AWS singlesignon medium security documentation change
Summary
Added note requiring SAML Subject NameID to match SCIM username mapping to prevent sign-in failures
Security assessment
The change addresses authentication misconfiguration that could cause sign-in failures. Ensuring consistent username mapping prevents potential account lockouts or unauthorized access attempts when attributes mismatch, directly impacting authentication security.
Diff
diff --git a/singlesignon/latest/userguide/provision-automatically.md b/singlesignon/latest/userguide/provision-automatically.md index d5596f4ea..a2ec25337 100644 --- a//singlesignon/latest/userguide/provision-automatically.md +++ b//singlesignon/latest/userguide/provision-automatically.md @@ -47,0 +48,2 @@ Before you begin deploying SCIM, we recommend that you first review the followin + * For SCIM-provisioned users, make sure the attribute your IdP sends as the SAML `Subject` `NameID` is the same attribute you map to **Username** in your SCIM configuration. If they differ, sign-in fails. +