Integrate with AWS IAM Identity Center

Use JumpCloud SAML Single Sign On (SSO) to give your users convenient but secure access to all their web applications with a single set of credentials. Automate and centralize AWS IAM Identity Center user and group management through the full lifecycle by configuring an Identity Management integration between your JumpCloud account and AWS IAM Identity Center.

Read this article to learn how to configure the AWS IAM Identity Center Integration.

Prerequisites

• A JumpCloud administrator account
• JumpCloud SSO Package or higher or SSO add-on feature
• AWS Admin account (AWS root user)
• AWS organization

Important Considerations

• Single sign-on for AWS IAM Identity Center is recommended, but not required, when creating an Identity Management integration with AWS IAM Identity Center.
• SAML is the recommended method for managing secure user authentication into AWS IAM Identity Center.
• For the connector to work, usernames in AWS IAM Identity Center need to match email addresses in JumpCloud.
• If you need to renew your token, you must deactivate the Identity Management integration first, update your token and then reactivate the integration.
• If you deactivate Identity Management integration on an AWS IAM Identity Center application connector, you will need to generate a new access token if you want to activate it again. 
• If you delete an integrated AWS IAM Identity Center application from your Applications list, the application is removed from JumpCloud, but any previously bound users remain active in AWS IAM Identity Center. These users will be able to log in to AWS IAM Identity Center with the password they used prior to enablement of SSO to the AWS IAM Identity Center application from your JumpCloud account.
• When a user is deleted in JumpCloud, the user is deleted from AWS IAM Identity Center. 
• Once the Identity Source is changed to “External Identity Provider” and SCIM Provisioning is enabled in AWS IAM Identity Center, you can no longer create or update users and groups in AWS IAM Identity Center.
  • To manage AWS IAM Identity Center users who were created before SCIM provisioning was enabled, you need to add them in JumpCloud and add them to a User Group that is associated with the AWS IAM Identity Center application connector.
  • To manage AWS IAM Identity Center groups that were created before SCIM provisioning  was enabled, in JumpCloud, you have to select the Enable management of User Groups and Group Membership in this application. Then, create user groups with the same name as your existing AWS IAM Identity Center groups, and add those groups to the AWS IAM Identity Center application connector.
• AWS IAM Identity Center is only capable of returning 50 groups from their ListGroups API. 
• Group names in JumpCloud cannot have a ‘:’ character. Otherwise, they won’t sync.
• The username in AWS IAM Identity Center must match the email address in JumpCloud. If users were manually created in AWS IAM Identity Center before JumpCloud was configured as the external identity source, the username must be updated to the email address specified for that user in JumpCloud. If the username is not a valid JumpCloud email, then the following will occur.
  • Jumpcloud won’t be able to take over management of the user in AWS IAM Identity Center.
  • The user won’t be able to log in via SSO.
  • The user encounters an invalid MFA credentials error:

Attribute Considerations

• A default set of attributes are managed for users. See the Attribute Mappings section for more details.
• If the display name is updated in JumpCloud, AWS IAM Identity Center won’t overwrite it.
• When you update a Group name in the JumpCloud administrator portal, it will update in AWS IAM Identity Center as well.
• When a new user is provisioned to AWS IAM Identity Center, the value of the displayName attribute is set to combine the firstName and lastName attributes. For example, the attribute displayName = firstName + lastName:
  • firstName = “John”
  • lastName = “Doe”
  • displayName = “John Doe”

Creating a new JumpCloud Application Integration

1. Log in to the JumpCloud Admin Portal.
2. Navigate to USER AUTHENTICATION > SSO Applications.
3. Click + Add New Application.
4. Type the name of the application in the Search field and select it.
5. Click Next.
6. In the Display Label, type your name for the application. Optionally, you can enter a Description, adjust the User Portal Image and choose to hide or Show in User Portal.

7. Click Save Application.
8. If successful, click:
   • Configure Application and go to the next section.
   • Close to configure your new application at a later time.

