AWS re:Post을(를) 사용하면 다음에 동의하게 됩니다. AWS re:Post 이용 약관
AWS re:Postre:Post

AWS SSO "User Portal" session timeout.

0

The AWS documentation for SSO has details on how to set a session duration for logging into the AWS console: https://docs.aws.amazon.com/singlesignon/latest/userguide/howtosessionduration.html

I set this to 1 hour to test. However, a behavior I've noticed is that when clicking on the link for the "management console", it opens a new tab in the browser (leaving the "user portal" open in the previous tab. The management console tab expires after 1 hour but if you go back to the previous tab with the "user portal" still open, you can simply click on the link for the "management console" to open a new tab without the need to re-authenticate.

Is there a way to configure a session timeout for the "user portal" in SSO?

  • Andreas Seemueller 전문가
    2년 전

    Can you detail which identity source you are using? SSO internal, AD, or an external identity provider?

주제
보안, 신원 및 규정 준수AWS Well-Architected 프레임워크
태그
AWS IAM 자격 증명 센터보안
언어
English
bluescape-jreed
질문됨 2년 전1380회 조회
3개 답변
0

Can you detail which identity source you are using? SSO internal, AD, or an external identity provider? I'm using AzureAD as an external identity provider.

I guess you are using SAML 2.0 integration then? In that case you need to configure the session lifecycle on the Azure AD side. (see: https://docs.microsoft.com/en-us/graph/api/resources/tokenlifetimepolicy?view=graph-rest-1.0). The lifetime of the session set the maximum time a user can use the Amazon SSO web portal without re-authenticating to the external IDP.

전문가
Andreas Seemueller
답변함 2년 전
profile picture
전문가
Giovanni Lauria
검토됨 한 달 전
  • bluescape-jreed
    2년 전

    I don't see this attribute listed in AWS's list of SAML assertions though. The closest one I can find is SessionDuration but that only affects the AWS Management Console and not the AWS User Portal. Its uses 60 minutes as a default if not specified.

    So what this effectively does is it expires the AWS Management Console session after 60 minutes. However, if you can go back to the browser tab where you still have the User Portal open, you can click on the "Management Console" link to open a new session for 60 minutes without having to do any re-authentication with SAML.

    The "User Portal" seems to leave its session open for several hours (I think 8 but I need to test that)

  • bluescape-jreed
    2년 전

    https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_saml_assertions.html#saml_role-session-duration

  • A
    3달 전

    Where would I deploy the policy in Entra?

0

Can you detail which identity source you are using? SSO internal, AD, or an external identity provider?

I'm using AzureAD as an external identity provider.

bluescape-jreed
답변함 2년 전
0

Identity center launched the new feature to configure session duration for access portal - https://docs.aws.amazon.com/singlesignon/latest/userguide/configure-user-session.html

aarushi
답변함 일 년 전

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인

관련 콘텐츠