SAP-C02 · Question #142
A solutions architect has implemented a SAML 2.0 federated identity solution with their company's on-premises identity provider (IdP) to authenticate users' access to the AWS environment. When the…
The correct answer is B. The IAM roles created for the federated users' or federated groups' trust policy have set the D. The web portal calls the AWS STS AssumeRoleWithSAML API with the ARN of the SAML F. The company's IdP defines SAML assertions that property map users or groups m the company. When federated users fail to access AWS, the solutions architect should verify that IAM roles' trust policies correctly allow the IdP to assume them, that the web portal correctly calls the STS AssumeRoleWithSAML API, and that the IdP's SAML assertions properly map users to…
Question
A solutions architect has implemented a SAML 2.0 federated identity solution with their company's on-premises identity provider (IdP) to authenticate users' access to the AWS environment. When the solutions architect tests authentication through the federated identity web portal access to the AWS environment is granted. However, when test users attempt to authenticate through the federated identity web portal, they are not able to access the AWS environment. Which items should the solutions architect check to ensure identity federation is property configured? (Choose three.)
Options
- AThe IAM user's permissions pokey has allowed the use of SAML federation for that user
- BThe IAM roles created for the federated users' or federated groups' trust policy have set the
- CTest users are not in the AWSFederatedUsers group in the company's IdP
- DThe web portal calls the AWS STS AssumeRoleWithSAML API with the ARN of the SAML
- EThe on-premises IdP's DNS hostname is reachable from the AWS environment VPCs.
- FThe company's IdP defines SAML assertions that property map users or groups m the company
How the community answered
(20 responses)- A25% (5)
- B60% (12)
- C5% (1)
- E10% (2)
Why each option
When federated users fail to access AWS, the solutions architect should verify that IAM roles' trust policies correctly allow the IdP to assume them, that the web portal correctly calls the STS AssumeRoleWithSAML API, and that the IdP's SAML assertions properly map users to these roles.
SAML federation uses IAM roles for federated identities, not IAM users, so an IAM user's permissions policy is not relevant to this issue.
The IAM roles' trust policies must be correctly configured to specify the SAML provider and the conditions (e.g., SAML attributes) under which federated users or groups can assume the role; incorrect policies would prevent access.
The group name 'AWSFederatedUsers' is not a mandatory or standard group required by AWS for federation; the issue lies with how *any* groups or users are mapped to SAML attributes and subsequently to AWS IAM roles.
The web portal acting as the relying party must make a successful AWS STS AssumeRoleWithSAML API call, exchanging the SAML assertion for temporary AWS credentials; if this call is incorrect or missing, access will be denied.
The problem states the solutions architect *can* access, implying basic connectivity and DNS resolution for the IdP are functional for the federation flow from the user's browser, making this an unlikely cause for only test users failing.
The on-premises IdP must define SAML assertions that include the necessary attributes (e.g., group membership, user identity) that are then used by the IAM role's trust policy conditions to grant access; incorrect or missing mappings will prevent users from assuming the correct roles.
Concept tested: AWS IAM SAML federation configuration
Source: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_saml.html
Community Discussion
No community discussion yet for this question.