Configuring the SSO Integration

To configure AWS IAM Identity Center 1

1. Log in to the AWS IAM Identity Center management console. 
2. Under Enable IAM Identity Center, choose Enable.
3. If there is not an existing AWS organization, click Create AWS organization to create one. 
4. Under Recommended setup steps, select Choose your identity source.
5. Next to Identity Source, click Change. 
6. Select External identity provider.
7. In the Service provider metadata section, click download metadata file. 
8. Keep the AWS console open because you need to access it for To configure AWS IAM Identity Center 2. 

To configure JumpCloud 

1. Create a new application or select it from the Configured Applications list.
2. Select the SSO tab.
3. Under Service Provider Metadata, click Upload Metadata.
4. Browse to the location of the Service Provider Metadata downloaded from the previous section and click Open.
5. Once this file is uploaded, all fields should populate automatically.
6. Click Export Metadata under JumpCloud Metadata.

7. Optionally, if you want to force SP Initiated Authentication, in the Login URL field, replace the value with your Login URL. 

8. Click save. 

To configure AWS IAM Identity Center 2

1. Go back to the AWS IAM Identity Center management console.
2. In the Identity provider metadata section, click Choose file, and upload the JumpCloud metadata file. 
3. Click Next: Review.
4. In the text box, type ACCEPT to change your identity source. 
5. Click Change identity source.

Authorizing User SSO Access

Users are implicitly denied access to applications. After you connect an application to JumpCloud, you need to authorize user access to that application. You can authorize user access from the Application Configuration panel or from the Groups Configuration panel. 

To authorize user access from the Application Configuration panel

1. Log in to the JumpCloud Admin Portal.
2. Go to USER AUTHENTICATION > SSO Applications, then select the application to which you want to authorize user access.
3. Select the User Groups tab. If you need to create a new group of users, see Get Started: User Groups.
4. Select the check box next to the group of users you want to give access.
5. Click save. 

To learn how to authorize user access from the Groups Configuration panel, see Authorize Users to an SSO Application.

Validating SSO authentication workflow(s)

IdP Initiated

• Access the JumpCloud User Console.
• Select the application’s tile.
• The application will launch and login the user.

SP Initiated

• Navigate to your Service Provider application URL.
• You will be redirected to log in to the JumpCloud User Portal.
• The browser will be redirected back to the application and be automatically logged in.

Configuring the Identity Management Integration

1. Create a new application or select it from the Configured Applications list.
2. Select the Identity Management tab.
3. Click configure, and keep the window available. 
4. In a new window, log in to the AWS administrator console. 
5. Go to All Services > Security, Identity & Compliance, and select AWS Single Sign-On.
6. Under Recommended setup steps, select Choose your identity provider.
7. In the Identity source section, select Enable automatic provisioning.
8. Copy the SCIM Endpoint URL from the Inbound automatic provisioning modal.
9. Go back to the AWS IAM Identity Center application connector in JumpCloud.
   • Click Enable management of User Groups and Group Membership in this application if you want to provision, manage, and sync groups.
   • *SP Base URL: Paste the SCIM Endpoint URL you copied from AWS. 
10. Go back to the AWS IAM Identity Center Inbound automatic provisioning modal. Click Show token, then copy the token. Important: When you click Show token, you have to keep the window open until you have copied and entered the token into JumpCloud. After you close the Inbound automatic provisioning modal, it doesn’t show you this information again.
11. Go back to the AWS IAM Identity Center application connector in JumpCloud. *SP SPI Token: Paste the Access token you copied from AWS.
12. Click Activate. 
13. You receive a confirmation that the Identity Management integration has been successfully verified and a Public Certificate is created. You can download the certificate from here.
14. Click save.
15. After the application is saved, it appears in the SSO Applications list. You can now connect users to the application in JumpCloud to provision them in AWS IAM Identity Center. Learn how to Authorize Users to an SSO Application.

