Item	Details
Prior Confirmation	Prior configuration in Amazon Connect is required. For the latest setup instructions, please check the manual provided by Amazon Connect.
Name ID	〇	Email address
		Custom attribute　Note: For instructions on how to configure a custom attribute, click here
SP-side Configuration	〇	Configured by the administrator
		Request configuration from the SP
Provisioning		API-based Provisioning supported (account management available in TrustLogin)
		SAML JIT Provisioning supported (account management available in TrustLogin; user deletion not supported)
	〇	None (accounts created in each system)
Access Method	×	SP-Initiated SSO
	〇	IdP-Initiated SSO
Verified Operation by Device	〇	PC - Browser
	ー	PC - Desktop App
	ー	iOS - Standard Browser (Safari)
	ー	iOS - TrustLogin Mobile App In-App Browser
	ー	iOS - Native App
	〇	Android - Standard Browser (Chrome)
	ー	Android - TrustLogin Mobile App In-App Browser
	ー	Android - Native App

 

Setup Flow

TrustLogin	AWS/Amazon Connect
1. TrustLogin Admin Page Settings 　Create custom SAML app, download metadata
	2. Create Amazon Connect Instance and Users
	3. Configure Identity Provider, Policy, and Role in AWS IAM    ① Configure Identity Provider 　② Configure Policy 　③ Configure Role
4. TrustLogin Admin Page Settings (continued) 　Configure SP information, configure SAML attributes
5. TrustLogin User Settings

TrustLogin Admin Page Settings

1. Log in to TrustLogin, open the "Admin Page > App" menu, and click the "Register SAML App" button in the upper right of the screen.
   
   
   
2. Register the "Application Name" and "Icon" (optional).
   
   
   
3. Download the metadata under "Identity Provider Information".
   

Now, switch to configuring the Amazon side. Please open the AWS Management Console in a separate window.

Create Amazon Connect Instance and Users

1. Open Amazon Connect from the AWS Management Console and create an instance that uses SAML 2.0-based authentication. Under Identity Management, select "SAML 2.0-based authentication" and specify the access URL (any name of your choosing).
   
   
   For detailed steps going forward, please refer to Create an Amazon Connect instance.
   
   
2. Open the account overview from the link of the created instance name, then copy and make a note of the "Instance ARN" value.
   
   
   
3. After the instance is created, open "Get started" in the message that is displayed.
   
   
   
4. Open "Users > User management" from the left menu.
   
   
   
5. Add users manually or by CSV import from "Add new users".
   Set the TrustLogin email address for "Login".
   Please configure the other settings according to your operational needs.
   

 

Configure Identity Provider, Policy, and Role in AWS IAM

① Configure Identity Provider

1. Open "Identity providers > Add provider" in the IAM console.
   
   
   
2. Configure each item as follows, then click "Add provider" to add it.
   

   Provider type	Select "SAML"
   Provider name	Any name of your choosing
   Metadata document	Upload the metadata downloaded from TrustLogin

   
   
   
   
3. Open the overview screen from the link of the created identity provider name, then make a note of the "ARN" value.
   

② Configure Policy

1. Open "Policies > Create policy" in the IAM console.
   
   
   
2. Open the JSON tab and copy and paste the following template content.
   Replace the <connect instance ARN> portion with the "Instance ARN" value obtained in step 2 of "Create Amazon Connect Instance and Users".
   Click "Next: Tags" to proceed.
   

   { "Version": "2012-10-17", "Statement": [ { "Sid": "Statement1", "Effect": "Allow", "Action": "connect:GetFederationToken", "Resource": [ "<connect instance ARN>/user/${aws:userid}" ] } ] }

   
   
   
   
3. Proceed directly to "Next: Review".
   
   
   
4. Set any name of your choosing for the policy "Name" and click "Create policy".
   
   
   

③ Configure Role

1. Open "Roles > Create role" in the IAM console.
   
   
   
2. Configure as follows and click "Next".
   

   Entity type	Select "SAML 2.0 federation"
   SAML 2.0-based provider	Select the identity provider you created and select "Allow programmatic and AWS Management Console access"

   
   
   
   
3. Check the policy you created and click "Next".
   
   
   
4. Set any name of your choosing for the "Role name" and click "Create role".
   
   
   
5. Open the overview screen from the link of the created role name in the role list, then make a note of the "ARN" value.
   

Return to configuring TrustLogin again.

TrustLogin Admin Page Settings (continued)

1.  Configure "Service Provider Settings" as follows.
   

   Redirect URL after successful SP authentication	https://<region id>.console.aws.amazon.com/connect/federate/<instance id> You can check the "region id" and "instance id" in the "Instance ARN" of Amazon Connect. Example: If the "Instance ARN" is arn:aws:connect:us-east-1:xxxxxxxxxxxx:instance/xxxxxxxxxxxxxxxxxxxxxxx In this case, the blue text is the "region id" and the red text is the "instance id". The value to set for the redirect URL after successful SP authentication is https://us-east-1.console.aws.amazon.com/connect/federate/xxxxxxxxxxxxxxxxxxxxxxx as shown above.
   Value for Name ID	Member > email
   Entity ID	urn:amazon:webservices
   Name ID Format	Select "persistent"
   ACS URL for the Service	https://signin.aws.amazon.com/saml

   
   
2. Click the "Specify Custom Attribute" button in "SAML Attribute Settings", then click the "Add SAML Attribute" button to add a row (attribute). Configure as follows.
   

   Service Provider Attribute			TrustLogin (IdP) Attribute
   Attribute Name (specified)	Attribute Type	Attribute Name		Attribute Value
   subject	Unspecified	subject	Member	Member - Email Address
   Value of ① below	Unspecified	Value of ① below	Fixed value	"Role ARN", "Identity Provider ARN" (Separate the role ARN and identity provider ARN with a comma (,))
   Value of ② below	Unspecified	Value of ② below	Member	Member - Email Address

   
   ①: https://aws.amazon.com/SAML/Attributes/Role
   ②: https://aws.amazon.com/SAML/Attributes/RoleSessionName
   
   
   
   
3. Click the "Register" button to save.

TrustLogin User Settings

① When a User Adds the App from My Page

1. Click the "Add App" button on "My Page".
2. On the "Register App" screen, select the custom SAML app you created, then click the "Next" button in the upper right of the screen.
3. If you want to change the "Display Name", enter it, then click the "Register" button.
4. Click the app from "My Page" or the "browser extension" and verify that login succeeds.

② When an Administrator Adds Members

1. Search for and click the custom SAML app you created in the "Admin Page > App" menu.
2. Click "Add Member", select the users to add from the member list, and click the "Register" button to add them.