IAM Identity Center Configuration Issue with WorkSPaces Secure Browser

Question

Hello everyone,

I'm configuring a “WorkSPaces Secure Browser” but when I get to step 4, I can't configure my “identity provider” correctly with “AWS IAM Identity Center”, I always get the same message “To continue creating your portal, finish configuring your identity provider.”

This is where I think I made a mistake when configuring the “IAM Identity Center”:
It's in the application configuration for the Work Space Secure Browser.
At “Application details” and at :
“Application URL
Enter the URL where users can access the application.”

-> I put “AWS access portal URL”, which is the URL found in the IAM Identity Center Dashboard that lets you access the portal and not the application itself.

**Does anyone know what URL to enter in this field and where to find the correct URL to access the application?**

For the Trusted token issuers, I've put the right Issuer URL and the right ARN corresponding to the “AWSServiceRoleForAmazonWorkSpacesWeb” role.

So ok for that, but I have a point of attention too where I'm not 100% sure

For the “Aud claim” I've put back the “Issuer URL”. 
**Is this a good value for the Aud claim, or do we need to set something else for it to work properly?  Also, does anyone know where to find the “Aud claim” value if it's not the right configuration?**

Thanks in advance for any help!

re:Post Agent · Answer

It seems you've encountered some issues while configuring AWS IAM Identity Center with WorkSpaces Secure Browser. Let's address your concerns:

1. Application URL:
The "Application URL" should not be the AWS access portal URL. Instead, it should be the URL of your WorkSpaces Secure Browser portal. This URL is typically generated when you create your WorkSpaces Secure Browser portal. If you haven't created the portal yet, you may need to complete that step first. The correct URL should be specific to your WorkSpaces Secure Browser instance.

2. Aud claim:
Regarding the "Aud claim", using the Issuer URL is not the correct approach. The "aud" (audience) claim is meant to identify the intended recipient of the token. For WorkSpaces Secure Browser, you should use a specific value that represents your application. Unfortunately, the exact value isn't provided in the available information. You may need to check the WorkSpaces Secure Browser documentation or contact AWS support to get the correct "aud" claim value for your specific setup.

To resolve your configuration issues:

1. Ensure that your IAM Identity Center is in the same AWS account and AWS Region as your WorkSpaces Secure Browser portal.
2. When creating the portal, at Step 4: Configure identity provider, choose "AWS IAM Identity Center" and then "Continue with IAM Identity Center".
3. On the "Assign users and groups" page, select the appropriate users or groups you want to add to the portal.
4. For the Application URL, use the URL specific to your WorkSpaces Secure Browser portal, not the AWS access portal URL.
5. For the "Aud claim", you'll need to find the correct value specific to WorkSpaces Secure Browser. This may require additional research or contacting AWS support.

After making these adjustments, you should be able to complete the configuration process successfully.  
**Sources**  
[Configuring the IAM Identity Center authentication type for Amazon WorkSpaces Secure Browser - Amazon WorkSpaces Secure Browser](https://docs.aws.amazon.com/workspaces-web/latest/adminguide/configure-iam.html)  
[Creating a web portal with IAM Identity Center - Amazon WorkSpaces Secure Browser](https://docs.aws.amazon.com/workspaces-web/latest/adminguide/web-portal-IAM.html)  
[Trusted token issuer configuration settings - AWS IAM Identity Center](https://docs.aws.amazon.com/singlesignon/latest/userguide/trusted-token-issuer-configuration-settings.html)

IAM Identity Center Configuration Issue with WorkSPaces Secure Browser

Add your answer

Relevant content