AWS marketplace: Generalize Marketplace procurement SSO docs from idc_url to start_url
Summary
Rewrites the AWS Marketplace procurement system SSO guide to replace the IAM Identity Center-specific `idc_url` parameter with a generic `start_url` parameter, broadens supported identity providers (IAM Identity Center, Okta, Entra ID, SAML/OIDC), removes the relay-state step, and adds Okta and SAP Ariba configuration examples.
Security assessment
The change documents SSO/federated authentication configuration for procurement punchout and explicitly warns that AWS Marketplace does not validate the domain in the URL parameter, placing responsibility on the administrator. This is security-relevant authentication guidance but does not reference a specific vulnerability, incident, or CVE, so it is documentation rather than a fix.
Evidence
+No domain validation | AWS Marketplace does not validate the domain in the URL parameter. The procurement administrator is responsible for providing the correct SSO login portal URL.
Diff
diff --git a/marketplace/latest/buyerguide/procurement-system-sso.md b/marketplace/latest/buyerguide/procurement-system-sso.md index 23d813560..7e512260c 100644 --- a//marketplace/latest/buyerguide/procurement-system-sso.md +++ b//marketplace/latest/buyerguide/procurement-system-sso.md @@ -7 +7 @@ -PrerequisitesHow SSO for procurement system integration worksStep 1: Find your IAM Identity Center access portal URLStep 2: Add the idc_url parameter to your punchout supplier URLStep 3: (Optional) Configure relay state for direct console accessRequirements and limitationsTroubleshooting +PrerequisitesHow SSO for procurement system integration worksStep 1: Find your SSO login portal URLStep 2: Add the SSO URL to your punchout configurationRequirements and limitationsTroubleshooting @@ -11 +11 @@ PrerequisitesHow SSO for procurement system integration worksStep 1: Find your I -You can enable single sign-on (SSO) for your AWS Marketplace procurement system integration by passing your IAM Identity Center access portal URL as a query parameter in the punchout configuration. When enabled, users who access AWS Marketplace through your procurement system are automatically redirected to your organization's SSO login page instead of the standard AWS sign-in page. +You can enable single sign-on (SSO) for your AWS Marketplace procurement system integration so that users are automatically signed in using your organization's existing identity provider, without needing a separate AWS login. When enabled, users who access AWS Marketplace through your procurement system are redirected to your organization's SSO login page instead of the standard AWS sign-in page. You enable SSO by passing your organization's SSO login portal URL as a query parameter in the punchout configuration. @@ -15 +15 @@ You can enable single sign-on (SSO) for your AWS Marketplace procurement system -This SSO configuration is compatible with any identity provider supported by IAM Identity Center, including Okta, Microsoft Entra ID, and the built-in IAM Identity Center directory. +This feature works with any identity provider that federates users into AWS, including IAM Identity Center, Okta, and Microsoft Entra ID. @@ -23,3 +23 @@ Before you enable SSO for procurement system integration, you must have the foll - * An IAM Identity Center instance with an access portal URL. For setup instructions, see [Enabling IAM Identity Center](https://docs.aws.amazon.com/singlesignon/latest/userguide/get-set-up-for-idc.html) in the _IAM Identity Center User Guide_. - - * Users who will access AWS Marketplace must be provisioned in IAM Identity Center with appropriate permission sets. For more information, see [Permission sets](https://docs.aws.amazon.com/singlesignon/latest/userguide/permissionsetsconcept.html) in the _IAM Identity Center User Guide_. Contact your IAM or identity team if you have questions about user provisioning. + * An SSO login portal URL from your identity provider that authenticates users and lands them in an AWS session. For example, an IAM Identity Center access portal URL, an Okta SAML app URL, or any OIDC-compliant login URL configured to federate into AWS. @@ -36 +34 @@ When you configure SSO for procurement system integration, the authentication fl - 1. A user in your procurement system initiates a punchout session. The procurement system sends the `idc_url` parameter along with the cXML PunchOutSetupRequest. + 1. A user in your procurement system initiates