Create a 3P App with SAML and SSO

To set up a third-party application with SAML and SSO integration for Amazon Connect, you'll need to follow a series of steps to ensure your frontend application can utilize the same login credentials and session as the user logged into the Agent Workspace. Here's a high-level overview of the process:

1. Set up an Identity Provider (IdP) or use an existing one that supports SAML 2.0.

2. Configure your Amazon Connect instance to use SAML-based authentication. This involves setting up SAML with AWS IAM for Amazon Connect.

3. In your IdP, set up your custom frontend application as a service provider (SP), alongside Amazon Connect.

4. Configure the SAML assertions in your IdP to include the necessary attributes for both Amazon Connect and your custom application.

5. In your frontend application, implement SAML authentication. This typically involves:

   • Redirecting users to the IdP for authentication
   • Handling the SAML response from the IdP
   • Validating the SAML assertion
   • Extracting user information from the SAML assertion

6. Use the AWS Security Token Service (STS) AssumeRoleWithSAML API in your application to obtain temporary AWS credentials. This allows your application to make AWS API calls on behalf of the authenticated user.

7. Implement session management in your application to maintain the user's authenticated state.

8. In Amazon Connect, configure your application as a third-party integration and set up the necessary permissions in the security profiles.

To make this work seamlessly, your application should be designed to work within the same single sign-on flow as Amazon Connect. When a user logs into the IdP, they should be able to access both Amazon Connect and your custom application without additional authentication steps.

While there isn't a specific reference architecture provided for this exact scenario, you can adapt the general SAML federation patterns used with AWS services to your specific use case with Amazon Connect.

Remember to thoroughly test your implementation to ensure it meets security best practices and doesn't introduce vulnerabilities. Also, make sure your application respects the session duration limits set by Amazon Connect and the IdP.

If you're still facing challenges, consider reaching out to AWS Support for more detailed guidance, especially if you have a business or enterprise support plan.
Sources
Set up SSO Federation for third-party apps in your Amazon Connect instance - Amazon Connect
Configure SAML with IAM for Amazon Connect - Amazon Connect
SAML 2.0 federation - AWS Identity and Access Management
Integrate third-party SAML solution providers with AWS - AWS Identity and Access Management