Setting up single sign-on (SSO) with IAM Identity Center

Sign in to the AWS Identity and Access Management console.

Open the Identity Center.

Choose Enable.

Choose Enable with AWS Organizations.

Choose Continue.

In the navigation pane, choose Settings.

Under Identity source, choose Actions and choose Change identity source.

Under Existing directories, select your directory.

Choose Next.

Review your changes and enter ACCEPT in the confirmation box.

Choose Change identity source.

In the confirmation banner, choose Start guided setup.

From Configure attribute mappings, choose Next.

Under the User section, enter the users you want to sync.

Choose Add.

Choose Next.

Review your changes, then choose Save configuration.

The sync process may take a few minutes. If you receive a warning message about users not syncing, choose Resume sync.

From the menu, choose Users.

Select the user(s) for whom you want to enable access.

Choose Enable user access.

Open the IAM Identity Center console.

Choose Applications.

Choose Add application.

Under Setup preference, choose I have an application I want to set up.

Under Application type, choose SAML 2.0.

Choose Next.

Enter the display name and description you would like to use.

Under IAM Identity Center metadata, copy the link for the IAM Identity Center SAML metadata file. You will need this when configuring IAM Identity Center with the RES portal.

Under Application properties, enter your Application start URL. For example, <your-portal-domain>/sso.

Under Application ACS URL, enter the redirect URL from the RES portal. To find this:

1. Under Environment management, choose General settings.

2. Select the Identity provider tab.

3. Under Single Sign-On, you will find the SAML Redirect URL.

Under Application SAML audience, enter the Amazon Cognito URN.

To create the urn:

1. From the RES portal, open General Settings.

2. Under the Identity provider tab, locate the User Pool ID.

3. Add the User Pool ID to this string:

   urn:amazon:cognito:sp:<user_pool_id>

After you enter the Amazon Cognito URN, choose Submit.

From the Identity Center, open the details for your created application.

Choose Actions, then choose Edit attribute mappings.

Under Subject, enter ${user:email}.

Under Format, choose emailAddress.

Choose Add new attribute mapping.

Under User attribute in the application, enter 'email'.

Under Maps to this string value or user attribute in IAM Identity Center, enter ${user:email}.

Under Format, enter 'unspecified'.

Choose Save changes.

From the Identity Center, open Assigned users for your created application and choose Assign users.

Select the users you want to assign application access.

Choose Assign users.

From the Research and Engineering Studio environment, under Environment management, open General settings.

Open the Identity provider tab.

Under Single Sign-On, choose Edit (next to Status).

Complete the form with the following information:

1. Choose SAML.

2. Under Provider name, enter a user friendly name.

3. Choose Enter metadata document endpoint URL.

4. Enter the URL you copied during Setting up the application in IAM Identity Center.

5. Under Provider email attribute, enter 'email'.

6. Choose Submit.

Refresh the page and check that the Status displays as enabled.