Federate entry to SageMaker Unified Studio with AWS IAM Id Middle and Okta

Many organizations are utilizing an exterior identification supplier to handle consumer identities. With an identification supplier (IdP), you possibly can handle your consumer identities exterior of AWS and provides these exterior consumer identities permissions to make use of AWS sources in your AWS accounts. Exterior identification suppliers (IdP), resembling Okta Common Listing, can combine with AWS IAM Id Middle to be the supply of fact for Amazon SageMaker Unified Studio.

Amazon SageMaker Unified Studio helps a single sign-on (SSO) expertise with AWS IAM Id Middle authentication. Customers can entry Amazon SageMaker Unified Studio with their present company credentials. AWS IAM Id Middle permits directors to attach their present exterior identification suppliers and permits them to handle customers and teams of their present identification programs resembling Okta which might then be synchronized with AWS IAM Id Middle utilizing SCIM (System for Cross-domain Id Administration).

This put up reveals step-by-step steerage to setup workforce entry to Amazon SageMaker Unified Studio utilizing Okta as an exterior Id supplier with AWS IAM Id Middle.

Stipulations

Earlier than you begin , be sure you have:

1. An AWS account with AWS IAM Id Middle enabled . It is strongly recommended to make use of an organization-level AWS IAM Id Middle occasion for greatest practices and centralized identification administration throughout your AWS group.
2. Okta account with customers and a gaggle
3. A browser with community connectivity to Okta and Amazon SageMaker Unified Studio

Answer Overview

The steps on this put up are structured into the next sections:

1. Allow AWS IAM Id Middle
2. Create an Amazon SageMaker area
3. Setup Okta customers and teams
4. Configure SAML in Okta for AWS IAM Id Middle
5. Configure Okta as an identification supplier in AWS IAM Id Middle
6. Join AWS IAM Id Middle to Okta
7. Arrange computerized provisioning of customers and teams in AWS IAM Id Middle
8. Full Okta Configuration
9. Configure Amazon SageMaker Unified Studio for SSO
10. Take a look at the setup
11. Cleanup

Allow AWS IAM Id Middle

To allow AWS IAM Id Middle, comply with the directions in Allow IAM Id Middle within the AWS IAM Id Middle Person Information.

Create an Amazon SageMaker area

1. Signal into the AWS Administration console and navigate to the Amazon SageMaker console. To create a brand new Amazon SageMaker Unified Studio area comply with the directions in Create a Amazon SageMaker Unified Studio area – handbook setup
2. From the Amazon SageMaker area Abstract web page, copy the Area ARN and save the worth as proven Determine 1 for later use.

Determine 1: Amazon SageMaker Area

Setup Okta customers and teams

Step 1: Join an Okta account

• Join an Okta account, then select the Enroll button to finish your account setup.
• If you have already got an account with Okta, login to your Okta account.

Step 2: Create Teams in Okta

• Select Listing within the left menu and select Teams to proceed.
• Click on on Add Group and enter identify as unifiedstudio. Then select the Save button.

Determine 2. Creating a gaggle in Okta

Step 3: Create customers in Okta

• Select Individuals in left menu beneath Listing part and select +Add Individual.
• Present First identify, Final identify, username (e mail ID), and first e mail. Then choose I’ll set password and select first time password. Use the Save button to create your consumer.
• Add extra customers as wanted.

Step 4: Assign Teams to customers

• Select Teams from the left menu, then select the unifiedstudio group created in Step 2.
• Use Assign Individuals so as to add customers to the sagemaker group. Subsequent, use + for every consumer you wish to add.

Configure SAML In Okta

1. Login to your okta area and select Functions from the left menu. Select Functions, then select Browse App Catalog
2. Within the search field, enter AWS IAM Id Middle, then select the app so as to add the AWS IAM Id Middle app after which, select + Add Integration button.
   The next picture reveals the SAML app integration setup:
   
   Determine 3. Making a SAML app integration in Okta
3. For this instance, we’re creating an software known as “unifiedstudio”. Beneath Common Settings: Required enter the next
   • Software label = Exchange IAM Id Middle with unifiedstudio after which, select Save
4. Beneath Signal on menu. Copy Metadata URL beneath SAML 2.0 part after which, open Metadata URL in a brand new browser window to obtain the Okta identification supplier metadata and reserve it as metadata.xml. You’ll use this for the SAML configuration in AWS IAM Id Middle to setup Okta as an Id Supplier.The next picture reveals the place to search out the metadata URL:

   
   Determine 4: Downloading Okta identification supplier metadata for SAML configuration

5. Select Extra particulars and replica Signal on URL into textual content file; you’ll use this for the SAML configuration in Amazon SageMaker Unified Studio.

You at the moment are prepared to maneuver to the AWS IAM Id Middle console to create an identification supplier integration to your Okta occasion.

