AWS singlesignon documentation change
Summary
Added troubleshooting section for 'Group members from trusted domains do not sync to IAM Identity Center'
Security assessment
The change documents a synchronization issue with cross-domain groups in IAM Identity Center. While it involves security groups, it addresses a functional limitation rather than a security vulnerability. The troubleshooting steps focus on permission configuration and synchronization methods without indicating any security exploit or vulnerability being patched.
Diff
diff --git a/singlesignon/latest/userguide/troubleshooting.md b/singlesignon/latest/userguide/troubleshooting.md index dc645d2a5..f198a3b74 100644 --- a//singlesignon/latest/userguide/troubleshooting.md +++ b//singlesignon/latest/userguide/troubleshooting.md @@ -5 +5 @@ -Issues creating an account instance of IAM Identity CenterYou receive an error when you attempt to view the list of cloud applications that are preconfigured to work with IAM Identity CenterIssues regarding contents of SAML assertions created by IAM Identity CenterSpecific users fail to synchronize into IAM Identity Center from an external SCIM providerDuplicate user or group error when provisioning users or groups with an external identity providerUsers can’t sign in when their user name is in UPN formatI get a ‘Cannot perform the operation on the protected role' error when modifying an IAM roleDirectory users cannot reset their passwordMy user is referenced in a permission set but can’t access the assigned accounts or applicationsI cannot get my application from the application catalog configured correctlyError 'An unexpected error has occurred' when a user tries to sign in using an external identity providerError 'Attributes for access control failed to enable'I get a 'Browser not supported' message when I attempt to register a device for MFAActive Directory “Domain Users” group does not properly sync into IAM Identity CenterInvalid MFA credentials errorI get a 'An unexpected error has occurred' message when I attempt to register or sign in using an authenticator appI get an 'It's not you, it is us' error when attempting to sign in to IAM Identity CenterMy users are not receiving emails from IAM Identity CenterError: You cannot delete/modify/remove/assign access to permission sets provisioned in the management accountError: Session token not found or invalid +Issues creating an account instance of IAM Identity CenterYou receive an error when you attempt to view the list of cloud applications that are preconfigured to work with IAM Identity CenterIssues regarding contents of SAML assertions created by IAM Identity CenterSpecific users fail to synchronize into IAM Identity Center from an external SCIM providerDuplicate user or group error when provisioning users or groups with an external identity providerUsers can’t sign in when their user name is in UPN formatI get a ‘Cannot perform the operation on the protected role' error when modifying an IAM roleDirectory users cannot reset their passwordMy user is referenced in a permission set but can’t access the assigned accounts or applicationsI cannot get my application from the application catalog configured correctlyError 'An unexpected error has occurred' when a user tries to sign in using an external identity providerError 'Attributes for access control failed to enable'I get a 'Browser not supported' message when I attempt to register a device for MFAActive Directory “Domain Users” group does not properly sync into IAM Identity CenterInvalid MFA credentials errorI get a 'An unexpected error has occurred' message when I attempt to register or sign in using an authenticator appI get an 'It's not you, it is us' error when attempting to sign in to IAM Identity CenterMy users are not receiving emails from IAM Identity CenterError: You cannot delete/modify/remove/assign access to permission sets provisioned in the management accountError: Session token not found or invalidGroup members from trusted domains do not sync to IAM Identity Center @@ -288,0 +289,13 @@ This error can occur when a client, such as a web browser, AWS Toolkit, or AWS C +## Group members from trusted domains do not sync to IAM Identity Center + +If a security group syncs successfully to IAM Identity Center, but its members from a trusted on-premises domain do not appear in the IAM Identity Center, this can be caused by the group resides in AWS Managed Microsoft AD and contains Foreign Security Principal (FSPs) representing users from a trusted domain. + +Try the following steps to troubleshoot: + + * Sync groups directly from the trusted domain: Instead of syncing a group from AWS Managed Microsoft AD that contains cross-domain members, create and sync the group directly from the trusted on-premises domain. This approach works because IAM Identity Center can access actual user objects in the source domain. + + * Verify service account permissions: Ensure the IAM Identity Center service account has the required permissions on user objects in the trusted domain: ReadProperties and ListContents permission. + + + +