AWS singlesignon medium security documentation change
Summary
Added requirement for SAML assertion's NameID to exactly match IAM Identity Center usernames.
Security assessment
Documents authentication failure conditions that could prevent account takeover if mismatched. Explicitly states sign-in failures when NameID doesn't match provisioned usernames, addressing potential authentication bypass risks.
Diff
diff --git a/singlesignon/latest/userguide/other-idps.md b/singlesignon/latest/userguide/other-idps.md index 4ea98eedf..86105b6c6 100644 --- a//singlesignon/latest/userguide/other-idps.md +++ b//singlesignon/latest/userguide/other-idps.md @@ -25,0 +26,2 @@ Any identity provider (IdP) that implements these standard protocols is expected + * The SAML assertion's `Subject` `NameID` value must exactly match the **Username** of a user provisioned in IAM Identity Center. Sign-in fails if IAM Identity Center cannot match the `NameID` to a **Username** , even when the external IdP authenticates the user successfully. +