To configure Attribute Based Access Control (ABAC)

AWS IAM Identity Center supports the use of attributes to control access to your AWS resources across multiple AWS accounts. This authorization strategy is known as attribute-based access control (ABAC). Within the AWS IAM Identity Center console, you can define fine-grained permissions and policies based on attributes sent from JumpCloud. Attributes used for ABAC are called tags in AWS. Using user attributes as tags in AWS helps you simplify the process of creating and managing permissions in AWS and allows you to extend your zero trust security model to your AWS resources. 

Configuring ABAC in AWS IAM Identity Center is done through the Attributes for access controls page in the AWS IAM Identity Center console. There are two ways to configure ABAC. You can use SCIM user attributes or SAML attributes. 

Important: In scenarios where the same attributes are sent to AWS IAM Identity Center through SAML and SCIM, the SAML attributes values take precedence in access control decisions.

To enable ABAC in AWS IAM Identity Center

To use attributed based access control (ABAC), you need to enable the Attributes for access control feature in AWS IAM Identity Center console. For more information about how to do this, see Enable and configure attributes for access control

1. Log in to the AWS IAM Identity Center console. 
2. Click Settings from the left hand navigation panel.
3. On the Settings page, under Identity source, next to Attributes for access control, click Enable.

To configure ABAC Using SCIM User Attributes

You can select user attributes sent to AWS IAM Identity Center via the JumpCloud SCIM Identity Management integration to be used as attributes to manage access (ABAC) to your AWS resources. Then, you create a permission set in AWS IAM Identity Center to manage access based on the attributes you passed from JumpCloud. For more information about which user attributes are passed from JumpCloud, see Attribute Mappings, below. For more information about configuring attributes for access controls, see Enable and configure attributes for access control.

1. Log in to the AWS IAM Identity Center console.
2. Click Settings from the left hand navigation panel.
3. On Settings > Identity source, next to Attributes for access control, click View details.
4. Enter a Key value.
   • Note: You can provide any name you want. Key represents the name you are giving to the attribute for use in policies and is case sensitive. You need to specify that exact name in the policies you author for access control. The Key must also be named exactly the same in your aws:PrincipalTag condition key (i.e., “ec2:ResourceTag/CostCenter”:  “${aws:PrincipalTag/CostCenter}”)
5. Select the Value.
6. Click Save changes.

To configure ABAC using SAML Attributes

You can configure SAML attributes for AWS IAM Identity Center to manage access to your AWS resources. The attributes that you define in JumpCloud will be passed in a SAML assertion to AWS IAM Identity Center. You then create a permission set in AWS IAM Identity Center to manage access based on the attributes you passed from JumpCloud. 

1. Open the JumpCloud AWS Single Sign-On application that you installed as part of configuring SAML for JumpCloud. Go to USER AUTHENTICATION > SSO.
2. Click the AWS Single Sign-On application, and then click the second tab, SSO.
3. At the bottom of this tab you have User Attribute Mapping, click Add new attribute. 
4. To use one of the predefined JumpCloud Attribute values:
   1. In the Service Provide Attribute Name field, enter https://aws.amazon.com/SAML/Attributes/AccessControl:AttributeName replacing AttributeName with the name of the attribute you are expecting in AWS IAM Identity Center. For example, https://aws.amazon.com/SAML/Attributes/AccessControl:Region
   2. In the JumpCloud Attribute Name field, select user attributes from your JumpCloud directory. For example, addresses.work.region.
   3. Repeat steps 1-2 for each additional attribute you want to map.
   4. Click save.
5. To use dynamic attributes from the user or group record:
   1. In the Service Provide Attribute Name field, enter https://aws.amazon.com/SAML/Attributes/AccessControl:AttributeName replacing AttributeName with the name of the attribute you are expecting in AWS IAM Identity Center. For example, https://aws.amazon.com/SAML/Attributes/AccessControl:CostCenter. 
   2. In the JumpCloud Attribute Name field, select Custom User or Group Attribute.
   3. Enter a name for the attribute. For example, AWS-ABAC-Project.
   4. Repeat steps 1-3 for each additional attribute you want to map.
   5. Click save.
   6. Open the user or group record for which you to pass the value for the attribute you created.
   7. In the Users or Group Details tab, go to the Custom Attributes section and click add new custom attributes.
   8. Select string.
   9. For Attribute Name, enter the name of one of the custom attributes that’s listed on the AWS IAM Identity Center configuration. For example AWS-ABAC-Project.
   10. For Attribute Value, enter the value you want to send for the attribute.
   11. Repeat steps 1-5 for each additional attribute you want to map.
   12. Click save.

