AWS marketplace: Add SAML 2.0 and OIDC SSO setup for Storefront
Summary
Expands the AWS Marketplace Storefront SSO guide: renames the OIDC flow for Okta/Microsoft Entra ID, and adds a full SAML 2.0 procedure covering IdP app creation, signed assertions (RSA-SHA256/SHA256), attribute statements, certificate handling, saving the connection, copying exact ACS URL/Audience values, and testing sign-in with MFA.
Security assessment
The added content documents authentication configuration for storefront buyer sign-in, including requiring signed SAML assertions with RSA-SHA256/SHA256, using the complete active PEM signing certificate, copying exact ACS URL/Audience values rather than constructing them, and completing MFA during the sign-in test. This is security best-practice/feature documentation for SSO, but there is no evidence it addresses a specific vulnerability, incident, or CVE.
Evidence
**Response** / **Assertion Signature** | **Signed** / **Signed**
Diff
diff --git a/marketplace/latest/storefrontguide/sso-storefront.md b/marketplace/latest/storefrontguide/sso-storefront.md index 3924e1e..6dc5a41 100644 --- a//marketplace/latest/storefrontguide/sso-storefront.md +++ b//marketplace/latest/storefrontguide/sso-storefront.md @@ -7 +7 @@ -Related topics +Configuring OIDC sign-in with Okta or Microsoft Entra IDConfiguring SAML 2.0 sign-inRelated topics @@ -11 +11 @@ Related topics -You can enable single sign-on (SSO) so buyers sign in to a storefront with your identity provider. AWS Marketplace Storefront supports Okta and Azure Entra ID. +You can enable single sign-on (SSO) so that buyers sign in to a storefront with your identity provider. AWS Marketplace Storefront supports Okta and Microsoft Entra ID through OpenID Connect (OIDC). It also supports any SAML 2.0 identity provider, such as Okta. @@ -13 +13 @@ You can enable single sign-on (SSO) so buyers sign in to a storefront with your -###### To configure storefront SSO +For Amazon Business Buy button sign-in with SSO, use SAML 2.0 with the same identity provider that you use for Amazon Business. For more information, see [Amazon Business connector](./connector-amazon-business.html). @@ -15 +15,5 @@ You can enable single sign-on (SSO) so buyers sign in to a storefront with your - 1. Open the storefront, then choose the **SSO Configuration** tab. +## Configuring OIDC sign-in with Okta or Microsoft Entra ID + +###### To configure storefront SSO with OIDC + + 1. Open the storefront, and then choose the **SSO Configuration** tab. @@ -19 +23 @@ You can enable single sign-on (SSO) so buyers sign in to a storefront with your - 3. For **Identity Provider** , choose Okta or Azure Entra ID. + 3. For **Identity Provider** , choose **OKTA** or **Azure Entra ID**. @@ -23 +27 @@ You can enable single sign-on (SSO) so buyers sign in to a storefront with your - 5. For Okta, enter the **Domain**. For Azure Entra ID, enter the **Tenant ID**. + 5. For Okta, enter the **Domain**. For Microsoft Entra ID, enter the **Tenant ID**. @@ -27 +31,61 @@ You can enable single sign-on (SSO) so buyers sign in to a storefront with your - 7. Choose **Test Connection** to verify the configuration. + 7. To verify the configuration, choose **Test Connection**. + + + + +## Configuring SAML 2.0 sign-in + +Use the following procedures to set up storefront buyer sign-in with a SAML 2.0 application in your identity provider (IdP). You can use any IdP that supports SAML 2.0 applications. These procedures use Okta as the example. In another IdP, menu and setting names differ, so use the equivalent settings. + +If your storefront already has working SAML sign-in through the intended IdP, confirm the user assignments and run the sign-in test at the end. + +###### SAML 2.0 availability + +If **SAML 2.0** or **IdP Configuration Values** isn't available on the **SSO Configuration** tab, contact [[email protected]](mailto:[email protected]). + +### Creating the storefront application in your IdP + +###### To create the storefront SAML application + + 1. Sign in to the Okta Admin Console. Open **Applications and Resources** > **Applications**. (Some Okta versions name the parent menu **Applications**.) + + 2. Choose **Create App Integration**. In the **Create app integration** dialog box, under **Sign-in method** , select **SAML 2.0** , and then choose **Next**. + + 3. On **General Settings** , enter `AWS Marketplace Storefront` as the **App name** , and then choose **Next** to continue to **Configure SAML**. + + 4. Enter the following initial settings. To display the signing controls, choose **Show Advanced Settings**. + +Setting | Value +---|--- +**Single sign-on URL** | Temporarily use `https://example.invalid/pending-storefront-acs`. +**Use this for Recipient URL and Destination URL** | Selected +**Audience URI (SP Entity ID)** | Temporarily use `https://example.invalid/pending-storefront-audience`. +**Default