--- title: Using SAML and token exchange to federate into AWS through the AWS Command Line Interface description: Federate into AWS via CLI using PingFederate to issue a SAML assertion and exchange it for AWS API access credentials. component: solution-guides page_id: solution-guides:multi-factor_authentication_use_cases:htg_use_saml_and_token_exchange_to_federate_into_aws canonical_url: https://docs.pingidentity.com/solution-guides/multi-factor_authentication_use_cases/htg_use_saml_and_token_exchange_to_federate_into_aws.html llms_txt: https://docs.pingidentity.com/solution-guides/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md revdate: April 24, 2025 page_aliases: ["multi-factor_authentication_use_cases:htg_use_saml_and_token_exchange_to_federate_into_aws_pf_sp_connect.adoc", "multi-factor_authentication_use_cases:htg_use_saml_and_token_exchange_to_federate_into_aws_download_jar.adoc", "multi-factor_authentication_use_cases:htg_use_saml_and_token_exchange_to_federate_into_aws_change_sys_props.adoc", "multi-factor_authentication_use_cases:htg_use_saml_and_token_exchange_to_federate_into_aws_create_token.adoc", "multi-factor_authentication_use_cases:htg_use_saml_and_token_exchange_to_federate_into_aws_use_ws_trust_sts.adoc", "multi-factor_authentication_use_cases:htg_use_saml_and_token_exchange_to_federate_into_aws_get_security_token.adoc"] section_ids: component: Component before-you-begin: Before you begin create-new-sp-connection-in-pf: Creating a new SP connection in PingFederate about-this-task: About this task steps: Steps downloading-aws-jar-files: Downloading AWS .jar files steps-2: Steps modifying-pingfederate-system-properties: Modifying PingFederate system properties about-this-task-2: About this task steps-3: Steps creating-a-token-processor: Creating a token processor steps-4: Steps changing-the-aws-saml-connection-to-use-ws-trust-sts: Changing the AWS SAML connection to use WS-Trust STS about-this-task-3: About this task steps-5: Steps writing-a-script-to-get-the-security-token-from-aws: Writing a script to get the security token from AWS about-this-task-4: About this task steps-6: Steps --- # Using SAML and token exchange to federate into AWS through the AWS Command Line Interface This use case shows you how to use PingFederate to issue a token to Amazon Web Services (AWS) to authenticate an end-user for API access. You can automate getting the AWS Access Key ID and AWS Secret Access Key (which are your account credentials) by using PingFederate to authenticate against the user store (such as ActiveDirectory), get a SAML assertion to federate into AWS, and then exchange the SAML assertion for an access token to make CLI commands to AWS. ## Component PingFederate 9.2 ## Before you begin Make sure of the following: * PingFederate 9.2 is installed and running. * You have a functioning AWS SP SAML connection in PingFederate. To accomplish this, install the AWS Connector and the AWS CLI tool. For documentation on the AWS Command Line Interface (CLI), see the [Amazon CLI User Guide](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-welcome.html). | | | | - | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | The CLI tool is installed on your hard drive (usually in a hidden folder) and includes two files: `config` and `credentials`. The credentials file is where the ID and Key are stored and look similar to this:``` aws_access_key_id = ARIAIY4DSCACQLFZSULQ aws_secret_access_key = /zf8dHb2FDJQ0IPxQZeoOLftZ5gif0ve6f8gibtu ``` | ## Creating a new SP connection in PingFederate ### About this task There are three main contract attributes you need to define in the SP configuration: * SAML\_SUBJECT * https\://aws.amazon.com/SAML/Attributes/Role * https\://aws.amazon.com/SAML/Attributes/RoleSessionName The AWS metadata URL () includes these attributes and will simplify making the SP connection in PingFederate. ### Steps 1. Log in to the PingFederate Administration console. 2. In the **SP Connections** section of the **Identity Provider** tab, click **Create New**. 3. Select **Browser SSO Profiles**. Click **Next**. 4. On the **Connection Options** tab, select the **Browser SSO** checkbox and click **Next**. 5. On the **Import Metadata** tab, select `URL`, **Manage Partner Metadata URLs**, then **Add New URL**. 6. Add the AWS metadata URL (https\://signin.aws.amazon.com/static/saml-metadata.xml), then click **Next**. Click **Save**. 7. Select the AWS metadata URL from the **Metadata URL** list on the **Import Metadata** tab and then click **Load Metadata**. Click **Next**. 