AWS workspaces medium security documentation change
Summary
Changed the requirement for 'ObjectSid' attribute in SAML assertion from mandatory to optional and removed related note about Microsoft KB5014754
Security assessment
The change directly affects authentication security by modifying the requirements for certificate-based authentication, specifically making the 'ObjectSid' attribute optional instead of mandatory, which could impact security mapping to Active Directory users.
Diff
diff --git a/workspaces/latest/adminguide/certificate-based-authentication.md index 9d57f1a3a..b9fb88c88 100644 --- a/workspaces/latest/adminguide/certificate-based-authentication.md +++ b/workspaces/latest/adminguide/certificate-based-authentication.md @@ -43,5 +43 @@ Complete the following steps before enabling certificate-based authentication. - 3. Configure the `ObjectSid` attribute in your SAML assertion. This is required to perform strong mapping to the Active Directory user. Certificate-based authentication will fail if the attribute does not match the Active Directory security identifier (SID) for user specified in the SAML_Subject `NameID`. For more information, see [Create Assertions for the SAML Authentication Response](https://docs.aws.amazon.com/workspaces/latest/adminguide/setting-up-saml.html#create-assertions-saml-auth). - -###### Note - -According to [Microsoft KB5014754](https://support.microsoft.com/en-us/topic/kb5014754-certificate-based-authentication-changes-on-windows-domain-controllers-ad2c23b0-15d8-4340-a468-4d4f3b188f16), the `ObjectSid` attribute will become mandatory for certificate-based authentication after September 10, 2025 + 3. Configure the `ObjectSid` attribute in your SAML assertion. This is optional to perform strong mapping to the Active Directory user. Certificate-based authentication will fail if the attribute does not match the Active Directory security identifier (SID) for user specified in the SAML_Subject `NameID`. For more information, see [Create Assertions for the SAML Authentication Response](https://docs.aws.amazon.com/workspaces/latest/adminguide/setting-up-saml.html#create-assertions-saml-auth).