a punchout session. The procurement system sends the `start_url` parameter along with the PunchoutURL. @@ -38 +36 @@ When you configure SSO for procurement system integration, the authentication fl - 2. AWS Marketplace reads the `idc_url` parameter and redirects the user to your IAM Identity Center access portal URL instead of the standard AWS sign-in page. + 2. AWS Marketplace reads the `start_url` parameter and redirects the user to your organization's SSO login portal instead of the standard AWS sign-in page. @@ -42 +40 @@ When you configure SSO for procurement system integration, the authentication fl - 4. After authentication, IAM Identity Center issues a session token and the user is redirected back to the AWS Marketplace punchout session to browse and request products. + 4. After authentication, your identity provider issues a session and the user is redirected back to the AWS Marketplace punchout session to browse and request products. @@ -47 +45 @@ When you configure SSO for procurement system integration, the authentication fl -## Step 1: Find your IAM Identity Center access portal URL +## Step 1: Find your SSO login portal URL @@ -49 +47 @@ When you configure SSO for procurement system integration, the authentication fl -Use the following procedure to locate your IAM Identity Center access portal URL. +Obtain the SSO login portal URL from your identity provider. Consult your identity provider's documentation to find the direct login URL that initiates the SSO authentication flow and lands users in an AWS session after successful authentication. @@ -51 +49 @@ Use the following procedure to locate your IAM Identity Center access portal URL -###### To find your IAM Identity Center access portal URL +###### Example: IAM Identity Center @@ -57,4 +55 @@ Use the following procedure to locate your IAM Identity Center access portal URL - 3. On the **Identity source** tab, locate the **AWS access portal URL**. - - 4. Copy this URL. - + 3. On the **Identity source** tab, locate the **AWS access portal URL**. Your URL looks similar to `https://d-1234567890.awsapps.com/start`. @@ -64 +58,0 @@ Use the following procedure to locate your IAM Identity Center access portal URL -Your access portal URL looks similar to the following example: @@ -66 +60 @@ Your access portal URL looks similar to the following example: -`https://d-1234567890.awsapps.com/start` +###### Example: Okta @@ -68 +62 @@ Your access portal URL looks similar to the following example: -For more information, see [Customizing the AWS access portal URL](https://docs.aws.amazon.com/singlesignon/latest/userguide/howtochangeURL.html) in the _IAM Identity Center User Guide_. + 1. In the Okta Admin Console, choose **Applications** , **Applications**. @@ -70 +64 @@ For more information, see [Customizing the AWS access portal URL](https://docs.a -## Step 2: Add the idc_url parameter to your punchout supplier URL + 2. Select the application that federates your users into AWS. @@ -72,3 +66 @@ For more information, see [Customizing the AWS access portal URL](https://docs.a -In your procurement system (Coupa or SAP Ariba), append the `idc_url` query parameter to the AWS Marketplace punchout supplier URL. The `idc_url` value is your IAM Identity Center instance access portal URL. - -**Example:** + 3. On the **General** tab, copy the **Embed Link URL** , which is the application's SSO login URL. @@ -77 +68,0 @@ In your procurement system (Coupa or SAP Ariba), append the `idc_url` query para - https://eprocurement.marketplace.us-east-1.amazonaws.com/v1/punchout/setup?idc_url=https://d-1234567890.awsapps.com/start @@ -79 +69,0 @@ In your procurement system (Coupa or SAP Ariba), append the `idc_url` query para -## Step 3: (Optional) Configure relay state for direct console access @@ -81 +71 @@ In your procurement system (Coupa or SAP Ariba), append the `idc_url` query para -If you want users to land on a specific AWS console page after SSO authentication, configure a relay state in your IAM Identity Center permission set. Without a relay state, users land on the AWS Management Console after authenticating. +## Step 2: Add the SSO URL to your punchout configuration @@ -83 +73 @@ If you want users to land on a specific AWS console page after SSO authenticatio -Configuring a relay state is optional, but strongly recommended. +How you configure the SSO URL depends on your procurement system. @@ -85 +75 @@ Configuring a relay state is optional, but strongly recommended. -###### To configure