iam identity center saml application, no access error

Question

I want to sign in to a keycloak instance using aws iam identity center.

my users are provisioned by entra, and they work for sigining in to the aws console.

i've set up a saml application and assigned myself as a user, set up keycloak accordingly.

when i initiate the login flow from keycloak, i get forwarded to aws sso, and if signed out there to entra and back again, and there the flow stops  with a no access error. we never get back to keycloak.

if i then press the show all apps button, the keycloak saml app is there.

i've tried everything i can think of, scoured the internet and the ai's. i'm all out of ideas.

what can i do to make that no access error go away, how can i discover whats actually going wrong.

re:Post Agent · Answer

Based on your description, you're experiencing a "No access" error when trying to use IAM Identity Center with Keycloak as a SAML application, even though your users can successfully sign in to the AWS console.

Here are some troubleshooting steps you can take:

1. Debug the SAML assertions: IAM Identity Center provides a way to examine the SAML assertions being sent. When you're signed into the AWS access portal:
- Hold down the Shift key
- Click on the Keycloak application tile
- Release the Shift key
- This will show you the "You are now in administrator mode" page with the SAML assertion details
- You can choose "Copy XML" to save this information for analysis

2. Check for SAML attribute issues: The error might be related to missing or incorrect attributes in the SAML response. Common issues include:
- Missing required attributes in the SAML configuration
- Incorrect attribute mappings between IAM Identity Center and Keycloak
- Ensure the SAML response includes all necessary attributes with correct formatting

3. Verify permission assignments: Make sure that:
- Your user is correctly assigned to the SAML application in IAM Identity Center
- The permission sets assigned to your user for this application are appropriate
- There are no conflicting policies or restrictions

4. Check session management: Since you mentioned using Entra ID (formerly Azure AD) as your identity source, be aware that IAM Identity Center does not support Single Logout (SLO) with external identity providers. This could potentially cause session-related issues.

5. Verify username requirements: In some cases, very short usernames (like one character) can cause issues with IAM Identity Center. Ensure your username meets any length requirements.

If you continue to experience issues, you might need to contact AWS Support for further assistance, as there could be an underlying configuration problem that's not immediately apparent.  
**Sources**  
[No access error during access to Management Console from the Access Portal for an IAM Identity Center's user with AdministratorAccess &/| PowerUserAccess permission sets | AWS re:Post](https://repost.aws/questions/QUMZcEHK1QTJ2F9LGuegh3fg/no-access-error-during-access-to-management-console-from-the-access-portal-for-an-iam-identity-center-s-user-with-administratoraccess-poweruseraccess-permission-sets)  
[Single Logout (SLO) support for IAM Identity Center with Entra ID SSO | AWS re:Post](https://repost.aws/questions/QU9vsYECbvThOJ-jGD3xZV9Q/single-logout-slo-support-for-iam-identity-center-with-entra-id-sso)  
[Troubleshoot SAML federation with IAM - AWS Identity and Access Management](https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_saml.html)  
[Troubleshooting IAM Identity Center issues - AWS IAM Identity Center](https://docs.aws.amazon.com/singlesignon/latest/userguide/troubleshooting.html)

iam identity center saml application, no access error

Add your answer

Relevant content