Enabling SAML for your AWS resources

• Security Assertion Markup Language 2.0 (SAML) is an open federation standard that allows an identity provider (IdP) to authenticate users and pass identity and security information about them to a service provider (SP), typically an application or service.

• With SAML, you can enable a single sign-on experience for your users across many SAML-enabled applications and services.

• Users authenticate with the IdP once using a single set of credentials, and then get access to multiple applications and services without additional sign-ins.

1. The user browses to your organization's portal and selects the option to go to the AWS Management Console. In your organization, the portal is typically a function of your IdP that handles the exchange of trust between your organization and AWS.

2. The portal verifies the user's identity in your organization.

3. The portal generates a SAML authentication response that includes assertions that identify the user and include attributes about the user. You can also configure your IdP to include a SAML assertion attribute called SessionDuration that specifies how long the console session is valid.

4. The client browser is redirected to the AWS single sign-on endpoint and posts the SAML assertion.

5. The endpoint requests temporary security credentials on behalf of the user and creates a console sign-in URL that uses those credentials.

6. AWS sends the sign-in URL back to the client as a redirect.

7. The client browser is redirected to the AWS Management Console. If the SAML authentication response includes attributes that map to multiple IAM roles, the user is first prompted to select the role for accessing the console.