RelayState** | Leave empty. +**Name ID format** | **Unspecified** +**Application username** | **Email** +**Update application username on** | **Create and update** +**Response** / **Assertion Signature** | **Signed** / **Signed** +**Signature Algorithm** / **Digest Algorithm** | **RSA-SHA256** / **SHA256** +**Assertion Encryption** | Keep the default, **Unencrypted**. + +###### Temporary values + +AWS Marketplace Storefront creates your sign-in connection after you save your IdP's sign-in URL and signing certificate. You then copy the generated **ACS URL** and **Audience** back into your IdP. The temporary values only let you create the app. Replace both before you test sign-in. + + 5. Choose **Next** , continue past the optional **Feedback** page, and choose **Finish**. + + + + +###### To add attributes, assign users, and get the sign-in details + + 1. On the app's **Sign On** tab, open **Show legacy configuration**. Next to **Profile attribute statements** , choose **Edit**. Add the following rows (choose **Add Another** for the second row), and then choose **Save**. + +Name | Name format | Value +---|---|--- +`email` | **Unspecified** | `user.email` +`name` | **Unspecified** | `user.displayName` + +Storefront sign-in requires both email and name. Populate each user's email and display name in your IdP. In Okta, use the legacy attribute grid instead of **Add expression**. + + 2. On the **Assignments** tab, choose **Assign** , and then choose **Assign to People** or **Assign to Groups**. Assign your test user and buyer groups, and verify that each application username is the user's email. For a person, choose **Save and Go Back** , and then choose **Done**. @@ -28,0 +93 @@ You can enable single sign-on (SSO) so buyers sign in to a storefront with your + 3. On the **Sign On** tab, copy the app's **Sign-On URL** and download its active **SHA-2** signing certificate. Use the complete PEM certificate, including its `BEGIN` and `END` lines. @@ -31,0 +97,54 @@ You can enable single sign-on (SSO) so buyers sign in to a storefront with your + +### Saving the connection in AWS Marketplace Storefront + +###### To save the SAML connection + + 1. Open the storefront, and then choose the **SSO Configuration** tab. + + 2. Turn on **Enable SSO**. For **Identity Provider** , choose **SAML 2.0** , and then enter the following values: + +Setting | Value +---|--- +**IdP sign-in URL** | The sign-in URL of the _AWS Marketplace Storefront_ application in your IdP. In Okta, this is the **Sign-On URL**. Required. +**IdP signing certificate (PEM)** | That application's complete active signing certificate. Paste it, or choose **Upload PEM file**. Required. + + 3. Choose **Save**. Saving provisions the storefront sign-in connection. The message _SSO configuration updated_ appears, and the new connection shows **Pending validation**. + + 4. Under **IdP Configuration Values** , copy the **ACS URL** and **Audience**. + + + + +###### Copy the exact values + +Copy the entire **ACS URL** , including its `connection` query parameter, and the entire **Audience**. Don't construct these values yourself. + +### Finishing the IdP application and testing sign-in + +###### To finish and test SAML sign-in + + 1. Return to the _AWS Marketplace Storefront_ application in your IdP. In Okta, on the **General** tab, next to **SAML Settings** , choose **Edit**. Keep the app name, and choose **Next** to continue to **Configure SAML**. + + 2. Replace the temporary values: + +Setting | Value +---|--- +**Single sign-on URL** | The exact **ACS URL** from AWS Marketplace Storefront. It has the form `https://auth-domain/login/callback?connection=connection-name`. +**Recipient URL** / **Destination URL** | Keep **Use this for Recipient URL and Destination URL** selected. +**Audience URI (SP Entity ID)** | The exact **Audience** from AWS Marketplace Storefront. It has the form `urn:auth0:tenant:connection-name`. + +Choose **Next** , and then choose **Finish**. + + 3. Verify the saved `email` and `name` attribute statements and the test user's assignment. + + 4. In AWS Marketplace Storefront, choose **Test Connection**. Allow the pop-up, sign in as a user who is assigned in your IdP, and complete your multi-factor authentication (MFA) requirements. + + 5. Return to **SSO Configuration**. Confirm that the status is **Connected** and that the **Last connection check** value updates. If needed, reopen the tab to refresh the status. + + 6. Open the hosted storefront as the assigned buyer and verify that sign-in reaches the correct storefront with the expected access. + + + + +A saved connection alone isn't a successful sign-in test. Both the connection test and the buyer's hosted storefront sign-in must succeed. + @@ -37,0 +157,2 @@ You can enable single sign-on (SSO) so buyers sign in to a storefront with your + * [Amazon Business connector](./connector-amazon-business.html) +