Integrating AWS IAM Identity Center (SSO) with Datazoom

This guide provides instructions for configuring single sign-on (SSO) for your Datazoom account using AWS IAM Identity Center (formerly AWS SSO) as your identity provider. The process involves creating a SAML 2.0 application in your AWS account and sharing the configuration details with Datazoom.

Prerequisites

Before you begin, please ensure you have the following:

Administrative access to your organization's AWS Management Console.
AWS IAM Identity Center enabled in your AWS account.
A User Pool ID and Cognito Domain URL provided by the Datazoom team. You will need these values to complete the steps below.

Access IAM Identity Center

In the AWS Management Console, navigate to IAM Identity Center.
Select Applications under Application assignments in the left menu.

Add a New Application

Click Add Application.
Choose I have an application I want to set up.
Select SAML 2.0 as the application type.
Click Next.

Configure Application

Display name: Enter a name for the application (e.g., Datazoom SSO).
Description: Provide a brief description of the application.
Download the IAM Identity Center SAML metadata file. Share this file with Datazoom for their Cognito configuration.
Under Application metadata, select Manually type your metadata values.
Fill in the following:
- Application ACS URL:
  - Format: {cognito domain}/saml2/idpresponse
  - Example: https://us-east-1dsfgdhfdfgh.auth.us-east-1.amazoncognito.com/saml2/idpresponse
- Application SAML audience:
  - Format: urn:amazon:cognito:sp:{user pool id}
  - Example: urn:amazon:cognito:sp:us-east-1_YTDVYoYcsd

Add Attribute Mappings

Configure the attribute mappings to map IAM Identity Center attributes to Cognito user attributes. Example:

User attribute in the application	AWS IAM Identity Center attribute
Subject	${user:subject}
email	${user:email}

Save and Assign Users

Save the application configuration.
Assign users or groups to the application in IAM Identity Center to grant access.