click Users, and then click Add User. Follow the prompts to enter the required information.

  10. Grant permissions to a user.

    1. In the left-side menu bar, choose Multi-account permissions > AWS accounts, and then click Manage accounts.

    2. Click Assign users or groups.

    3. Click the Users tab, enter the users to authorize, select them, and then click Next.

    4. Click Create Permission Set. Select permissions that meet your business requirements. This topic uses the AdministratorAccess permission as an example. After making your selection, click Next.

    5. Go to the Review and submit page. After you confirm the user and permissions, click Submit to complete authorization.

3. Verify SSO

  1. IdP-initiated SSO

    Use an IDaaS account that has access permissions for the AWS SSO application to log on to the IDaaS application portal. Click the application icon to initiate single sign-on and log on to AWS as a federated user.

  2. SP-initiated SSO

    In AWS IAM Identity Center, obtain the AWS access portal URL.

    In an incognito browser, open the AWS access portal URL. If you are already logged on to the IDaaS application portal, you can log on to AWS directly as a federated user. Otherwise, you are redirected to the Alibaba Cloud IDaaS logon page. Enter your username and password, then click Log On. After you log on to IDaaS, you are automatically logged on to AWS.

Previous：Bastionhost SSONext：AWS role-based SSO