AWS SSO with GSuite external identify with AWS VPN Client Endpoint
I use AWS SSO with GSuite as an external identity provider to provide access to our AWS accounts. I was trying to setup AWS VPN Client Endpoint to allow access via the same method.
So far I'm able to get to the authentication, however, after entering the details, I get a "Oops, something went wrong; Provide your administrator with the following info: No access. 403".
I've configured VPN for mutual authentication and federated login, and chose our AWS SSO as the source for login. AWS SSO is working fine for AWS accounts access, but no luck for the VPN yet.
Hello and thanks for writing in.
While I'm confident we can get past the current "oops something went wrong" error, the last update i have when using AWS Client VPN _ Google Idp is the fact that Google does not support the use of a non secure ACS URL (http) while the AWS client VPN does not support HTTPS. While the support for use of secure ACS URL's is in the works, the only supported and tested Idps as far as Client VPNs go are Okta and Azure AD. This of course, does not mean other Idps will not work but is not guaranteed. Please refer to the link below for all the relevant information for client VPN _ SAML integration including the requirements and considerations.
External Identity Source is not an option when setting up AWS SSOasked a month ago
Transit Gateway shared with AWS Resource Access Manager (AWS RAM) identify all accounts as externalAccepted Answerasked 3 years ago
issues with AWS SSO linking to Google WorkspacesAccepted Answerasked 5 months ago
AWS SSO + Azure AD, no way to access AWS Console?Accepted Answerasked 5 months ago
AWS VPN Client - how does it open a browser for SSO ?asked 4 months ago
Will AWS SSO conflict with IAM ID provider?Accepted Answerasked 2 years ago
AWS SSO - Manage UsersAccepted Answerasked a month ago
AWS SSO "User Portal" session timeout.asked a month ago
AWS client vpn selfserviceasked 4 months ago
AWS SSO with GSuite external identify with AWS VPN Client Endpointasked a year ago