Note: SAML authentication is available for AWS Client VPN's web browser version and desktop app.
Note: Prior configuration on the AWS side is required.
Note: For the latest configuration steps, please refer to the manual provided by AWS.

Configuration steps: 1. TrustLogin Admin Page Settings 2. AWS Settings ① Create an AWS IAM IdP in the AWS Console ② Create a VPC in the AWS Console ③ Create a subnet in the AWS Console ④ Create an ACM certificate in AWS ⑤ Create a Client VPN endpoint in AWS ⑥ Using the AWS VPN Client 3. TrustLogin User Settings

1. TrustLogin Admin Page Settings

1. Log in to TrustLogin, open the "Admin Page > Apps" menu, and click the "Register SAML App" button in the upper right of the screen.
   
   
   
   
2. Register an "Application Name" and an "Icon" (optional).
   
   
   
   
3. Download the metadata from "Download Metadata" under "Identity Provider Information".
   
   
   
   
4. Configure the "Service Provider Settings" as follows.
   
   

   Sign SAML Response	Check this box
   Value for Name ID	Member > email
   Entity ID	urn:amazon:webservices:clientvpn
   Name ID Format	emailAddress
   ACS URL to Service	① [HTTP-POST] http://127.0.0.1:35001 ② [HTTP-POST] https://self-service.clientvpn.amazonaws.com/api/auth/sso/saml Note: Set this if you are using the self-service portal Note: You can add a row using the "+" button on the right

   
   
   
   
5. In "SAML Attribute Settings", use "Specify Custom Attribute" → "Add SAML Attribute" button to add attributes, and configure them as follows.
   
   

   Service Provider Attributes				TrustLogin (IdP) Attributes
   Attribute Name	Attribute Type	Attribute Name			Attribute Value
   NameID	Email	NameID	↔︎	Member	Member - Email Address
   FirstName	Persisted	FirstName	↔︎	Member	Member - First Name
   LastName	Persisted	LastName	↔︎	Member	Member - Last Name
   memberOf	Persisted	memberOf	↔︎	Group	Select an existing group from the dropdown and add it with the "+" button

   
   
   
   
6. Click the "Register" button to save.
   
   

2. AWS Settings

① Create an AWS IAM IdP in the AWS Console

1. Open the AWS IAM settings screen and click "Identity providers > Add provider".
   
   

   
   
   
2. Select "SAML" for "Provider type", enter any name you like for the provider name, and upload the metadata downloaded from TrustLogin using the "Choose file" button for the metadata document. Add the configuration with "Add provider".
   
   

3. The created IdP configuration will be added to the provider list.

② Create a VPC in the AWS Console

Note: If the corresponding settings have already been completed on the AWS side, please skip this step.

1. Open the VPC screen and click "VPC > Create VPC".
   
   

2. Enter the information as needed, and click the "Create VPC" button to save the settings.
   

③ Create a subnet in the AWS Console

Note: If the corresponding settings have already been completed on the AWS side, please skip this step.

1. Click "Subnets > Create subnet".
   
   
2. Enter the information as needed, and click the "Create subnet" button to save the settings.
   
   

④ Create an ACM certificate in AWS

Note: If the corresponding settings have already been completed on the AWS side, please skip this step.

For how to issue the certificate, please refer to the official AWS documentation.
https://docs.aws.amazon.com/ja_jp/vpn/latest/clientvpn-admin/client-authentication.html

Set the issued certificate in AWS ACM.
https://aws.amazon.com/jp/premiumsupport/knowledge-center/import-ssl-certificate-to-iam/

⑤ Create a Client VPN endpoint in AWS

Note: If the corresponding settings have already been completed on the AWS side, please skip this step.

1. Click "Client VPN Endpoints > Create Client VPN Endpoint".
   
   
   
   
2. Configure each item, then click " Create Client VPN Endpoint".
   
   

   Client IPv4 CIDR	Configure as needed (An address range separate from the VPC's CIDR is required)
   Server certificate ARN	The server certificate created in ACM
   Authentication option	Select "Use user-based authentication" / "Federated authentication"
   SAML provider ARN	Select the AWS IdP created in step ①
   Self-service SAML provider ARN	Select the AWS IdP created in step ①
   CloudWatch Logs log group/log stream	Specify the log group/log stream created in advance
   VPC ID	Set the VPC you want to connect to (this can be left blank and associated later)
   Security group ID	The default security group

   
   
   
   
   

3. Select the created Client VPN endpoint, then click the "Associate" button on the Associations tab.
   
   
   
   

4. Select the VPC created in step ② and the subnet created in step ③ respectively, then click the "Associate" button.
   
   
   
   

5. On the Authorization tab, click the "Accept incoming" button.
   
   
   
   

6. Configure the destination network and the targets to grant access to as needed, then click the "Add Authorization Rule" button.
   
   
   
   

7. On the Route Table tab, click the "Create Route" button.
   
   
   
   

8. Set the route destination and target VPC subnet as needed, then click the "Create Route" button.
   
   
   
   

9. Select the created Client VPN endpoint and run "Download Client Configuration" to download a configuration file named "downloaded-client-config.ovpn".
   
   
   
   

⑥ Using the AWS VPN Client

1. Download the official AWS VPN client software from the official AWS download page, install it, and launch it. Set the downloaded configuration file (downloaded-client-config.ovpn) as a profile.
   

   
   
   
   

   Open "File > Manage Profiles".
   
   
   From "Add Profile", select and upload the downloaded configuration file.
   
   
   
   
   

2. After clicking the connect button, your browser will automatically open and navigate to the TrustLogin login screen.
   
   
   
   
   

3. Once you log in via TrustLogin, the Client VPN connection will begin to be established.
   
   
   
   
   

4. You can check the connection history on the Connections tab of the AWS Client VPN endpoint screen.
   
   
   
   

3. TrustLogin User Settings

① When users add it themselves via My Page

1. On "My Page", click the "Add App" button.
2. On the "Register App" screen, select the custom SAML app you created, and click the "Next" button in the upper right of the screen.
3. If you want to change the "Display Name", enter it, then click the "Register" button.
4. Click the app on "My Page" or in the browser extension and confirm that login succeeds.

② When an administrator adds members

1. In the "Admin Page > Apps" menu, search for and click the custom SAML app you created.
2. Click "Add Member", select the users to add from the member list, and click the "Register" button to add them.