AWS SSO ERROR 403 with AD connector

Question

I have enabled AWS SSO and set directory source to be my AD connector. Users authenticate without issue, however login into accounts show below error
https://ibb.co/XC2LvgP

Below cloudtrail event
{
    "eventVersion": "1.08",
    "userIdentity": {
        "type": "Unknown",
        "principalId": "local.test//S-1-5-21-2194430433-125441924-3567485280-1114",
        "accountId": "",
        "userName": "admin3000@local.test"
    },
    "eventTime": "2022-06-18T17:34:02Z",
    "eventSource": "sso.amazonaws.com",
    "eventName": "Federate",
    "awsRegion": "eu-central-1",
    "sourceIPAddress": "",
    "userAgent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36",
    "errorCode": "403",
    "errorMessage": "Forbidden",
    "requestParameters": null,
    "responseElements": null,
    "requestID": "8090dc61-de3a-4bde-9275-f6efa75db024",
    "eventID": "1c10d90b-b47b-4a48-93e3-bc6f870dd7b9",
    "readOnly": false,
    "eventType": "AwsServiceEvent",
    "managementEvent": true,
    "recipientAccountId": ,
    "serviceEventDetails": {
        "role_name": "AdministratorAccess",
        "account_id": ""
    },
    "eventCategory": "Management"
}

Also in terminal below error happens while using same user to log with aws sso cli
An error occurred (ForbiddenException) when calling the GetRoleCredentials operation: No access

I have checked all roles of SSO and seems nothing is missed. Also issue happens when the identity store is AD, however no issue while identity store is the internal SSO identity store.
Can you please advise.

Regards
Ali

rePost-User-2618137 · Answer

Hi There,
I don't think the issue from the integration between AD and SSO due to below points
- Authentication is working without any problem. Only issue with authorization
- I have already used guided process

Users are presented in SSO, issue again when user try to use any accounts will get 403, it happens after the authentication.

rePost-User-2618137 · Answer

Hello There,
I think you have missed my point, I am not using ADFS with SAML. I am using AWS SSO and source is AD connector. So all of these settings has been created by AWS SSO. Even I can't modify any of these created SSO roles. Below steps I have used
1- Created a service account in AD to be used by AD connector.
2- Changed AWS SSO identity source to this AD connector
3- Set permission sets to access the AWS accounts.
4- Authentication part is working but problem with role authorization.

So please suggest what can be done.

AWS SSO ERROR 403 with AD connector

Relevant content