Amazon Web Services

Configuring Key9 Identity SAML SSO with AWS

Setting up Amazon Web Services, requires two extra parameters, Role and RoleSessionName.

You can connect this parameters now if you have the fields configured, or set them later.

The RoleSessionName is typically mapped to the users email address

Configuring SAML SSO for AWS

AWS documentation can be found here.

You will need Admin access to your AWS Console.

1. Sign in to your AWS Console.

2. Navigate to the IAM Dashboard (Identity and Access Management).

3. In the IAM Dashboard, navigate to Access Management > Identity Providers

4. Click Add provider.

5. In the Configure provider section, select SAML as the Provider type, enter Key9-Identity as the Provider name.

6. For the Metadata document, Download SAML Metadata file from the side navigation of your Key9 application, then click Choose file and upload the metadata file.

7. Then click Add provider.

8. Copy the ARN displayed. (You will need this later when configuring access)

9. If you haven't yet, you will need to create a Role, that will be assigned to the Key9 Identity provider. Please refer to AWS docs for creating a Role

10. Click Assign role button, then select whether you will Create a new role or Use an existing role, and follow the AWS docs.

11. Once you have a Role(s) assigned to Key9 Identity, copy the ARN displayed for each role. (You will need this later when configuring access)

12. When assigning a role to a user, the value will consist of the AWS ARN role and the AWS ARN provider, separated with a comma.

An example of a role would be: arn:aws:iam::123456789000:role/RoleNameHere,arn:aws:iam::123456789000:saml-provider/Key9-Identity

-------------------

By default, applications are not active upon creation. Active applications are immediately available to assign groups. Applications should only be activated when you have configured the Service Provider (SP).