Identityfederation

SAML 2.0

• SAML - Security Assertion Markup Language
• Open Standard used by many Identity Prodivders (IDP)
• SAML 2.0 integration enables indirectly using on premise identities with AWS
• Primarily used with Enterprise (not web) IDP that is SAML 2.0 compliant
• Single source of identity truth for more than 5000 users
• Federation uses IAM Roles and Temporary Credentials ( with 12 hours validity)
• For this to work Trust needs to be established between SAML2.0 IDP & AWS IAM
• Enterprise application first authenticates with Enterprise IDP & gets a SAML token
• While communitcating with AWS, the application invokes STS:AssumeRoleWithSAML operation passing in SAML Assertion
• STS returns temporary AWS credentials to the application