Integrate with Amazon IAM (Multiple Roles)

JumpCloud enables employees of your organization to sign into Amazon's Web Service with role-based access using multiple SSO Connectors.

Read this article to learn how to configure the Amazon IAM (Multiple Roles) connector. 

Prerequisites

• A JumpCloud administrator account
• JumpCloud SSO Package or higher or SSO add-on feature.
• AWS Admin account (AWS root user)
• AWS organization

Important Considerations

• Amazon IAM only supports IdP-Initiated SSO.
• Each connector you create for Amazon IAM can allow for a specific and unique role to be set. Using Tags will enable you to assign specific users to each specific connector.

Creating a new JumpCloud Application Integration

1. Log in to the JumpCloud Admin Portal.
2. Go to USER AUTHENTICATION > SSO Applications.
3. Click + Add New Application.
4. Type the name of the application in the Search field and select it.
5. Click Next.
6. In the Display Label, type your name for the application. Optionally, you can enter a Description, adjust the User Portal Image and choose to hide or Show in User Portal.

7. Optionally, expand Advanced Settings to specify a value for the SSO IdP URL. If no value is entered, it will default to https://sso.jumpcloud.com/saml2/<applicationname>.

8. Click Save Application.
9. If successful, click:
   • Configure Application and go to the next section
   • Close to configure your new application at a later time

Configuring the SSO Integration

To configure JumpCloud

1. Create a new application or select it from the Configured Applications list.
2. Select the SSO tab.
3. In the CONSTANT ATTRIBUTES section, leave the default settings for the values under Name <https://aws.amazon.com/SAML/Attributes/RoleSessionName>; and <https://aws.amazon.com/SAML/Attributes/Role>; respectively.
4. In the first value field, leave the default value of SSO-User.
5. In the second value field, change the default value of arn:aws:iam::YOUR_AWS_ACCOUNT_NUMBER:role/SAML-User,arn:aws:iam::YOUR_AWS_ACCOUNT_NUMBER:saml-provider/JumpCloud
   (ReplaceYOUR_AWS_ACCOUNT_NUMBER with the account number associated with your AWS Account).
6. In the field terminating the IdP URL, change the default value to aws-a
7. Click save. 

Click on the Applications link in the side navigation

1. Click on the Amazon Web Services Icon
2. For values under Name, leave the default setting (https://aws.amazon.com/SAML/Attributes/RoleSessionName) and https://aws.amazon.com/SAML/Attributes/Role respectively.
3. Click Upload IdP Private Key and upload your private key (see note above)
4. Click Upload IdP Certificate and upload your public certificate (see note above)
5. In the first Value field, leave the default value of SSO-User
6. In the second Value field, change the default value of arn:aws:iam::YOUR_AWS_ACCOUNT_NUMBER:role/SAML-User,arn:aws:iam::YOUR_AWS_ACCOUNT_NUMBER:saml-provider/JumpCloud (ReplaceYOUR_AWS_ACCOUNT_NUMBER with the account number associated with your AWS Account)
7. In the IdP URL field, change the default value to aws-a
8. Enter in a Display Label for this Connector
9. Click Activate
10. Click the export metadata button for the Amazon IAM entry (this will download a metadata file named JumpCloud-aws-metadata.xml)
11. Repeat Steps 1-7 for the Second AWS SSO Connector
12. In the second Value field, change the default value of arn:aws:iam::YOUR_AWS_ACCOUNT_NUMBER:role/SAML-User,arn:aws:iam::YOUR_AWS_ACCOUNT_NUMBER:saml-provider/JumpCloud (Replace YOUR_AWS_ACCOUNT_NUMBER with the account number associated with your AWS Account and ensure that this field has arn:aws:iam::YOUR_AWS_ACCOUNT_NUMBER:role/SAML2-User,arn:aws:iam::YOUR_AWS_ACCOUNT_NUMBER:saml-provider/JumpCloud2 )
13. In the IdP URL field, change the value to aws-b
14. Enter in a Display Label for this Connector
15. Click Activate
16. Click export metadata button for the Amazon IAM entry (this will download a metadata file named JumpCloud-aws-metadata-2.xml

​​To configure AWS

1. Log in to Amazon Web Services console for your organization
2. Under the Security & Identity section, click on Identity & Access Management (IAM)
3. Click Identity Providers in the Sidebar under Details
4. Click Create Provider
   • ​Provider Type: SAML
   • Provider Name: JumpCloud
   • Click the Choose File button next to Metadata file and upload the JumpCloud-aws-metadata.xml file (downloaded in step 12 above)
   • Click Next Step then select Create
5. Create a second Identity Provider
   • Provider Type: SAML
   • Provider Name: JumpCloud2
   • Click the Choose File button next to Metadata file and upload the JumpCloud-aws-metadata-2.xml file (downloaded in step 18 above)
   • Click Next Step then select Create​
6. ​Click Roles in the Sidebar under Details
7. Click Create New Role ​​
   • Role Name: SAML-User
   • Role Type: Role for Identity Provider Access
     • ​Grant Web Single Sign-On (WebSSO) access to SAML providers ​
   • ​SAML Provider: JumpCloud
   • Click Next Step then Next Step again on the Verify Role Trust page
   • Select the desired Policies from the list of available policies then click Next Step
   • Review the information, then select Create Role
8. ​Click Create New Role for the second time
   • Role Name: SAML2-User
   • Role Type: Role for Identity Provider Access
     • ​Grant Web Single Sign-On (WebSSO) access to SAML providers
   • ​SAML Provider: JumpCloud2
   • Click Next Step then Next Step again on the Verify Role Trust page
   • Select the desired Policies from the list of available policies then click Next Step
   • Review the information, then select Create Role

Authorizing User SSO Access

Users are implicitly denied access to applications. After you connect an application to JumpCloud, you need to authorize user access to that application. You can authorize user access from the Application Configuration panel or from the Groups Configuration panel. 

To authorize user access from the Application Configuration panel

1. Log in to the JumpCloud Admin Portal.
2. Go to USER AUTHENTICATION > SSO Applications, then select the application to which you want to authorize user access.
3. Select the User Groups tab. If you need to create a new group of users, see Get Started: User Groups.
4. Select the check box next to the group of users you want to give access.
5. Click save. 

To learn how to authorize user access from the Groups Configuration panel, see Authorize Users to an SSO Application.

Testing Your Single Sign-on (SSO) Configuration

IdP-Initiated Flow

• In the JumpCloud Admin Console, create a tag called SSO-AWS-A  and then select the users you wish to grant access to the resources provided in Step 7 of Part 2
• Create a second tag called SSO-AWS-B and then select the users you wish to grant access to the resources provided in Step 8 of Part 2

To deactivate the SSO Integration

1. Log in to the JumpCloud Admin Portal.
2. Go to USER AUTHENTICATION > SSO Applications.
3. Search for the application that you’d like to deactivate and click to open its details panel. 
4. Select the SSO tab.
5. Scroll to the bottom of the configuration.
6. Click Deactivate SSO. 
7. Click save. 
8. If successful, you will receive a confirmation message.

To delete the application

1. Log in to the JumpCloud Admin Portal.
2. Go to USER AUTHENTICATION > SSO Applications.
3. Search for the application that you’d like to delete.
4. Check the box next to the application to select it.
5. Click Delete.
6. Enter the number of the applications you are deleting
7. Click Delete Application.
8. If successful, you will see an application deletion confirmation notification.