SSO issue working with Fleet Manager and RDP: SSO is not shared in a org

1

I'm trying to follow this post https://aws.amazon.com/blogs/security/how-to-enable-secure-seamless-single-sign-on-to-amazon-ec2-windows-instances-with-aws-sso/ But I have an error message related with SSO "An error occurred while calling the ListDirectoryAssociations API operation. SSO features are disabled. AccessDeniedException: SSO is not shared in org: xxxxx" I have configured SSO with AzureAD as external provider. Can somebody help me with this issue? Regards

  • Hi Hernan. I have the same issue; did you get anywhere with it? For me it works when SSOing into the AWS Organizations management account, but not on an invited account. On the latter, there's no option in Fleet Manager to use SSO as an authentication method, and the errors you mention crop up in the browser network debug log. I'll post here if/when I figure it out 👍

2 個答案
1

In the AWS Fleet Manager documentation, it mentions -

Fleet Manager supports AWS SSO authenticated RDP connections in the same AWS Region where you enabled AWS SSO

I have instances in multiple regions and it wasn't until I re-read the docs that I noticed this colossal limitation and understood why I wasn't getting anywhere. I'm guessing you're in the same boat.

The regional limitation of SSO is also mentioned here.

I'm still finding it hard to believe such a fundamental feature isn't supported by AWS SSO 😢

已回答 2 年前
  • Ouch. Thank you for the clue. I've production workloads split across regions as well and this is indeed a colossal limitation.

0

Hello, my suggestion is that you check that "trusted access" for SSO is enabled in the organization, please go to AWS Organizations>Services>Single Sign On and make sure "trusted access" is enabled, if that is enabled, then it may be a permissions issue, in this guide https://docs.aws.amazon.com/organizations/latest/userguide/services-that-can-integrate-sso.html you can check the role and it's permissions

AWS
已回答 2 年前
  • Thanks for your answer. Trustes Access was enable and related to permission, it seems the role has the needed ones. But I don't know if the permission should be related with the ec2 role o related with the user role.

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋,同時有助於提問者的專業成長。

回答問題指南