AWS Builder Center is the official home for builders on AWS. Share and read what others are working on, follow people who inspire you, explore training and workshops, and find tools to support what you're building.
EntraID SSO for Workspaces Pool Issue
Hello all,
I've spent the last few days trying to setup EntraID SSO with our workspaces pool directory. To put it simply, it seems that the authentication is working, as I see the success on the EntraID side; however, I must have something else wrong because after the user clicks on "Continue to sign in to workspaces", it opens a browser successfully, performs the authentication, but then drops the user into the AWS Access Portal.
If the user were to click the "Permission Set" that I built using the instructions from AWS, it takes them to the AWS console.
I'm going to do my best to show as much of the information as I can without compromising sensitive info, but I'm hoping someone can identify where I went wrong.
If there's anything else I can post to help with identifying the issue, please let me know. It seems that my authentication is working but my authorization is broken, or maybe both are working and I've somehow messed up the re-direct of the logon URL's or something.
Any help would be awesome! Thank you!
- Newest
- Most votes
- Most comments
Based on your description, it appears that your SAML authentication with EntraID is working correctly, but the redirection after successful authentication is not taking you to WorkSpaces Pools as expected. Instead, you're being redirected to the AWS Access Portal.
This issue is likely related to how the relay state is configured in your SAML setup. When a user authenticates through a SAML 2.0 identity provider for WorkSpaces Pools, the authentication flow should direct them to the WorkSpaces application rather than the AWS console.
Here are some potential issues and solutions:
-
Relay State Configuration: The relay state URL should point specifically to the WorkSpaces Pools directory relay state URL, not just to the AWS console. This is a common issue where users are redirected to the AWS console instead of WorkSpaces after authentication.
-
SAML Assertion Configuration: Ensure your SAML assertion is correctly configured with all required attributes for WorkSpaces Pools. The assertion needs to properly identify that the user is attempting to access WorkSpaces, not just the AWS console.
-
IAM Role Permissions: Verify that the IAM role used for SAML federation has the necessary permissions for WorkSpaces Pools access. If the role is only configured for general AWS console access, users will be directed there instead of to WorkSpaces.
-
WorkSpaces Pools Directory Configuration: Double-check your WorkSpaces Pools directory configuration to ensure it's properly set up for SAML 2.0 authentication. WorkSpaces Pools only supports SAML 2.0 identity providers for authentication, unlike WorkSpaces Personal which can use AWS Managed Microsoft AD.
-
User Access URL: The User Access URL in your WorkSpaces Pools directory settings might need adjustment. There have been issues reported where the URL format or length causes problems with the authentication flow.
Remember that WorkSpaces Pools and WorkSpaces Personal have different authentication configurations, even when both are using SAML. Make sure you're following the specific documentation for WorkSpaces Pools when setting up your EntraID integration.
Sources
Using AWS Managed AD with WorkSpaces Pools - on the roadmap? | AWS re:Post
Amazon WorkSpaces SAML Authentication with Active Directory Federation Service (ADFS) | AWS re:Post
AWS WorkSpace Pool | AWS re:Post
Overview of Active Directory Domains - Amazon WorkSpaces
Relevant content
asked 8 months ago
asked 2 years ago
