Federate entry to SageMaker Unified Studio with AWS IAM Id Middle and Okta

Many organizations are utilizing an exterior id supplier to handle person identities. With an id supplier (IdP), you possibly can handle your person identities exterior of AWS and provides these exterior person identities permissions to make use of AWS sources in your AWS accounts. Exterior id suppliers (IdP), reminiscent of Okta Common Listing, can combine with AWS IAM Id Middle to be the supply of fact for Amazon SageMaker Unified Studio.

Amazon SageMaker Unified Studio helps a single sign-on (SSO) expertise with AWS IAM Id Middle authentication. Customers can entry Amazon SageMaker Unified Studio with their current company credentials. AWS IAM Id Middle permits directors to attach their current exterior id suppliers and permits them to handle customers and teams of their current id methods reminiscent of Okta which may then be synchronized with AWS IAM Id Middle utilizing SCIM (System for Cross-domain Id Administration).

This publish reveals step-by-step steering to setup workforce entry to Amazon SageMaker Unified Studio utilizing Okta as an exterior Id supplier with AWS IAM Id Middle.

Conditions

Earlier than you begin , ensure you have:

1. An AWS account with AWS IAM Id Middle enabled . It is strongly recommended to make use of an organization-level AWS IAM Id Middle occasion for greatest practices and centralized id administration throughout your AWS group.
2. Okta account with customers and a bunch
3. A browser with community connectivity to Okta and Amazon SageMaker Unified Studio

Answer Overview

The steps on this publish are structured into the next sections:

1. Allow AWS IAM Id Middle
2. Create an Amazon SageMaker area
3. Setup Okta customers and teams
4. Configure SAML in Okta for AWS IAM Id Middle
5. Configure Okta as an id supplier in AWS IAM Id Middle
6. Join AWS IAM Id Middle to Okta
7. Arrange computerized provisioning of customers and teams in AWS IAM Id Middle
8. Full Okta Configuration
9. Configure Amazon SageMaker Unified Studio for SSO
10. Take a look at the setup
11. Cleanup

Allow AWS IAM Id Middle

To allow AWS IAM Id Middle, comply with the directions in Allow IAM Id Middle within the AWS IAM Id Middle Consumer Information.

Create an Amazon SageMaker area

1. Signal into the AWS Administration console and navigate to the Amazon SageMaker console. To create a brand new Amazon SageMaker Unified Studio area comply with the directions in Create a Amazon SageMaker Unified Studio area – handbook setup
2. From the Amazon SageMaker area Abstract web page, copy the Area ARN and save the worth as proven Determine 1 for later use.

Determine 1: Amazon SageMaker Area

Setup Okta customers and teams

Step 1: Join an Okta account

• Join an Okta account, then select the Join button to finish your account setup.
• If you have already got an account with Okta, login to your Okta account.

Step 2: Create Teams in Okta

• Select Listing within the left menu and select Teams to proceed.
• Click on on Add Group and enter title as unifiedstudio. Then select the Save button.

Determine 2. Creating a bunch in Okta

Step 3: Create customers in Okta

• Select Individuals in left menu below Listing part and select +Add Particular person.
• Present First title, Final title, username (e mail ID), and first e mail. Then choose I’ll set password and select first time password. Use the Save button to create your person.
• Add extra customers as wanted.

Step 4: Assign Teams to customers

• Select Teams from the left menu, then select the unifiedstudio group created in Step 2.
• Use Assign Individuals so as to add customers to the sagemaker group. Subsequent, use + for every person you need to add.

Configure SAML In Okta

1. Login to your okta area and select Functions from the left menu. Select Functions, then select Browse App Catalog
2. Within the search field, enter AWS IAM Id Middle, then select the app so as to add the AWS IAM Id Middle app after which, select + Add Integration button.
   The next picture reveals the SAML app integration setup:
   
   Determine 3. Making a SAML app integration in Okta
3. For this instance, we’re creating an software referred to as “unifiedstudio”. Beneath Normal Settings: Required enter the next
   • Utility label = Substitute IAM Id Middle with unifiedstudio after which, select Save
4. Beneath Signal on menu. Copy Metadata URL below SAML 2.0 part after which, open Metadata URL in a brand new browser window to obtain the Okta id supplier metadata and reserve it as metadata.xml. You’ll use this for the SAML configuration in AWS IAM Id Middle to setup Okta as an Id Supplier.The next picture reveals the place to search out the metadata URL:

   
   Determine 4: Downloading Okta id supplier metadata for SAML configuration

5. Select Extra particulars and duplicate Signal on URL into textual content file; you’ll use this for the SAML configuration in Amazon SageMaker Unified Studio.

