By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

SSO with Managed AD as idp - 403 forbidden

0

Hi,

I've connected the SSO idp to the Managed Active Directory with AD Connector as proxy between SSO and Active Directory.

User and groups are sync correctly I can loggin to the SSO I can attach permission set to account

After logging to the SSO when I click on the account to assume the role I got a 403 error {"message":"No access","__type":"com.amazonaws.switchboard.portal#ForbiddenException"}

I don't know where to search to solve this issue.

Can you please help me ?

Regards

Topics
Security, Identity, & ComplianceManagement & Governance
Tags
AWS Identity and Access ManagementAWS Directory ServiceAWS IAM Identity CenterAWS Account Management
Language
English
FabienG
asked 2 years ago620 views
2 Answers
1
Accepted Answer

HI,

Solved, the issue was a mapping problem between AWS Managed AD and SSO. The SSO user primary-email field was empty.

We change the mapping, everything works well

Regards

FabienG
answered 2 years ago
profile picture
EXPERT
Adeleke Adebowale Julius
reviewed a year ago
  • Kisshore Gunasekaran
    2 years ago

    Hi @fabieng, can you please share the attribute mapping configured on the SSO.

0

I recommend you review the metadata issued and supported by AWS SSO. Then check the attribute mapping making sure the format is set to "transient"

profile picture
Gera
answered 2 years ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions

Relevant content