Configuring your SAML 2.0 IdP with Relying Party Trust and Adding Claims
When you create a SAML provider and the role for SAML access in IAM, you are essentially telling AWS about the identity provider (IdP) and what its users are allowed to do. Your next step is to then tell the IdP about AWS as a service provider. This is called adding relying party trust between your IdP and AWS. The exact process for adding relying party trust depends on what IdP you're using; for details, see the documentation for your identity management software.
Many IdPs allow you to specify a URL from which the IdP can read an XML document that
contains relying party information and certificates. For AWS, you can use
If you can't specify a URL directly, then download the XML document from the preceding URL and import it into your IdP software.
You also need to create appropriate claim rules in your IdP that specify AWS as a relying party. When the IdP sends a SAML response to the AWS endpoint, it includes a SAML assertion that contains one or more claims. A claim is information about the user and its groups. A claim rule maps that information into SAML attributes. This lets you make sure that SAML authentication responses from your IdP contain the necessary attributes that AWS uses in IAM policies to check permissions for federated users. For more information, see the following topics:
Overview of the Role to Allow SAML-Federated Access to Your AWS Resources. This topic discusses using SAML-specific keys in IAM policies and how to use them to restrict permissions for SAML-federated users.
Configuring SAML Assertions for the Authentication Response. This topic discusses how to configure SAML claims that include information about the user. The claims are bundled into a SAML assertion and included in the SAML response that is sent to AWS. You must ensure that the information needed by AWS policies is included in the SAML assertion in a form that AWS can recognize and use.
Integrating Third-Party SAML Solution Providers with AWS. This topic provides links to documentation provided by third-party organizations about how to integrate identity solutions with AWS.