SAML 2.0 - AWS IAM

Part A: SAML Authentication (Login)

1. Go to AWS IAM Identity Center.

2. Go to Applications > Add application > Add a custom SAML 2.0 application.

3. Get AWS Metadata: On the details page, copy the "IdP SAML metadata URL" or download the metadata in xml format to host it on the server.

4. Configure SP Data (your application):

   • Entity ID (Audience): identificador-unico-para-saml (Must be unique and match the yml).

   • ACS URL: https://dev.anjanadata.org/gateway/saml2/sso/devaws (The key devaws matches the one used in the yml).

5. Assign users: Go to the "Assigned users and groups" tab and grant access to those who need it.

Part B: API Configuration (User Provisioning)

1. Go to the IAM service (not IAM Identity Center).

2. Create a new IAM User for your application (e.g. anjana-provisioning-user).

3. Generate access keys (accessKey and secretKey) for this user.

4. Assign this user the necessary read-only permissions (Policies):

   • AWSSSOReadOnlyAccess

   • A new set of Permissions that will contain the following:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "identitystore:DescribeUser",
        "identitystore:IsMemberInGroups",
        "kms:Decrypt",
        "identitystore:DescribeGroupMembership",
        "identitystore:ListGroupMemberships",
        "identitystore:GetGroupMembershipId",
        "identitystore:DescribeGroup",
        "identitystore:GetGroupId",
        "identitystore:GetUserId",
        "sso:ListApplicationAssignments"
      ],
      "Resource": "*"
    }
  ]
}

5. Go to IAM Identity Center > Settings and copy the "Identity Store ID" (identityStoreId).

6. Go to the SAML application you created in Part A and copy its "Application ARN" (applicationArn).

Final Data for the yml

• accessKey: The access key of the IAM user you created.

• secretKey: The secret of the IAM user.

• region: The region where your IAM Identity Center is located (e.g. us-east-1).

• identityStoreId: The ID you copied from the settings.

• applicationArn: The ARN you copied from the SAML application.

Example application-default.yml file

This example details the SAML-specific properties for AWS IAM. The properties common to all providers are found in SAML 2.0 (Deprecated)

security:
  provisioning:
    providers:
      aws-iam-ic:
        # The key 'devaws' must be IDENTICAL to the key used in 'provisioning'
        devaws:
          # Access key of the admin user used to retrieve users
          access-key: <accessKey>
          # Password for the access key of the admin user used to retrieve users
          secret-key: <secretKey>
          # AWS IAM region where the Identity Center is located
          region: eu-west-1
          # ARN of the SAML application
          application-arn: <appARN>
          # Identity Store ID
          identity-store-id: <identityStoreID>