To use ABAC in Permission Policies

Once you have configured attributes for use with ABAC, you can create permission policies that use those attributes for controlling access to AWS resources, services, and actions.

To apply a permission policy from the AWS IAM Identity Center console:

1. Log in to the AWS IAM Identity Center console.
2. Navigate to AWS Accounts > Permission Sets.
3. Select the permission to which you want to add a permission set.
4. Click Edit Permissions in the Permissions Policy.
5. Enter the json for the permission policy you want to add or update.

For example, denying certain actions by Project or Region:

6. Click Save Policy.
7. *Optionally, select the accounts to which the permission has been applied, so the new or updated policy can be applied and click Reprovision. Otherwise, click Skip for now.
8. If you don’t already have tags defined for your permission, click Add tags in the Tags section. Otherwise, click Edit Tags to add a new tag.
9. Add all the attributes you will be using in your Permissions Policy.
   • For example, Project and Region.
   • *Optionally, enter a value for the Key.
     • Note: Key is case sensitive and must exactly match the attribute you defined in Attributes for access control interface in the AWS IAM Identity Center console and in the SAML attributes you pass from JumpCloud.
10. Click Save changes.

Attribute Mappings

The following table lists attributes that JumpCloud sends to the application. See Attribute Considerations for more information regarding attribute mapping considerations. 

Learn about JumpCloud Properties and how they work with system users in our API. 

Group Management Considerations

Enabling Group Management

You must select the Enable management of User Groups and Group Membership in this application option to manage groups and group membership in the application from JumpCloud.

Group Provisioning and Syncing 

• Empty groups are not created.
• JumpCloud takes over management of existing groups in the application when the user group name in JumpCloud matches the name of the group in the application.
• All user groups associated with the application in JumpCloud are synced. Syncing occurs whenever there is a membership or group change event.
• Group renaming is supported.
• If a user group is disassociated from the application in JumpCloud, syncing immediately stops and the group is left as-is in the application. All members of that user group are deactivated in the application unless they are associated with another active application group that is managed from JumpCloud.

Group Deletion

• Managed groups deleted in JumpCloud are deleted in the application.
• All members of the deleted group are deactivated in the application, unless they are associated with another active application group that is managed from JumpCloud.

Disabling Group Management

• You can disable group and group membership management by unchecking the Enable management of User Groups and Group Membership in this application option.
• The managed groups and group membership are left as-is in the application.
• JumpCloud stops sending group membership information for the user, but the user’s identity will continue to be managed from JumpCloud.

Removing the Integration

To deactivate the IdM Integration

1. Log in to the JumpCloud Admin Portal.
2. Go to USER AUTHENTICATION > SSO Applications.
3. Search for the application that you’d like to deactivate and click to open its details panel. 
4. Under the company name and logo on the left hand panel, click the Deactivate IdM connection link.
5. Click confirm. 
6. If successful, you will receive a confirmation message.

To deactivate the SSO Integration

1. Log in to the JumpCloud Admin Portal.
2. Go to USER AUTHENTICATION > SSO Applications.
3. Search for the application that you’d like to deactivate and click to open its details panel. 
4. Select the SSO tab.
5. Scroll to the bottom of the configuration.
6. Click Deactivate SSO or Deactivate Bookmark. 
7. Click save. 
8. If successful, you will receive a confirmation message.

To delete the application

1. Log in to the JumpCloud Admin Portal.
2. Go to USER AUTHENTICATION > SSO Applications.
3. Search for the application that you’d like to delete.
4. Check the box next to the application to select it.
5. Click Delete.
6. Enter the number of the applications you are deleting
7. Click Delete Application.
8. If successful, you will see an application deletion confirmation notification.