You at the moment are prepared to maneuver to the AWS IAM Id Middle console to create an id supplier integration on your Okta occasion.

Configure Okta as an id supplier in AWS IAM Id Middle

1. Sign up to the AWS IAM Id Middle console as a person with administrative privileges
2. Within the left navigation menu, select Settings after which, open the Id supply tab, select Change Id supply from Actions dropdown as proven in Determine 5
   Determine 5: Deciding on id supply in AWS IAM Id Middle
3. From Beneath Id supply, select Exterior Id supplier as proven in Determine 6
   
   Determine 6: Selecting Exterior Id supplier in AWS IAM Id Middle
4. You’ll want these configuration parameters for the following step. In Configure exterior id supplier part, below Service Supplier metadata, do the next:
   • Select Obtain metadata file to obtain the AWS IAM Id Middle metadata file and reserve it in your system
   • Copy these Service Supplier metadata right into a textual content file
     1. IAM Id Middle Assertion Client Service (ACS) URL
     2. IAM Id Middle issuer URL
5. In Id supplier metadata part, below Idp SAML metadata, click on on select file and add the metadata.xml file which you downloaded from okta within the earlier step after which, select Subsequent as proven in Determine 7

   

   Determine 7. Configuring okta as Id Supplier in AWS IAM Id Middle

6. After you learn the disclaimer and are able to proceed, enter ACCEPT after which select Change id supply to finish Okta as an Id Supplier in IAM Id Middle.

Join AWS IAM Id Middle to Okta

1. Signal into Okta and go to the admin console.
2. Within the left navigation pane, select Functions, after which select the Okta software referred to as unifiedstudio which you created within the earlier part
3. In Signal On, select Edit to finish SAML configuration. Beneath Superior Signal-on Settings enter the next after which, select Save to finish configuration as proven Determine 8.
   1. For the AWS SSO ACS URL, enter IAM Id Middle Assertion Client Service (ACS) URL
   2. For the AWS SSO issuer URL, enter IAM Id Middle issuer URL
   3. For the Utility username format, select Okta username from dropdown

Determine 8. Configuring okta sign-on settings

Arrange computerized provisioning of customers and teams

Within the AWS IAM Id Middle console, on the Settings web page, find the Computerized provisioning info field, after which select Allow as proven in Determine 9. Copy these values to allow computerized provisioning.

Determine 9. Enabling computerized provisioning in AWS IAM Id Middle

Within the Inbound computerized provisioning dialog field, copy every of the values for the next choices as proven in Determine 10 after which, select Shut

• • SCIM endpoint
  • Entry token

You’ll use these values to configure provisioning in Okta within the subsequent step.

Determine 10. Computerized provisioning configuration parameters in AWS IAM Id Middle

Full the Okta integration

1. Signal into Okta and go to the admin console.
2. Within the left navigation pane, select Functions, after which select the Okta software referred to as unifiedstudio which you created earlier.
3. In Provisioning tab, select Edit to finish auto provisioning between okta and AWS IAM Id Middle.
   • Beneath Settings, select Integration after which, select Configure API integration after which, choose Allow API integration to allow provisioning and enter the next utilizing the SCIM provisioning values from AWS IAM Id Middle that you simply copied from the earlier step as proven in Determine 11

     For the Base URL, enter SCIM endpoint from IAM Id Middle
     For the API Token, enter Entry token from IAM Id Middle
     For Import Teams, choose Import teams possibility

   After which, select Take a look at API Credentials to validate the SCIM provision after which, select Save.

   

   Determine 11: Computerized provisioning configuration in Okta

4. Within the Provisioning tab, within the navigation pane below Settings, select To App within the left navigation. Select Edit, to Allow all choices reminiscent of Create Customers , Replace Consumer Attributes , Deactivate Customers as proven in Determine 12 after which, select Save.

   

   Determine 12: Enabling Computerized provisioning configuration in Okta

5. Within the Assignments tab, select Assign, after which Assign to Teams.
   • Choose the unifiedstudio group, select Assign, after which, go away it to defaults on popup after which, select Completed to finish the Group project, as proven in Determine 13.

