This is version 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 . It is not the current version, and thus it cannot be edited.
[Back to current version]   [Restore this version]

Amazon supports custom SAML 2.0 applications. See Amazon: Set up your own SAML 2.0 application Link

---

⚠️ Important: Redirect of CrushFTP user to the SAML provider is not supported.

https://domain.com/?u=SSO_SAML&p=redirect

---

1. Amazon SSO SAML 2.0 Configurations:#

Open the IAM Identity Center Console Link and create a new custom application.



Configure SAML Settings:
Enter the Application Name, Application ACS URL, and SAML Audience in the provided fields.
Once all required values are set, click Submit to complete the application setup.

Application ACS URL example:
https://your.crushftp.com/?u=SSO_SAML&p=none

SAML Audience example:
https://your.crushftp.com/

Configure Attribute Mappings:
Set up the attribute mappings for your application to define which user details (such as username, email, or roles) are passed during the SAML authentication process.
These mappings ensure that the correct user information is shared between your identity provider and the application.



Add new attribute mapping.

Maps to this string value or user attribute in IAM Identity Center:
${user:subject}

Warning: Assign users/groups to the created application!

2. SAMLSSO plugin configuration
#

Download the IAM Identity Center SAML metadata file.

[Amazon SSO SAML 2.0 Configuration]                                    [CrushFTP settings] 

entityID value of IAM Identity Center SAML metadata XML file        -> SAML Provider URL (EntityID)

Application SAML audience                                           -> SAML Audience

SingleSignOnService SAML:2.0:bindings:HTTP-POST Location value 
of IAM Identity Center SAML metadata XML file                       -> IDP Redirect URL (HTTP-POST)

IAM Identity Center SAML issuer URL                                 -> SAML Issuer

X509Certificate value of IAM Identity Center SAML metadata XML file -> Base64 encoded PEM Signing certificate

On CrushFTP SAMLSSO plugin for "Authentication type:" set "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport".

urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport