Menu
Amazon AppStream 2.0
Developer Guide

Tutorial: Setting Up Active Directory

To use Active Directory with AppStream 2.0, you must first register your directory configuration by creating a Directory Config object in AppStream 2.0. This object includes the information required to join streaming instances to an Active Directory domain. You create a Directory Config object by using the AppStream 2.0 management console, AWS SDK, or AWS CLI. You can then use your directory configuration to launch domain-joined fleets and image builders.

Step 1: Create a Directory Config Object

The Directory Config object that you create in AppStream 2.0 will be used in later steps.

If you are using the AWS SDK, you can use the CreateDirectoryConfig operation. If you are using the AWS CLI, you can use the create-directory-config command.

To create a Directory Config object by using the AppStream 2.0 console

  1. Open the AppStream 2.0 console at https://console.aws.amazon.com/appstream2.

  2. In the navigation pane, choose Directory Configs, Create Directory Config.

  3. For Directory Name, provide the fully qualified domain name (FQDN) of the Active Directory domain (for example, corp.example.com). Each region can have only one Directory Config value with a specific directory name.

  4. For Service Account Name, enter the name of an account that can create computer objects and that has permissions to join the domain. For more information, see Granting Permissions to Create and Manage Active Directory Computer Objects. The account name must be in the format DOMAIN\username.

  5. For Password and Confirm Password, type the directory password for the specified account.

  6. For Organizational Unit (OU), type the distinguished name of at least one OU for streaming instance computer objects. The default Computers container is not an OU and cannot be used by AppStream 2.0. For more information, see Finding the Organizational Unit Distinguished Name.

  7. To add more than one OU, select the plus sign (+) next to Organizational Unit (OU). To remove OUs, choose the x icon.

  8. Choose Next.

  9. Review the configuration information and choose Create.

Step 2: Create an Image by Using a Domain-Joined Image Builder

Next, using the AppStream 2.0 image builder, create a new image with Active Directory domain-join capabilities. Note that the fleet and image can be members of different domains. You join the image builder to a domain to enable domain join and to install applications. Fleet domain join is discussed in the next section.

To create an image for launching domain-joined fleets

  1. Follow the procedures in Tutorial: Create a Custom Image.

  2. For the base image selection step, use an AWS base image released on or after July 24, 2017. For a current list of released AWS images, see Amazon AppStream 2.0 Windows Image Version History.

  3. For Step 3: Configure Network, select a VPC and subnets with network connectivity to your Active Directory environment. Select the security groups that are set up to allow access to your directory through your VPC subnets.

  4. Also in Step 3: Configure Network, expand the Active Directory Domain (Optional) section, and select values for the Directory Name and Directory OU to which the image builder should be joined.

  5. Review the image builder configuration and choose Create.

  6. Wait for the new image builder to reach a Running state, and choose Connect.

  7. Log in to the image builder in Administrator mode or as a directory user with local administrator permissions. For more information, see Granting Local Administrator Rights on Image Builders.

  8. Complete the steps in Tutorial: Create a Custom Image to install applications and create a new image.

Step 3: Create a Domain-Joined Fleet

Using the private image created in the previous step, create an Active Directory domain-joined fleet for streaming applications. The domain can be different than the one that you used for the image builder to create the image.

To create a domain-joined fleet

  1. Follow the procedures in Create a Fleet.

  2. For the image selection step, use the image that was created in the previous step, Step 2: Create an Image by Using a Domain-Joined Image Builder.

  3. For Step 4: Configure Network, select a VPC and subnets with network connectivity to your Active Directory environment. Select the security groups that are set up to allow communication to your domain.

  4. Also in Step 4: Configure Network, expand the Active Directory Domain (Optional) section and select the values for the Directory Name and Directory OU to which the fleet should be joined.

  5. Review the fleet configuration and choose Create.

  6. Complete the remaining steps in Create AppStream 2.0 Fleets and Stacks so that your fleet is associated with a stack and running.

Step 4: Configure SAML 2.0

Your users must use your SAML 2.0-based identity federation environment to launch streaming sessions from your domain-joined fleet.

To configure SAML 2.0 for single sign-on access

  1. Follow the procedures in Setting Up SAML.

  2. AppStream 2.0 requires that the SAML_Subject NameID value for the user who is logging in be provided in either of the following formats:

    • domain\username using the sAMAccountName

    • username@domain.com using the userPrincipalName

    If you are using the sAMAccountName format, you can specify the domain by using either the NetBIOS name or the fully qualified domain name (FQDN).

  3. Provide access to your Active Directory users or groups to enable access to the AppStream 2.0 stack from your identity provider application portal.

  4. Complete the remaining steps in Setting Up SAML.

To log in a user with SAML 2.0

  1. Log in to your SAML 2.0 provider's application catalog and open the AppStream 2.0 SAML application that you created in the previous procedure.

  2. When the AppStream 2.0 application catalog is displayed, select an application to launch.

  3. When a loading icon is displayed, you are prompted to provide a password. The domain user name provided by your SAML 2.0 identity provider appears above the password field. Enter your password, and choose log in.

The streaming instance performs the Windows login procedure, and the selected application opens.