- Newest
- Most votes
- Most comments
The SAML assertions for WorkSpaces personal cannot perform kerberos authentication to the operating system. For that, you will need Certificate Based Authentication.. This will perform the login to the operating system for a true SSO experience.
It sounds like there may be an issue with your SAML configuration between JumpCloud and Amazon WorkSpaces. Here are a few things to check:
-
Verify attribute mapping: Ensure that the attributes being sent from JumpCloud to Amazon WorkSpaces are correctly mapped. The username attribute in particular needs to be properly configured in both JumpCloud and WorkSpaces.
-
Check the SAML response: Review the SAML response in your browser to make sure all required attributes are present and correctly formatted. The NameID element should have a persistent value and match the WorkSpaces username and Active Directory's samaccountname. The Role attribute should start with the IAM role ARN, followed by a comma and the IdP ARN. The RoleSessionName value should be an email address or user principal name that matches the user's Active Directory email.
-
IAM role permissions: Verify that the IAM role used for SAML authentication has the necessary permissions, including the workspaces:Stream action.
-
Trust relationship policy: Check the trust relationship policy in your IAM role to ensure it includes the sts:AssumeRoleWithSAML and sts:TagSession actions, with the SAML:sub_type value set to persistent.
-
Relay state configuration: Make sure the relay state is properly configured to pass along necessary information, including the username, to Amazon WorkSpaces.
-
Test with different users: Try the SSO process with multiple user accounts to determine if the issue is specific to one user or a general configuration problem.
If you've verified these settings and the issue persists, you may want to check the logs in both JumpCloud and Amazon WorkSpaces for any error messages that could provide more specific information about the problem. Remember that when properly configured, the WorkSpaces username should be automatically populated from the JumpCloud SAML assertion, allowing for a seamless login experience.
Sources
Username Prefill for WorkSpaces SAML Configuration JumpCloud | AWS re:Post
Configure SAML 2.0 authentication for WorkSpaces | AWS re:Post
Troubleshoot SAML 2.0 authentication issues in WorkSpaces | AWS re:Post
In section 5, you mention that the relay state should be configured to pass the ‘username’ to Amazon WorkSpaces. Can you clarify how that value should be passed in the SAML assertion?
Relevant content
- asked 2 years ago
- asked 3 years ago
AWS OFFICIALUpdated 8 months ago- AWS OFFICIALUpdated 8 months ago
- AWS OFFICIALUpdated 9 months ago
- AWS OFFICIALUpdated 10 months ago
Thanks for the answer. Could you also clarify if certificate-based authentication is supported on the linux workspaces for ubuntu 22.04?
Can you please confirm if the password prompt is expected behavior when authenticating to WorkSpaces from JumpCloud via SAML? (without enabling certificate based auth)