Forbbiden 403 access denied with AWS SSO SAML application from Gitlab integration

0

HI,

I have a setup with AWS SSO and its identity source is AWS SSO (not AD or external)

I have a problem with this integration, the gitlab configuration has the correct configuration (with IDP Okta has worked correctly with the same configuration by Gitlab).

The idea is to use AWS SSO as IdP and Gitlab as SP.

Gitlab settings:

gitlab_rails['omniauth_enabled'] = true
gitlab_rails['omniauth_auto_link_user'] = ['saml']
gitlab_rails['omniauth_external_providers'] = ['saml']
gitlab_rails['omniauth_sync_profile_from_provider'] = ['saml']
gitlab_rails['omniauth_allow_single_sign_on'] = ['saml']
gitlab_rails['omniauth_block_auto_created_users'] = false
gitlab_rails['omniauth_auto_link_saml_user'] = false
gitlab_rails['omniauth_providers'] = [
  {
    name: "saml",
    label: "Saml Provider",
    args: {
      assertion_consumer_service_url: "http://gitlab.domain/users/auth/saml/callback",
      idp_sso_target_url: "https://portal.sso.eu-west-1.amazonaws.com/saml/assertion/{assertion_id}",
      issuer: "https://portal.sso.eu-west-1.amazonaws.com/saml/assertion/{assertion_id}",
      name_identifier_format: "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
      idp_cert_fingerprint: "{fingerprint_cert}"
    }
  }
]

Into AWS SSO the config is:

AWS SSO mappings image url

The assigned users is a Administrator Group to which I belong

But I recivied this error:

AWS SSO Error image url

I only see the SAML Request but I can't find the SAML Response, also when I go back to the gitlab url with the Cookie, I get the following message in it: Could not authenticate you from SAML because "Saml response missing".

The assertions required by gitlab is:

Field	Supported keys
Email (required)	email, mail
Full Name	name
First Name	first_name, firstname, firstName
Last Name	last_name, lastname, lastName

Regards!

질문됨 3년 전3689회 조회
2개 답변
1

I think the problem is related to setting up the trust between Gitlab - the service provider's application and AWS SSO, make sure to check the instruction manual AWS Single Sign-On (AWS SSO) Integration Guide for GitLab

HTH.

AWS
답변함 3년 전
  • I have followed that guide and the most I get is a 403 in the AWS SSO, I can not see more logs except the ones I see in the Cloudtrial where the 403 is indicated in Federate.

    The configuration with the Okta provider has worked correctly but with AWS SSO I can't get it to work.

0
수락된 답변

Hi again,

FInally, the configuration that has worked correctly for me into AWS SSO is:

Attribute APPAttributte SSOFormat
Subject${user:email}emailAddress
name${user:name}basic
last_name${user:familyName}basic
first_name${user:givenName}basic
email${user:email}basic

Regards!

답변함 3년 전

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인

관련 콘텐츠