• If you want to use OGNL expressions to populate the values of the AWS session tags, see Enable and disable expressions in the PingFederate documentation.
  • Create an Amazon Web Services (AWS) console account and policy that uses session tags. For help, see AWS prerequisites in the PingAccess documentation.
  1. Open your service provider (SP) connection. Go to SP Connection > Browser SSO > Assertion Creation > Attribute Contract.
  2. Extend the contract of the AWS SP connection.
    • If you are using AWS SSO, include the access control tags based on the following format:
      • https://aws.amazon.com/SAML/Attributes/AccessControl:{attribute}

      This screen capture shows the Attribute Contract tab with several example AWS SSO access control attributes.
    • If you are using AWS IAM, include the AWS Principal Tags and TransitiveTagKeys, based on the following examples:
      • https://aws.amazon.com/SAML/Attributes/AccessControl:{attribute}
      • https://aws.amazon.com/SAML/Attributes/PrincipalTag:project
      • https://aws.amazon.com/SAML/Attributes/Role
      • https://aws.amazon.com/SAML/Attributes/RoleSessioName
      • https://aws.amazon.com/SAML/Attributes/TransitiveTagKeys

      This screen capture shows the Attribute Contract tab with the example AWS IAM PrincipalTag and TransitiveTagKeys attributes.
  3. Go to SP Connection > Browser SSO > Assertion Creation > IdP Adapter Mapping > Attribute Sources & User Lookup > Attribute Contract Fulfillment.
  4. Configure the attribute contract fulfillment for the AWS attributes.
    Example 1: This example shows AWS IAM Identity Center attributes mapped directly from an HTML Form Adapter instance.
    This screen capture shows the Attribute Contract Fulfillment tab with AWS IAM Identity Center attributes mapped to Adapter sources.
    Example 2: This example shows AWS IAM attributes mapped from a data source and manipulated by the OGNL expression language available in PingFederate.
    This screen capture shows the Attribute Contract Fulfillment tab with AWS IAM attributes mapped to Adapter and LDAP sources.
  5. Click Save.
The AWS session tags are now included in the SAML assertion created by PingFederate.