8. On the **General Info** tab, name your connection in the **Connection Name** field. Click **Next**. 9. On the **Browser SSO** tab, click **Configure Browser SSO**. Select the **IDP-Initiated SSO** and **SP-Initiated SSO** checkboxes and click **Next** until you reach the **Assertion Creation** tab. Click **Configure Assertion Creation**. 10. On the **Attribute Contract** tab, select `urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified` from the **Subject Name Format** list for `SAML_SUBJECT` . Click **Next**. | | | | - | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | There are several extra attributes included in the AWS metadata URL (such as `urn:oid:1.3.6.1.4.1.5923.1.1.1.1`). These attributes are not required and can be deleted on the **Attribute Contract** tab. | 11. On the **Authentication Source Mapping** tab, click **Map New Adapter Instance**. 12. Select your adapter instance and click **Next** until you reach the **Attribute Contract Fulfillment** tab. 13. On the **Attribute Contract Fulfillment** tab, select `Text` from the **SAML\_SUBJECT** **Source** list and in the **SAML\_SUBJECT** **Value** field, enter `null`. 14. Select `Text` from the **https\://aws.amazon.com/SAML/Attributes/Role** **Source** field and in the **https\://aws.amazon.com/SAML/Attributes/Role** `Value` field, enter the value using the following example: ``` arn:aws:iam:::role/,arn:aws:iam:::saml-provider/ ``` 15. Select `Adapter` from the **https\://aws.amazon.com/SAML/Attributes/RoleSessionName** **Source** list and select `username` from the **Value** list. Click **Next** and **Done** until you complete the IdP Adapter Mapping. 16. Click **Next**. Click **Done** to complete the Assertion Creation configuration. 17. On the **Protocol Settings** tab, click **Configure Protocol Settings**. 18. On the **Allowable SAML Bindings** tab, clear the `Artifact` and `Soap` checkboxes and then click **Next** and **Done** until you complete the Protocol Settings configuration. 19. Click **Next** then **Done** to complete the Browser SSO configuration. 20. On the **Credentials** tab, click **Configure Credentials** and then select a signing certificate from the **Signing Certificate** list. Click **Done**. 21. Click **Save** on the **Activation and Summary** tab to complete the SP connection configuration. ## Downloading AWS .jar files ### Steps * Now that you have a functioning SAML connection between your PingFederate and AWS instances, download and install the following: * `aws-java-sdk-1.11.604.jar` from `aws-java-sdk-1.11.604`. This is available from [AWS Downloads](https://sdk-for-java.amazonwebservices.com/latest/aws-java-sdk.zip). * All `.jar` files from `lib` of `PingFederate_WS-Trust_STS_Client_SDK-1.1.1`. This is available from PingIdentity. ## Modifying PingFederate system properties ### About this task Set the `pf.idp.wstrust.samlp.resp` system property to `true`. ### Steps 1. Do one of the following depending on how you are running PingFederate: * If your PingFederate is running as a Windows service, this is done in `\pingfederate\sbin\wrapper\PingFederateService.conf` 1. Find the `# Java Additional Parameters` section. 2. Attribute the next number in the list to a `wrapper.java.additional` parameter. For example: `wrapper.java.additional.15=-Dpf.idp.wstrust.samlp.resp=true` * If you are not running PingFederate as a Windows service, you will need to append the appropriate run file in the bin folder (`run.bat` or `run.sh`). For example, in `run.sh` add `JAVA_OPTS="$JAVA_OPTS -Dcom.ncipher.provider.announcemode=on -Dpf.idp.wstrust.samlp.resp=true"` 2. Restart PingFederate. Learn more in [Start and stop PingFederate](https://cdn-docs.pingidentity.com/archive/pdf/pingfederate/pingfederate-92.pdf#page=22) (page 22). ## Creating a token processor ### Steps 1. In the PingFederate Administrative console, click the **System** tab and then click **Protocol Settings.** Click the **Roles & Protocols** tab. 2. Select the **WS-Trust** checkbox for IDP roles. Click **Save**. 3. On the **Identity Provider** tab, click **Token Processors** and then click **Create New Instance**. 4. Enter the appropriate values in the **Instance Name** and **Instance ID** fields. From the **Type** menu, select **Username Token Processor**. Click **Next**. 5. From the `Password Credential Validator Instance` menu, select your password credential validator instance. Click **Next**. 