This is a step by step guide on how to set up SSO for Amazon Web Services (AWS) Identity and Access Management (IAM) on Okta.

Essentially by federating Okta to Amazon Web Services (AWS) Identity and Access Management (IAM) accounts, end users get single sign on access to all their assigned AWS roles with their Okta credentials.

Such that when users sign into AWS from Okta, they are automatically logged into their assigned AWS role on AWS. 

• Prerequisites
• Add AWS IAM app to your Okta instance
• Set up SSO settings on AWS IAM
• Set up SSO settings on Okta
• Test and confirm that it is working

Before you can start setting up Single Sign On (SSO) for Amazon Web Services (AWS) Identity and Access Management (IAM) and Okta, we need to check the following:

Once there, click on "Add Provider".

Then you will be presented an "Add an Identity provider" page. We will fill this in as follows and click "Add provider" when we are done. 

• Provider type - SAML
• Provider name - Okta
• Metadata document - We will upload the metadata.xml file we downloaded from Okta earlier. 

Once added, you will be presented an SSO summary page.

Click on "Okta" and review your settings. 

We will need copy to Identity Provider "ARN" details here. Identity Provider ARN value. You will need it later during this configuration.

Add Okta as a trusted source for AWS roles

We need to create and/or update your existing AWS IAM roles to provide permissions for Okta to retrieve and assign roles to users (that will log in from Okta to AWS). 

To do this, we need to add Okta as a trusted source for your AWS roles.

I will show you an example of this through creating a new role, where we need to create a new policy and create a new role. Then attach the new policy to our role. 

The next section will cover:

• Creating a new policy
• Creating a new role

Creating a new policy

In the AWS Console, we will go to:

AWS Console > Services > Security, Identity & Compliance > IAM > Policies

Click "Create policy". 

Click on "JSON" tab.

Copy and paste the following json detail to your set up. 

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"iam:ListRoles",
"iam:ListAccountAliases"
],
"Resource": "*"
}
]
}

(Optional) But you can click on the "Visual editor" tab and you will see how this is reflected:

Click "Next: Tags" when you are done. 

Click "Next: Review".

Give your policy a name, for example, "Oktassopolicy". 

We can then leave the rest defaults, and click "Create policy". 

You will then see your new policy when you search the name you have defined.

Creating a new role

In the AWS Console, we will go to:

AWS Console > Services > Security, Identity & Compliance > IAM > Roles

Click "Create Role".

Click on "SAML 2.0 federation" under the "Select type of trusted entity" section.

Select "SAML provider" as "Okta"

Select "Allow programmatic and AWS Management Console access"

Click "Next: Permissions".

With the policy we created earlier, we can now attach this new policy to our Role. 

We can click on "Next: Tags".

On the "Add tags (optional)" page, click "Next: Review". 

Give your policy a name, for example, "Oktassorole". 

We can then leave the rest defaults, and click "Create role". 

You will now see the new role we have created, with a "Trusted entities" relationship with our Identity Provider Okta. 

Add a user to AWS to generate the AWS API access key

In the AWS Console, we will create a new AWS user with specific permissions that will allow Okta to dynamically fetch a list of available roles from your accounts.

This is important so that we can populate the roles in Okta to assign roles from Okta to AWS later. Example below. 

This will also make assigning users and groups to specific AWS roles easy and secure for administrators.

Creating a new user

In the AWS Console, we will go to:

AWS Console > Services > Security, Identity & Compliance > IAM > Users

Click "Add Users".

Set user details and click "Next: Permissions" when you are done. 

• User name - oktasso
• Access type - Programmatic access

Click "Next: Permissions".

Select "Attach existing policies directly".

Find the policy we created earlier, and attach this policy to our user. 

We can click on "Next: Tags".

On the "Add tags (optional)" page, click "Next: Review". 

We can now review the user and when we are ready click "Create user". 

Click "Create user". 

You will now see the new user details successfully created page. 

Copy the keys in the Access key ID and Secret access key somewhere safe and click Close.

We will need these keys to complete our configurations.

When you are ready, let's test that it works.

In Okta Admin Console, let's assign a user to the application. (Applications> Applications> AWS Account Federation app)

Go to "Assignments" tab. (Applications> Applications> AWS Account Federation app> "Assignments)

Select "Assign" and "Assign to People".

Select our test user, click "Assign"

Select the AWS role options for the "Role" from the dropdown menu. This is populated (via the API integration) with the applicable roles you have created in AWS. 

When you are ready, click "Save and Go Back".

Now let's log into our Okta instance as a test user. You may need to refresh your browser if you had the browser window already open.

Then click on "AWS Account Federation" application icon (chiclet).

Success, you will be logged in successfully to your AWS Account Federation account!

Tips and Troubleshooting

• To get new list of AWS roles from AWS (use "Refresh Application Data" function)
• Reset the API connection
• Reset the AWS Account Federation assignment
• Other AWS error messages that might come up

To get new list of AWS roles from AWS (use "Refresh Application Data" function)

If you create another new IAM Role after setting up the API integration in Okta it does not get populated in Okta automatically. To get this new role, do the following:

Go to the Applications> Applications.

Click "More", and then click "Refresh Application Data".

This downloads the latest roles, profiles and groups from apps configured with user provisioning. Okta uses this data when creating new users in those apps.

Reset the API connection

Reset the AWS Account Federation assignment

"Identity Provider ARN"

"Identity Provider ARN" setting is found under AWS Account Federation app> Sign On> Advanced Sign-on Settings> Identity Provider ARN.

arn:aws:iam::1111111111:saml-provider/Okta 

 

 

"Role ARN"

 "Role ARN" setting is found under AWS Account Federation app> Assignment> Assign to People> Your test user > Role 

 

Mapping error

• Make sure you have enabled "Import Groups" to import Groups from AWS to Okta, in your "Okta> Application> AWS Account Federation > Provisioning> Integration> API Integration" settings. 
• The issue was that there were differences in formatting between Active Directory group’s name and Okta Group Filter.
• Make sure you have added active directory user into the role groups, that’s why it prompts that no user can be set at a group level.

Tool - SAML Tracer

You can consider installing a SAML tracer in your Chrome or Firefox browser for testing. This allows you to see the SAML payloads being sent. So you open the SAML Tracer and click from your Okta SSO page, click on your app and it populates as the page loads. Similar to inspect element but specific for looking at SAML requests.

Chrome Extension - SAML Tracer 

A debugger for viewing SAML messages
A tool for viewing SAML and WS-Federation messages sent through the browser during single sign-on and single logout.

Here's a couple of examples of what it captures. 

Click the SAML row (It will be marked with "SAML" in orange)

Click on the "Summary" tab, and you will see the details summarised. 

Click on the "SAML" tab, and you will see the raw SAML xml details.

Other AWS error messages that might come up

For other AWS error messages that might compe up, see Amazon Web Services' summary of these error messages to expect and how to manage them https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_saml.html .

Resources:

• Okta - Overview of Amazon Web Services Account Federation 
• Okta - Configure the Amazon Web Services Account Federation app in Okta 
• Okta - How to configure SAML2.0 for AWS
• AWS - Enabling SAML 2.0 federated users to access the AWS Management Console
• AWS - Troubleshooting SAML 2.0 federation with AWS