Configure Okta as an identification supplier in AWS IAM Id Middle

1. Register to the AWS IAM Id Middle console as a consumer with administrative privileges
2. Within the left navigation menu, select Settings after which, open the Id supply tab, select Change Id supply from Actions dropdown as proven in Determine 5
   Determine 5: Choosing identification supply in AWS IAM Id Middle
3. From Beneath Id supply, select Exterior Id supplier as proven in Determine 6
   
   Determine 6: Selecting Exterior Id supplier in AWS IAM Id Middle
4. You’ll want these configuration parameters for the subsequent step. In Configure exterior identification supplier part, beneath Service Supplier metadata, do the next:
   • Select Obtain metadata file to obtain the AWS IAM Id Middle metadata file and reserve it in your system
   • Copy these Service Supplier metadata right into a textual content file
     1. IAM Id Middle Assertion Shopper Service (ACS) URL
     2. IAM Id Middle issuer URL
5. In Id supplier metadata part, beneath Idp SAML metadata, click on on select file and add the metadata.xml file which you downloaded from okta within the earlier step after which, select Subsequent as proven in Determine 7

   

   Determine 7. Configuring okta as Id Supplier in AWS IAM Id Middle

6. After you learn the disclaimer and are able to proceed, enter ACCEPT after which select Change identification supply to finish Okta as an Id Supplier in IAM Id Middle.

Join AWS IAM Id Middle to Okta

1. Signal into Okta and go to the admin console.
2. Within the left navigation pane, select Functions, after which select the Okta software known as unifiedstudio which you created within the earlier part
3. In Signal On, select Edit to finish SAML configuration. Beneath Superior Signal-on Settings enter the next after which, select Save to finish configuration as proven Determine 8.
   1. For the AWS SSO ACS URL, enter IAM Id Middle Assertion Shopper Service (ACS) URL
   2. For the AWS SSO issuer URL, enter IAM Id Middle issuer URL
   3. For the Software username format, select Okta username from dropdown

Determine 8. Configuring okta sign-on settings

Arrange computerized provisioning of customers and teams

Within the AWS IAM Id Middle console, on the Settings web page, find the Automated provisioning data field, after which select Allow as proven in Determine 9. Copy these values to allow computerized provisioning.

Determine 9. Enabling computerized provisioning in AWS IAM Id Middle

Within the Inbound computerized provisioning dialog field, copy every of the values for the next choices as proven in Determine 10 after which, select Shut

• • SCIM endpoint
  • Entry token

You’ll use these values to configure provisioning in Okta within the subsequent step.

Determine 10. Automated provisioning configuration parameters in AWS IAM Id Middle

Full the Okta integration

1. Signal into Okta and go to the admin console.
2. Within the left navigation pane, select Functions, after which select the Okta software known as unifiedstudio which you created earlier.
3. In Provisioning tab, select Edit to finish auto provisioning between okta and AWS IAM Id Middle.
   • Beneath Settings, select Integration after which, select Configure API integration after which, choose Allow API integration to allow provisioning and enter the next utilizing the SCIM provisioning values from AWS IAM Id Middle that you just copied from the earlier step as proven in Determine 11

     For the Base URL, enter SCIM endpoint from IAM Id Middle
     For the API Token, enter Entry token from IAM Id Middle
     For Import Teams, choose Import teams possibility

   After which, select Take a look at API Credentials to validate the SCIM provision after which, select Save.

   

   Determine 11: Automated provisioning configuration in Okta

4. Within the Provisioning tab, within the navigation pane beneath Settings, select To App within the left navigation. Select Edit, to Allow all choices resembling Create Customers , Replace Person Attributes , Deactivate Customers as proven in Determine 12 after which, select Save.

   

   Determine 12: Enabling Automated provisioning configuration in Okta

5. Within the Assignments tab, select Assign, after which Assign to Teams.
   • Choose the unifiedstudio group, select Assign, after which, go away it to defaults on popup after which, select Performed to finish the Group task, as proven in Determine 13.

   Determine 13: Assigning unifiedstudio group to SAML software known as unifiedstudio

6. Within the Push Teams tab, beneath Push Teams drop-down record, choose Discover teams by identify as proven in Determine 14.

   

   Determine 14: Selecting okta teams to push them to AWS IAM Id Middle

   • Choose the unifiedstudio group, go away Push group memberships instantly default possibility after which, select Save as proven in Determine 15.

   

   Determine 15: Pushing okta teams to AWS IAM Id Middle

Return to AWS IAM Id Middle, and you must be capable of see Okta group and Okta customers in AWS IAM Id Middle teams and customers as proven In Determine 16.

Determine 16: Okta consumer teams in AWS IAM Id Middle

Configure SageMaker Unified Studio for SSO

On this step, you’ll configure SSO consumer entry to Amazon SageMaker Unified Studio to your Amazon SageMaker platform area.

1. Navigate to the Amazon SageMaker administration console.
2. Within the left navigation menu, choose Domains.
3. Select the Area from the record for which you wish to configure SAML consumer entry.
4. On the area’s particulars web page, select Configure subsequent to the Configure SSO consumer entry.
   
