Sagemaker Unified Studio Keycloak SAML Configuration Guide

Prerequisites

1. Create Identity Provider

a. Download IDP SAML metadata file

Refer to the screenshot to download the IDP SAML metadata file.

If the automatic download doesn't work, use the following command:

$ curl <Keycloak URL>/realms/<Realm name>/protocol/saml/descriptor > descriptor.xml

b. Navigate to Identity providers

Go to Identity providers from the left menu bar in the IAM Console.

c. Click the Add provider button

d. Configure and create with the following settings:

• Provider type – Select SAML
• Provider name – Add a name to identify your identity provider (this guide uses keycloak-provider )
• Metadata document – Upload the XML file downloaded in step a

Record the ARN of the created Identity Provider and proceed to the next step.

---

2. Create IAM Role for Access

Trust Policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::<aws-account-id>:saml-provider/<iam-idp-name>"
      },
      "Action": "sts:AssumeRoleWithSAML",
      "Condition": {
        "StringEquals": {
          "SAML:aud": "https://signin.aws.amazon.com/saml"
        }
      }
    },
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::<aws-account-id>:saml-provider/<iam-idp-name>"
      },
      "Action": "sts:TagSession",
      "Condition": {
        "StringLike": {
          "aws:RequestTag/Email": "*"
        }
      }
    }
  ]
}

Permission Policies:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Statement1",
      "Effect": "Allow",
      "Action": "datazone:GetIamPortalLoginUrl",
      "Resource": [
        "arn:aws:datazone:{{region}}:<account-id>:domain/<domain-id>"
      ]
    }
  ]
}

Record the created Role ARN and proceed to the next step.

---

---

Keycloak Configuration

1. Download AWS SAML Metadata

Download the service provider (AWS) SAML-METADATA.XML:

$ curl -O https://signin.aws.amazon.com/static/saml-metadata.xml

---

2. Import Client

Click the CLIENTS > IMPORT CLIENT button and upload the file downloaded in step 1.

---

3. Add Role

a. Access the Roles tab

Enter the client created in step 2, click the Roles tab, and click the Create role button.

b. Create a role

Create a role with an appropriate name. This example uses aws-saml-role.

---

4. Configure Client Scopes

Go to the CLIENT SCOPES tab. Remove all scopes except those ending with -DEDICATED.

---

5. Configure Dedicated Scope

Click the scope ending with -DEDICATED. Go to the SCOPE tab and disable FULL SCOPE ALLOWED.

---

6. Add Mappers

Navigate to the MAPPERS tab. Keep existing mappers and add the following mappers:

a. Role Mapper

b. RoleSessionName Mapper

c. SessionDuration Mapper

d. PrincipalTag:Email Mapper

e. Role Name Mapper (aws-saml-role)

• Select the Role created in step 3
• For New Role Name, use the ARNs recorded in Prerequisites in the format: <Role ARN>,<Identity Provider ARN>

---

7. Create Group

a. Create a group

This example uses the name aws-smus-group.

b. Add members

In the Members tab, add the users who will log in.

c. Assign role mapping

In the Role mapping tab, select the role created in step 3 (click Assign role).

---

8. Configure Client Access Settings

Configure CLIENT > SETTINGS > ACCESS SETTINGS as follows:

• Name ID Format: username or email

• Root URL: Keycloak's base URL. In my test case, I'm using HTTP protocol and port 8080, but you should replace this with your actual URL.
• Home URL: /realms/<realm name>/protocol/saml/clients/<IDP-Initiated SSO URL name>
• Valid redirect URIs: https://signin.aws.amazon.com/saml
• IDP-Initiated SSO URL name: This example uses smus

---

9. Test the Configuration

To verify it works correctly, access the Home URL link and attempt to log in.

---

10. Configure SMUS SSO

If you successfully log in to the AWS Console, use this URL when configuring SMUS SSO.

---

---

Conclusion

You have successfully configured SAML-based SSO integration between Keycloak and SageMaker Unified Studio(SMUS). Users assigned to the aws-smus-group in Keycloak can now authenticate through your identity provider and access AWS resources with the appropriate IAM role permissions.