How to get IAM Identity Center User Attributes?

Hello,

No direct way to get IAM Identity Center user attributes via SDK or CLI.

• SAML Attribute Mapping: Map custom attributes to SAML claims for your application to access [AWS IAM Identity Center attribute mappings concept] https://docs.aws.amazon.com/singlesignon/latest/userguide/attributemappingsconcept.html).

• Lambda with AssumeRole: Develop secure Lambda to assume role and retrieve data with AWS SDK [AWS Lambda documentation](link: https://docs.aws.amazon.com/lambda/latest/dg/welcome.html).

• Separate User Pool: Create separate user pool in your app to mirror IAM Identity Center users and capture custom attributes.

Hi AleXONIVY,

Please go through the below steps i hope it will helps to resolve your issue.

Here's a general approach to achieve what you want:

• Use AWS SDK for JavaScript (or any other SDK): Since AWS SDK for JavaScript (v3) is commonly used, I’ll provide examples using it. You can adapt the code for other SDKs like Python (boto3) as needed.

• Create and Manage Custom Attributes: If you need to set or update custom attributes, you would typically use the AWS Management Console or API to update the user profiles. Unfortunately, as of my knowledge cutoff in June 2023, AWS does not provide direct API endpoints to manage custom attributes for users in IAM Identity Center (SSO).

• Retrieve Custom Attributes via IAM Identity Center: There isn’t a direct API to fetch custom attributes from IAM Identity Center. However, you can use AWS SSO's ListUsers API to retrieve user attributes and then handle custom attributes stored in an external store (like a database) that your application can query.

Here's an example approach using Node.js:

Step 1: Set up AWS SDK

Install AWS SDK for JavaScript (v3):

npm install @aws-sdk/client-identitystore
npm install @aws-sdk/client-sso-admin

Step 2: Code to Retrieve User Attributes

const { IdentitystoreClient, ListUsersCommand } = require('@aws-sdk/client-identitystore');
const { SSOAdminClient, ListInstancesCommand } = require('@aws-sdk/client-sso-admin');

// Initialize clients
const identitystoreClient = new IdentitystoreClient({ region: 'us-west-2' });
const ssoAdminClient = new SSOAdminClient({ region: 'us-west-2' });

// Function to get Identity Store ID
const getIdentityStoreId = async () => {
    const instancesCommand = new ListInstancesCommand({});
    const response = await ssoAdminClient.send(instancesCommand);
    return response.Instances[0].IdentityStoreId; // Assumes single instance
};

// Function to list users
const listUsers = async (identityStoreId) => {
    const usersCommand = new ListUsersCommand({ IdentityStoreId: identityStoreId });
    const response = await identitystoreClient.send(usersCommand);
    return response.Users;
};

// Main function
const main = async () => {
    try {
        const identityStoreId = await getIdentityStoreId();
        const users = await listUsers(identityStoreId);

        // Display user attributes
        users.forEach(user => {
            console.log(`User: ${user.UserName}, Attributes: ${JSON.stringify(user)}`);
            // Add code to fetch and display custom attributes from your external store
        });
    } catch (error) {
        console.error(error);
    }
};

main();

Step 3: Manage Custom Attributes

Since custom attributes are not directly supported via the Identity Store API, you should maintain these attributes in an external database. For example, use DynamoDB to store and retrieve custom attributes:

Example DynamoDB Structure:

• Table Name: UserAttributes
• Partition Key: UserName (String)
• Attributes: Division, CustomAttribute1, CustomAttribute2, etc.

Step 4: Integrate DynamoDB in the Application

const { DynamoDBClient, GetItemCommand } = require('@aws-sdk/client-dynamodb');

const dynamoDBClient = new DynamoDBClient({ region: 'us-west-2' });

const getCustomAttributes = async (userName) => {
    const params = {
        TableName: 'UserAttributes',
        Key: {
            'UserName': { S: userName }
        }
    };
    const command = new GetItemCommand(params);
    const response = await dynamoDBClient.send(command);
    return response.Item;
};

// Fetch and display custom attributes in the main function
const main = async () => {
    try {
        const identityStoreId = await getIdentityStoreId();
        const users = await listUsers(identityStoreId);

        for (const user of users) {
            console.log(`User: ${user.UserName}, Attributes: ${JSON.stringify(user)}`);
            const customAttributes = await getCustomAttributes(user.UserName);
            console.log(`Custom Attributes: ${JSON.stringify(customAttributes)}`);
        }
    } catch (error) {
        console.error(error);
    }
};

main();