How do I configure Microsoft Entra ID as a SAML identity provider for Client VPN authentication?

Resolution

Configure Microsoft Entra ID

Configure Client VPN for Microsoft Entra ID. For instructions, see Configure AWS Client VPN for Single sign-on with Microsoft Entra ID on the Microsoft Learn website.

When you configure the Basic SAML Configuration in the Microsoft Entra Admin Center, use the following values:

• For Identifier (Entity ID), use urn:amazon:webservices:clientvpn.
• For Reply URL (ACS URL), enter https://127.0.0.1:35001.
  Note: Microsoft Azure requires HTTPS for the Reply URL field, but you must use HTTP for the Client VPN.
• For Sign on URL, enter https://127.0.0.1:35001.
• For Signing Option, use Sign SAML response and assertion.
• If you use the self-service portal, then as a second URL, add https://self-service.clientvpn.amazonaws.com/api/auth/sso/saml as the Assertion Consumer Service (ACS) endpoint for the Client VPN self-service portal URL.

After you save the SAML configuration, in your Microsoft Graph App Manifest, change the defaultRedirectUri and redirectUriSettings values to use http://127.0.0.1:35001.

For group-based authorization rules, add the following claims to your SAML token attributes configuration:

• For FirstName, add user.givenname.
• For LastName, add user.surname.
• For memberOf, add user.groups.
  Note: Group-based authorization rules require the memberOf claim. The claim is case-sensitive.

Note: Be sure to download the Federation Metadata XML from the SAML Signing Certificate section. Then, in the Users and groups section, assign the users or groups that must access your VPN.

Create an IAM SAML identity provider

Create an AWS Identity and Access Management (IAM) SAML identity provider to establish a trust relationship between AWS and Microsoft Entra ID.

When you configure the provider, use the following settings:

• For Provider type, use SAML.
• For Provider name, use a descriptive name, such as EntraID-ClientVPN.
• For Metadata document, upload the Federation Metadata XML that you downloaded when you configured Microsoft Entra ID.
  Note: Client VPN uses the identity provider directly for authentication, and the provider doesn't require a new IAM role.

Create the Client VPN endpoint

Create a Client VPN endpoint with federated authentication. When you configure authentication, choose the following options:

• For Authentication options, choose User-based authentication.
• For User-based authentication options, choose Federated authentication.
• For SAML provider ARN, select the IAM SAML identity provider that you created.
• (Optional) If you use the self-service portal, then select a second provider for Self-service SAML provider ARN.

Test the connection

To test your connection, complete the following steps:

1. Download the .ovpn Client VPN configuration file from your endpoint.
2. Import the file into the AWS VPN Client version 1.2.0 or later.
3. Connect to the Client VPN. A browser window opens with the Microsoft Entra ID login page.
4. Authenticate with your Entra ID credentials.

After successful SAML authentication, the VPN connection establishes.

Related information

Enable SAML for AWS Client VPN