Using IDP V3 for SSO with AWS

[Wessel, Keith]

Hi, all,

Wondering if anyone's configured IDP v3 for SSO with AWS. Amazon's docs (http://blogs.aws.amazon.com/security/post/TxRTTT5PLUE6B5/How-to-use-Shibboleth-for-single-sign-on-to-the-AWS-Management-Console) are all about V2. My translation issue, I suspect, is in the relying-party changes. The error I'm getting from Amazon is:

Amazon Web Services Sign In
Your request included an invalid SAML response. To logout, click here

Not terribly helpful. I'm confident, based on my logs, that I'm releasing the correct attributes, but I suspect that I'm missing something with the relying party configuration. The above blog post says, in V2 lingo, that I need:

     <rp:ProfileConfiguration         xsi:type="saml:SAML2SSOProfile"       
includeAttributeStatement="true"        assertionLifetime="PT5M" assertionProxyCount="0"        signResponses="never" signAssertions="always"        encryptAssertions="never" encryptNameIds="never"        includeConditionsNotBefore="true"        maximumSPSessionLifetime="PT1H" />
 </rp:RelyingParty>

Based on what I think I've found the defaults for SAML2SSO, I've added the following override block to my V3 relying-party.xml:

        <bean parent="RelyingPartyByName" c:relyingPartyIds="urn:amazon:webservices">
            <property name="profileConfigurations">
                <list>
                    <bean parent="SAML2.SSO" p:encryptAssertions="false"
                        p:signResponses="false" p:signAssertions="true" />
                </list>
            </property>
        </bean>
       
I didn't' bothger overriding the SP session lifetime yet, but I think I covered all the other bases.

Am I missing something? Or is the relying party configuration not the issue? Anyone have advice for other pieces of the IDP configuration where I might have gone astray?

Thanks,
Keith