View a markdown version of this page

Update the SAML application configuration - Innovation Sandbox on AWS

Update the SAML application configuration

After deploying the Data stack, update the SAML 2.0 application you created earlier with the actual ACS URL and audience values from the Data stack outputs. To enable IdP-initiated sign-in from the AWS access portal, you also set the Application start URL to the solution’s web UI URL.

  1. Sign in to the AWS CloudFormation console in the Hub account.

  2. Choose the Data stack, and then choose the Outputs tab.

  3. Note the values for CognitoAcsUrl and CognitoAudience.

  4. Choose the Compute stack, choose the Outputs tab, and note the web UI URL (the CloudFrontDistributionUrl value). If you configured a custom domain, use that domain instead. For more information, see Logging into the web UI.

  5. Sign in to the AWS IAM Identity Center console in the account where IAM Identity Center is configured.

  6. From the left pane, under Application assignments, choose Applications.

  7. On the Applications page, on the Customer managed tab, choose the SAML application you created in Create a SAML 2.0 application.

  8. Choose Actions, then choose Edit configuration.

  9. Under Application metadata, update the following fields:

    Field Value

    Application ACS URL

    The CognitoAcsUrl value from the Data stack outputs (for example, https://<namespace>-isb.auth.<region>.amazoncognito.com/saml2/idpresponse)

    Application SAML audience

    The CognitoAudience value from the Data stack outputs (for example, urn:amazon:cognito:sp:<user-pool-id>)

    Application start URL

    The solution’s web UI URL — the CloudFrontDistributionUrl value from the Compute stack outputs, or your custom domain (for example, https://isb.example.com). This URL is where the AWS access portal sends users when they start sign-in from the portal.

  10. Choose Submit to save the updated configuration.

Note

The Application start URL enables IdP-initiated sign-in, so users can launch the solution from the AWS access portal. If you leave it empty, service provider-initiated sign-in (starting from the web UI URL) still works, but the application does not appear as a launchable tile in the AWS access portal.

Important

If these values do not match the Data stack outputs, users will receive a SAML assertion audience mismatch error when attempting to sign in to the web application.