   Determine 17: Amazon SageMaker Unified Studio SSO configuration
5. On the Select consumer authentication methodology web page, select IAM Id Middle. With IAM Id Middle, customers configured by exterior Id Suppliers (IdPs) get to entry the area’s Amazon SageMaker Unified Studio. Select Subsequent.
   
   Determine 18: Selecting authentication
6. You may select both Require assignments – which suggests you explicitly choose customers/teams that may entry the area or Don’t require assignments – which permits all approved Okta customers and teams entry to this area.
   1. You have got two choices to configure how your customers will entry to Amazon SageMaker Unified studio with AWS IAM Id Middle federation with Okta
      • Don’t required Assignments – The entry can be offered to Amazon SageMaker Unified Studio based mostly in your Okta SAML software assignments both by Group assignments or Particular person consumer assignments. For this instance, once you select Don’t required assignments possibility, all of the customers inside unifiedstudio Okta group may have entry to Amazon SageMaker Unified Studio as now we have assigned unifiedstudio Okta consumer group to unifiedstudio SAML software in Okta.
      • Require Assignments – It’s essential to add both Okta customers or Okta group to Amazon SageMaker area as proven in step 8. In step 8, you’ll add unifiedstudio Okta group into Amazon SageMaker area so that each one unifiedstudio Okta group customers will get entry to Amazon SageMaker Unified Studio. You can even present an Particular person Okta group customers entry to Amazon SageMaker unified studio by Amazon SageMaker area console by including SSO (okta consumer) consumer into the area.
   2. Word that both an Particular person consumer or group inside Okta should be assigned to the AWS Id heart software (AWS IAM Id Middle from Okta software catalog. We renamed software label as unifiedstudio for this instance) for each Don’t require Assignments and Require Assignments choices.

   

   Determine 19. Amazon SageMaker Unified Studio SAML configuration

7. On the Evaluation and save web page, evaluation your decisions after which select Save. Word that these settings are everlasting as soon as saved.

   

   Determine 20. Evaluation and ensure SAML configuration

8. For those who’ve chosen to require assignments, use the Add customers and teams so as to add SAML customers and teams to your area.

   

   Determine 21. Including okta group into Amazon Sagemaker area

9. Now, customers will be capable of entry the Amazon SageMaker Unified Studio utilizing the Area URL with their SSO credentials.
10. You may discover completely different tasks to your customers and assign these tasks based mostly in your SAML consumer teams for fine-grained entry controls. For instance, you possibly can create completely different SAML consumer teams based mostly on their job perform in Okta, assign these Okta teams to AWS IAM Id Middle app in Okta after which, assign these Okta SAML teams to respective venture profiles in Amazon SageMaker Unified Studio. To carry out venture profiles assignments to respective teams, select venture profiles tab, click on on respective venture profiles like SQL analytics, select Approved customers and teams tab after which, select Add and choose SSO teams from drop down as proven in Determine 22. Lastly select Add customers and teams to finish venture profile task.

    

    Determine 22. Assigning a venture profile to okta group

Take a look at the setup

1. The Amazon SageMaker Unified Studio URL could be discovered on the area particulars web page as proven in Determine 23. The primary entry to Amazon SageMaker Unified Studio URL redirects you to the Okta login display.
   

   Determine 23. Validating Okta consumer entry with Amazon SageMaker Unified Studio

2. Copy and paste the Amazon SageMaker Unified Studio URL in your browser and enter the consumer credentials.
3. After profitable login, you may be redirected to the Amazon SageMaker Unified Studio residence web page.

   

   

   Determine 24. SAML authenticated Amazon SageMaker Unified Studio

4. As soon as logged into Amazon SageMaker Unified Studio, you possibly can assign authorization insurance policies based mostly in your necessities. Select Govern after which select, Area items and select your SageMaker area to pick out appropriate authorization insurance policies. For this instance, we’re selecting venture creation coverage as proven in Determine 25.

   

   

   
   Determine 25. Amazon SageMaker unified studio authorization insurance policies

5. Select Undertaking membership coverage after which select ADD POLICY GRANT choice to assign consumer teams or customers to respective venture. For this instance, we’re selecting venture membership coverage as proven in Determine 26.

   

   

   Determine 26. Amazon SageMaker unified studio authorization insurance policies task

You’ve now efficiently configured single sign-on for Amazon SageMaker Unified Studio utilizing Okta credentials by AWS IAM Id Middle.

Clear up

To keep away from ongoing costs, delete the sources you created:

Conclusion

On this put up, we confirmed you easy methods to arrange Okta as an identification supplier utilizing SAML authentication for Amazon SageMaker Unified Studio entry by AWS IAM Id Middle federation. This setup permits your customers to entry SageMaker Unified Studio with their present company credentials, eliminating the necessity for separate AWS accounts.

Get began by checking the Amazon SageMaker Unified Studio Developer Information, which gives steerage on easy methods to construct knowledge and AI purposes utilizing Amazon SageMaker platform

Concerning the authors