SAML AWS SSO

Follow the sections in this guide to set up AWS SSO using SAML.

Create OpenMetadata application

Step 1: Configure a new Application in AWS Console

• Login to AWS Console as an administrator and search for IAM Identity Center.

• Click on Choose your identity source and configure as per security requirements.

• After identity source is set up successfully, goto step 2 and click on Manage Access to application and add all the required users who need access to application.

• Click on Set up Identity Center enabled applications, and click Add application, and select Add custom SAML 2.0 application.

• Set Display Name to OpenMetadata , and download the metadata xml file and save it someplace safe, it is needed to setup OM Server

• Click on Manage assignments to your cloud applications and select OpenMetadata from list of applications.

• Click on Actions and select Edit Configurations from list. Populate the shown values replacing localhost:8585 with your {domain}:{port} and Submit.

• Click on Actions again and select Edit Attribute Mapping from list. Populate the values as shown below and submit

Step 2: Setup OpenMetadata Server

• Open the downloaded metadata xml file, and populate the following properties in openmetadata.yml

• Populate the above config from xml metadata

• IDP Config
  entityID -> Populate it from Metadata XML Entity ID HTTP-Redirect SSO Login URL -> always select HTTP-Redirect Url for SSO Login Url X509 Certificate -> This is also available in the IDP XML. NameIDFormat -> from MetadataXML NameIDFormat authorityUrl -> set as {http}/{https}://{domain}:{port}/api/v1/saml/login

• SP Config entityId -> -> set as {http}/{https}://{domain}:{port}/api/v1/saml/acs acs -> Assertion Consumer Url , set as {http}/{https}://{domain}:{port}/api/v1/saml/acs spX509Certificate -> set to your X509 Signing Key callback -> set as {http}/{https}://{domain}/api/v1/saml/callback

• Security Parameters can be configured in case we want to have signed or encrypted or both assertions. In any case we decided to use above config for security then it is mandatory to provide keystore config, from where the system can load the signing certificate or Private Key for encryption.

Step 3: Setup JWT Configuration

• Follow the guide here for JWT Configuration Enable JWT Token.

Step 4: Start the server

• Set up for SAML is done, you should be routed to your IDP on trying to Sign-in.