Repository navigation
Guidance on integrating keycloak with AWS SAML IDP, without cognito or iam identity center. #38683
Replies: 1 comment
|
The issue was, client mappers were not getting assigned value as custom attribute were not getting assigned a value. Updated |
0 replies
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
Hi All,
I have set up the aws client in keycloak by importing the xml file from aws static file. Which is globally available. In addition, I have added the home url to keycloak client saml endpoint (/realm/abc/protocol/saml/clients/aws).
On AWS Side, I have created an IDP using saml2.0 metadata document from keycloak, which fills most of the details and added a role to it with aws saml endpoint in trust relations and aud:
urn:amazon:webservices.Next Created a user and gave it access to client role (aws-role-arn,aws-saml-provider-arn).
However still When I try to login to aws using IDP intiated login, I'm getting the generic response of
Your request included an invalid SAML response. To logout, click [here](https://signin.aws.amazon.com/oauth?Action=logout&redirect_uri=https://aws.amazon.com)Another thing i noticed is Attributes are not getting correctly passed in the SAML while trying to login. As Instead of correct attribute:
https://aws.amazon.com/SAML/Attributes/Rolewhich should have the value of the role assigned (in ideal case) The attribute name is just Role. Also RoleName attribute is missing from the saml hence I'm assuming that mappers from client scope are not correctly passed on while logging.Any help or reference to an article will be appreciated.
Thanks in advance.
All reactions