Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

AWS IAM Identity Center Instance & External Identity Provider (Entra ID) - Can You Get a True SSO Login Flow?

0

I am trying to understand if it is possible to get a true single sign-on user experience when using an IAM identity center instance (service provider) with Microsoft Entra ID as the external identity provider. Information online pointed me towards the concept of certificate-based authentication for AWS workspaces via an AWS Private CA, acting like a temporary virtual smartcard.

From that point, I ended up reading that only certain types of AWS Directories work with CBA though, like AD Connector, not an Entra ID workspaces directory. My IAM instance and Entra ID app are already set up, it's is using SAML 2.0, metadata has been shared between the two, Entity ID, Reply URL and Sign-on URL are set, Attributes and Claims are set up, SCIM provisioning is working, etc. I was just expecting a seamless workspaces login experience after following the Amazon documents to get Entra ID and an IAM Identity Center instance talking together.

  • Florian Turnwald EXPERT
    21 days ago

    If my answer was helpful, I would appreciate it if you could mark it as the accepted answer.

Topics
End User ComputingSecurity, Identity, & Compliance
Tags
AWS IAM Identity CenterAmazon WorkSpacesAWS Directory Service
Language
English

asked 22 days ago50 views

1 Answer
1

To answer your question directly: True SSO (seamless pass-through without a second login prompt) is currently only possible if you use an Active Directory-joined WorkSpace combined with Certificate-Based Authentication (CBA). If you are using native Entra ID-joined WorkSpaces, true SSO is technically not supported.

Here is the exact technical breakdown of why you are not getting a seamless login experience despite your SAML/SCIM setup:

1. The Authentication Boundary (Client vs. OS) Your current setup (IAM Identity Center + Entra ID via SAML 2.0 and SCIM) successfully federates authentication for the WorkSpaces Client. However, once the client connects to the virtual machine, the Windows Operating System requires a second, OS-level authentication to unlock the desktop session. SAML claims cannot natively unlock a Windows desktop.

2. Why CBA works for Active Directory To bridge this gap for Active Directory environments (AD Connector or AWS Managed AD), AWS uses CBA via AWS Private CA. The CA issues a short-lived virtual smartcard certificate during the SAML login flow. Windows accepts this smartcard to unlock the OS seamlessly without prompting the user for a password.

3. The Limitation of Entra ID-Joined WorkSpaces As you correctly discovered in the documentation, CBA is not supported for native Entra ID-joined WorkSpaces. Because this virtual smartcard translation does not exist for Entra ID-joined directories, there is no mechanism to pass the authentication through to the OS.

Consequently, users will always face a "double prompt":

  • Prompt 1: WorkSpaces Client login (redirects to Entra ID via SAML).
  • Prompt 2: Windows Lock Screen (requires Entra ID password, Windows Hello for Business, or FIDO2 security key).

Conclusion: Your IAM Identity Center and Entra ID integration is configured perfectly according to the documentation. However, the seamless "true SSO" experience you are expecting is simply not a supported feature for Entra ID-joined WorkSpaces at this time. To get true SSO, you would have to rebuild the environment using AD Connector/Managed AD and deploy AWS Private CA for CBA.

Reference: AWS Documentation: Access Microsoft Entra ID-joined WorkSpaces Personal (See "Important" note regarding double authentication) -> https://docs.aws.amazon.com/workspaces/latest/adminguide/access-entra-id.html

see also:

EXPERT

answered 22 days ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Relevant content