Amazon

Overview of the SSO flow

With the Amazon Cloud Identity Connector, PingFederate includes a Amazon authentication server in the sign-on flow.

The following diagram shows a service provider (SP)-initiated single sign-on (SSO) scenario in which PingFederate authenticates users to an SP application using the Amazon IdP Adapter.

cbs1568654125565
Amazon Cloud Identity Connector - Overview of the SSO flow

Processing Steps

  1. The user opens a web application and selects the Amazon sign-on option.

  2. The sign-on link points to the PingFederate Amazon IdP Adapter, which redirects the browser…​

  3. …​to Amazon with a list of requested permissions and the authorization callback endpoint. On Amazon, the user authenticates their identity and then authorizes the requested permissions.

  4. Amazon redirects the browser…​

  5. …​to the PingFederate Amazon IdP Adapter authorization callback endpoint with an authorization code.

    If the user fails to authenticate or does not authorize the request, the response includes an error code instead.

  6. PingFederate sends Amazon the client ID, client secret, authorization code, and the PingFederate authorization callback URL.

  7. Amazon returns an access token.

  8. PingFederate sends Amazon a request for user attributes and presents the access token.

  9. Amazon verifies the access token and provides the user information.

  10. PingFederate redirects the user to the web application with the user attributes.