How do I capture and analyze the SAML response to troubleshoot common errors when I use SAML 2.0 federation with AWS?

Short description

Make sure that you correctly configured Active Directory. For more information, see AWS federated authentication with Active Directory Federation Services (AD FS).

To set up federated access to your AWS accounts for the first time, it's a best practice to use AWS IAM Identity Center.

To troubleshoot SAML-related errors, take the following actions:

• View and decode the SAML response in your browser.
• Review the values in the decoded file.
• Check for errors, and then confirm the configuration.

Resolution

View and decode a SAML response

View the SAML response in your browser, and then use a decoding tool to extract the response that was sent to AWS. 

Review the values in the decoded file

Review the values in the decoded SAML response file:

• Verify that the value for the saml:NameID attribute matches the username for the authenticated user.
• Review the value for https://aws.amazon.com/SAML/Attributes/Role. The ARN and SAML provider are case sensitive, and the ARN must match the resource in your account.
• Review the value for https://aws.amazon.com/SAML/Attributes/RoleSessionName. The value must match the value in the claim rule. If you configure the attribute value for an email address or an account name, then make sure that the values are correct. The values must correspond to the email address or account name of the authenticated Active Directory user.

Check for errors and confirm the configuration

Check whether the values contain errors, and confirm that the following configurations are correct:

• The claim rules meet the required elements and all ARNs are correct. For more information, see Configure your SAML 2.0 IdP with relying party trust and adding claims.
• You uploaded the latest metadata file from your IdP into AWS in your SAML provider. For more information, see Activating SAML 2.0 federated users to access the AWS Management Console.
• You correctly configured the AWS Identity and Access Management (IAM) role's trust policy. For more information, see Modifying a role.
• The Active Directory user that tried to log in is a member of the Active Directory group for the IAM role.

For a list of common errors, see Troubleshooting SAML 2.0 federation with AWS. If you configured claim rules in Active Directory, then be sure to configure SAML assertions for the authentication response.