This article describes how to integrate AWS IAM Identity Center with RSA Cloud Access Service (CAS) using My Page SSO.

Configure CAS

Perform these steps to configure CAS using My Page SSO.
Procedure

1. Sign in to the RSA Cloud Administration Console with administrator credentials.
2. On the Access > My Page, enable Applications. Ensure it is enabled and protected by two-factor authentication using a Password and an access policy.
   
3. On the Applications > Application Catalog page, click Create From Template.
   
4. On the Choose Connector Template page, click Select for SAML Direct.
   
5. On the Basic Information page, enter a name for the configuration in the Name field and click Next Step.
   
6. In the Connection Profile page, under Initiate SAML Workflow, choose IdP-initiated.
7. To provide Service Provider details, select Import Metadata, click Choose File, and select the file downloaded from the Service Provider.
   
8. In the SAML Response Protection section, choose IdP signs assertion within response, and download the certificate by clicking Download Certificate.
   
9. Scroll down to the User Identity section and select the following values:
   1. Identifier Type: Auto Detect
   2. Property: Auto Detect
      
      
10. Under the Statement Attributes section, add the following attributes.
    1. Attribute 1:
       1. Attribute Name: https://aws.amazon.com/SAML/Attributes/RoleSessionName
       2. Attribute Source: Identity Source
       3. Property: mail
    2. Attribute 2:
       1. Attribute Name: https://aws.amazon.com/SAML/Attributes/Role
       2. Attribute Source: Constant
       3. Property: AWS role ARN value, AWS IAM instance session ARN value
          

Note: See the Configure AWS IAM Identity Center section to obtain the AWS role ARN and the AWS IAM instance session ARN values.

11. Click Next Step.
12. On the User Access page, select the access policy that will be used to determine which users can access the application.
    
13. Click Next Step.
14. On the Portal Display page, configure the portal display and other settings.
15. Click Next Step.
     
16. On the Fulfillment page, configure your preferred settings or leave the Fulfillment toggle button disabled as it is, then click Save and Finish.
    
17. Click Publish Changes and wait for the operation to be completed.
    After publishing, your application is enabled for SSO. 
18. Navigate to the newly created application on the Applications page and from the Edit drop-down list, choose Export Metadata.
    This metadata will be used in the AWS IAM Identity Center configuration.

Configure AWS IAM Identity Center

Perform these steps to configure CAS using My Page SSO.
Procedure

1. Access the AWS Management Console by logging in to your AWS account with admin credentials.
2. Under Services, go to Security, Identity, & Compliance, and select IAM Identity Center.
   
3. In the right pane, click Go to settings.
   
4. On the Identity Source tab, select Change identity source in the Actions drop-down list.
   
5. Choose External identity provider, and then click Next.
   
6. Configure the external identity provider and click Next.
   1. Service provider metadata: Click Download metadata file to download the SP metadata.
   2. IdP SAML metadata: Click Choose file and upload the metadata downloaded from RSA.
      
      
7. Review the list of changes. Once you are ready to proceed, type ACCEPT and click Change identity source.
   
8. Go to Settings and copy the Instance ARN for the RSA configuration (Attribute mapping). 
   
9. To create groups, navigate to AWS IAM.
   
10. Click IAM User groups, and then click Create group. 
    
11. In the User group name field, enter the name of the group, and then click Create user group.
    
    
12. To create a user, navigate to Access management > User, and click Create user.
    
13. Under User details, enter the username in the User name text box, and then click Next.
    
14. To create roles, navigate to Access Management > Roles, and then click Create role.
    
15. Choose SAML 2.0 federation as the Trusted entity type and enter a name for the SAML 2.0 trusted provider in the SAML 2.0-based provider field.
    
16. Copy the ARN. This is the same value as the AWS Role ARN value used in the RSA configuration (Attribute mapping).
17. Combine the Role ARN and the Provider ARN values, separated by a comma, to use as the Property value in RSA.
    

The configuration is complete.