This section includes the configuration required to integrate Advanced Authentication with Amazon Web Services Single Sign-On (AWS SSO). This integration secures the connection with Advanced Authentication verification methods and allow users to seamlessly access AWS services after the successful SAML authentication.
After the integration, Advanced Authentication serves as an Identity Provider and AWS Single Sign-On serves as a Service Provider.
To configure the integration of Advanced Authentication with AWS Single Sign-On, perform the following tasks:
Ensure that the following requirements are met:
AWS SSO is intended for organizations. Use your existing organization or create one.
For more information, see Create an Organization.
Make sure the repository that you are using contains users with email addresses specified. You cannot use the LOCAL repository in Advanced Authentication because the local users do not have email address.
Add users’ details to AWS.
NOTE:The username of each user in AWS must be user’s email address else you cannot map the user account. If the mapping is not valid then SAML authentication might fail.
Navigate to Policies > Web Authentication on the Administration Portal.
Click Download IdP SAML 2.0 Metadata.
A new tab launches with the SAML 2.0 metadata that includes the certificate in x.509 format.
Save the file in .xml format. Keep the file for further use.
Log in to AWS Management Console with your organization management credentials.
Open AWS SSO Console.
Select Enable AWS SSO.
If you have not yet created AWS Organizations, a prompt to create an organization appears.
Click Go to Settings.
Under Identity source section, click Actions > Change identity source.
Select External Identity Provider and click Next.
Click Download metadata file and save the file for further use.
The AWS SSO SAML metadata file must be uploaded in Advanced Authentication that serves as the external identity provider.
Under Identity provider metadata, click Choose file, and select the metadata file that you downloaded from Advanced Authentication Step 3.
Click Next.
Specify ACCEPT to confirm the change and click Change identity source.
Click Events > Add on the Administration Portal.
Specify the following details:
Name: AWS SSO (or any other string).
Chains: select the required chains.
Under SAML 2.0 settings, click Choose File and select the metadata of AWS Single Sign-On that you obtained in Step 7.
Select Send E-Mail as NameID (suitable for G-Suite) from NameID formatting options. This is required to prevent errors in the SAML response.
Click Save.
Ensure that users are available on Advanced Authentication server and AWS account of your organization.
Navigate to AWS SSO > Dashboard.
Copy the User portal URL under Settings summary.
Navigate to the User portal URL in a browser and check whether you are redirected to Advanced Authentication login page.
Complete the authentication as per the chains configured in the SAML event.
For example, specify the user credentials in Username and Password if Password Only chain is available.
Check whether you can access the Single Sign-On page.