6. Click **Next** and **Done** until you complete the Token Processor Instance configuration. | | | | - | ---------------------------------------------------------- | | | Only the `username` attribute is required in the Contract. | ## Changing the AWS SAML connection to use WS-Trust STS ### About this task Change the AWS SP SAML connection to use the STS processor and map the attributes. ### Steps 1. On the **Identity Provider** tab, from the **SP connections** list, select your AWS connection. 2. Click **Connection Type** and select the **WS-Trust STS** checkbox. Click **Next**. 3. On the **WS-Trust STS** tab, click **Configure WS-Trust STS** and enter `https://signin.aws.amazon.com/saml` in the **Partner Service Identifier** field. Click **Add** and then click **Next**. 4. On the **Token Creation** screen, click **Configure Token Creation**. 5. Enter `https://aws.amazon.com/SAML/Attributes/Role` in the **Extend the Contract** field. Click **Add**. 6. Enter `https://aws.amazon.com/SAML/Attributes/RoleSessionName` in the **Extend the Contract** field and click **Add**. Click **Next**. 7. On the **IdP Token Processor Mapping** tab, click **Map New Token Processor Instance** and specify the token processor. Click **Next**. 8. Map the **Attribute Contract Fulfillment** section. See steps 13 - 15 in [Creating a new SP connection in PingFederate](#create-new-sp-connection-in-pf). 9. Click **Next** and **Save** on the **Summary** tab. ## Writing a script to get the security token from AWS ### About this task Write a script to automate the authentication and get the security token from AWS. ### Steps * The following template is an example script written in `.java`, exported as a runnable `.jar` file, and executed in a terminal window. | | | | - | ----------------------------------------------------- | | | You can write your automation script in any language. | ```java package com.pingidentity.sts; import com.amazonaws.auth.AnonymousAWSCredentials; import com.amazonaws.services.securitytoken.AWSSecurityTokenServiceClient; import com.amazonaws.services.securitytoken.model.AssumeRoleWithSAMLRequest; import com.amazonaws.services.securitytoken.model.AssumeRoleWithSAMLResult; import com.pingidentity.sts.clientapi.STSClient; import com.pingidentity.sts.clientapi.STSClientConfiguration; import com.pingidentity.sts.clientapi.model.RequestSecurityTokenData; import com.pingidentity.sts.clientapi.model.STSResponse; import com.pingidentity.sts.clientapi.tokens.wsse.UsernameToken; import java.util.Scanner; public class AssumeRoleWithSAMLSample { private static final String PING_STS = ""; https://:9031/idp/sts.wst private static final String PRINCIPAL_ARN = "arn:aws:iam::736827903656:saml-provider/PingFed"; private static final String ROLE_ARN = "arn:aws:iam::736827903656:role/Administrators"; public static void main(String[] args) throws Exception { AssumeRoleWithSAMLSample sample = new AssumeRoleWithSAMLSample(); sample.getTemporaryCredential(sample.getSAMLAssertion()); } protected String getTemporaryCredential (String assertion) { AWSSecurityTokenServiceClient client = new AWSSecurityTokenServiceClient(new AnonymousAWSCredentials()); AssumeRoleWithSAMLRequest assumeRoleRequest = new AssumeRoleWithSAMLRequest(); assumeRoleRequest.setPrincipalArn(PRINCIPAL_ARN); assumeRoleRequest.setRoleArn(ROLE_ARN); assumeRoleRequest.setSAMLAssertion(assertion); AssumeRoleWithSAMLResult result = client.assumeRoleWithSAML(assumeRoleRequest); System.out.println(result.toString()); return result.toString(); } protected String getSAMLAssertion () throws Exception { Scanner user_input = new Scanner( System.in ); String username; String password; System.out.print("Enter your AD UserID: "); username = user_input.next(); System.out.print("Enter your AD Password: "); password = user_input.next(); System.out.println("Getting assertion from PingFederate . . ."); STSClientConfiguration stsClientConfiguration = new STSClientConfiguration(); stsClientConfiguration.setStsEndpoint(PING_STS); stsClientConfiguration.setIgnoreSSLTrustErrors(true); STSClient client = new STSClient(stsClientConfiguration); RequestSecurityTokenData requestData = new RequestSecurityTokenData(); requestData.setRequestType(""); http://docs.oasis-open.org/ws-sx/ws-trust/200512/Issue requestData.setTokenType("urn:oasis:names:tc:SAML:2.0:profiles:SSO:browser"); requestData.setAppliesTo(""); https://signin.aws.amazon.com/saml org.w3c.dom.Element token = null; UsernameToken usernameToken = new UsernameToken(); usernameToken.setUsername(username); usernameToken.setPassword(password); token = usernameToken.getRoot(); STSResponse respData; respData = client.makeRequest(requestData, token, null, null); String result = respData.getRstr().getToken().getFirstChild().getTextContent(); System.out.println("Returninig " + result); return result; } } ```