relay state +###### Coupa @@ -87 +77 @@ Configuring a relay state is optional, but strongly recommended. - 1. Open the IAM Identity Center console at [https://console.aws.amazon.com/singlesignon/](https://console.aws.amazon.com/singlesignon/). +In Coupa, navigate to **Setup** > **Punchout Sites** > select your punchout site, and update the **Punchout URL** field to append the `start_url` query parameter with your organization's SSO login portal URL. @@ -89,9 +79 @@ Configuring a relay state is optional, but strongly recommended. - 2. Under **Multi-account permissions** , choose **Permission sets**. - - 3. Choose the permission set your procurement users use. - - 4. Choose **Edit**. - - 5. Under **Relay state** , enter: `https://console.aws.amazon.com/marketplace` - - 6. Choose **Save changes**. +**Example:** @@ -99,0 +82 @@ Configuring a relay state is optional, but strongly recommended. + https://eprocurement.marketplace.us-east-1.amazonaws.com/v1/punchout/setup?start_url=https://d-1234567890.awsapps.com/start @@ -100,0 +84 @@ Configuring a relay state is optional, but strongly recommended. +###### SAP Ariba @@ -102 +86 @@ Configuring a relay state is optional, but strongly recommended. -For more information, see [Set relay state for quick access to the AWS Management Console](https://docs.aws.amazon.com/singlesignon/latest/userguide/howtopermrelaystate.html) in the _IAM Identity Center User Guide_. +For SAP Ariba, the punchout endpoint is managed on the AWS supplier account in the Ariba Network, so the `start_url` parameter cannot be self-configured. To enable SSO, contact AWS Support with your SSO login portal URL and request that the `start_url` parameter be added to your AWS Marketplace punchout configuration in the Ariba Network. @@ -108,3 +92,4 @@ SSO requirements and limitations Requirement | Details -Parameter is optional | If the `idc_url` parameter is omitted, users see the standard AWS sign-in page. -No domain validation | AWS Marketplace does not validate the domain in the `idc_url` parameter. The procurement administrator is responsible for providing the correct IAM Identity Center access portal URL. -Supported identity providers | Any identity provider supported by IAM Identity Center, including Okta, Microsoft Entra ID, and the built-in IAM Identity Center directory. +URL must federate into AWS | The SSO login URL must complete authentication and federate the user into an AWS session. URLs that authenticate users into non-AWS destinations are not supported. +Parameter is optional | If the `start_url` parameter is omitted, users see the standard AWS sign-in page. +No domain validation | AWS Marketplace does not validate the domain in the URL parameter. The procurement administrator is responsible for providing the correct SSO login portal URL. +Supported identity providers | Any identity provider that provides a direct login URL for SSO authentication to AWS, including IAM Identity Center, Okta, Microsoft Entra ID, and other SAML or OIDC-compliant providers. @@ -118,3 +103,3 @@ SSO troubleshooting Issue | Cause | Resolution -Users see the standard AWS sign-in page | The `idc_url` parameter is missing or was not saved correctly. | Verify the supplier URL contains `?idc_url=<your-url>` and confirm the change was saved. -SSO page loads but authentication fails | The IAM Identity Center URL is incorrect or the user is not provisioned. | Verify the access portal URL by opening it directly in a browser. Confirm the user is provisioned in IAM Identity Center. -Users prompted to sign in again during session | IAM Identity Center session duration is shorter than the punchout session. | Review session duration settings in IAM Identity Center under **Settings** , **Authentication**. +Users see the standard AWS sign-in page | The `start_url` parameter is missing or was not saved correctly. | Verify the supplier URL contains `?start_url=<your-url>` and confirm the change was saved. +SSO page loads but authentication fails | The SSO login portal URL is incorrect or the user is not provisioned in the identity provider. | Verify the SSO login portal URL by opening it directly in a browser. Confirm the user is provisioned in your identity provider with appropriate permissions. +Users prompted to sign in again during session | The identity provider session duration is shorter than the punchout session. | Review session duration settings in your identity provider. For IAM Identity Center, check under **Settings** , **Authentication**.