   Determine 13: Assigning unifiedstudio group to SAML software referred to as unifiedstudio

6. Within the Push Teams tab, below Push Teams drop-down checklist, choose Discover teams by title as proven in Determine 14.

   

   Determine 14: Selecting okta teams to push them to AWS IAM Id Middle

   • Choose the unifiedstudio group, go away Push group memberships instantly default possibility after which, select Save as proven in Determine 15.

   

   Determine 15: Pushing okta teams to AWS IAM Id Middle

Return to AWS IAM Id Middle, and you must be capable to see Okta group and Okta customers in AWS IAM Id Middle teams and customers as proven In Determine 16.

Determine 16: Okta person teams in AWS IAM Id Middle

Configure SageMaker Unified Studio for SSO

On this step, you’ll configure SSO person entry to Amazon SageMaker Unified Studio on your Amazon SageMaker platform area.

1. Navigate to the Amazon SageMaker administration console.
2. Within the left navigation menu, choose Domains.
3. Select the Area from the checklist for which you need to configure SAML person entry.
4. On the area’s particulars web page, select Configure subsequent to the Configure SSO person entry.
   
   Determine 17: Amazon SageMaker Unified Studio SSO configuration
5. On the Select person authentication technique web page, select IAM Id Middle. With IAM Id Middle, customers configured via exterior Id Suppliers (IdPs) get to entry the area’s Amazon SageMaker Unified Studio. Select Subsequent.
   
   Determine 18: Selecting authentication
6. You may select both Require assignments – which implies you explicitly choose customers/teams that may entry the area or Don’t require assignments – which permits all licensed Okta customers and teams entry to this area.
   1. You may have two choices to configure how your customers will entry to Amazon SageMaker Unified studio with AWS IAM Id Middle federation with Okta
      • Don’t required Assignments – The entry can be offered to Amazon SageMaker Unified Studio based mostly in your Okta SAML software assignments both via Group assignments or Particular person person assignments. For this instance, while you select Don’t required assignments possibility, all of the customers inside unifiedstudio Okta group may have entry to Amazon SageMaker Unified Studio as we’ve got assigned unifiedstudio Okta person group to unifiedstudio SAML software in Okta.
      • Require Assignments – It’s essential to add both Okta customers or Okta group to Amazon SageMaker area as proven in step 8. In step 8, you’ll add unifiedstudio Okta group into Amazon SageMaker area so that every one unifiedstudio Okta group customers will get entry to Amazon SageMaker Unified Studio. You may as well present an Particular person Okta group customers entry to Amazon SageMaker unified studio via Amazon SageMaker area console by including SSO (okta person) person into the area.
   2. Observe that both an Particular person person or group inside Okta should be assigned to the AWS Id heart software (AWS IAM Id Middle from Okta software catalog. We renamed software label as unifiedstudio for this instance) for each Don’t require Assignments and Require Assignments choices.

   

   Determine 19. Amazon SageMaker Unified Studio SAML configuration

7. On the Evaluation and save web page, evaluate your selections after which select Save. Observe that these settings are everlasting as soon as saved.

   

   Determine 20. Evaluation and ensure SAML configuration

8. In the event you’ve chosen to require assignments, use the Add customers and teams so as to add SAML customers and teams to your area.

   

   Determine 21. Including okta group into Amazon Sagemaker area

9. Now, customers will be capable to entry the Amazon SageMaker Unified Studio utilizing the Area URL with their SSO credentials.
10. You may discover totally different tasks on your customers and assign these tasks based mostly in your SAML person teams for fine-grained entry controls. For instance, you possibly can create totally different SAML person teams based mostly on their job operate in Okta, assign these Okta teams to AWS IAM Id Middle app in Okta after which, assign these Okta SAML teams to respective challenge profiles in Amazon SageMaker Unified Studio. To carry out challenge profiles assignments to respective teams, select challenge profiles tab, click on on respective challenge profiles like SQL analytics, select Licensed customers and teams tab after which, select Add and decide SSO teams from drop down as proven in Determine 22. Lastly select Add customers and teams to finish challenge profile project.

    

    Determine 22. Assigning a challenge profile to okta group

Take a look at the setup

1. The Amazon SageMaker Unified Studio URL will be discovered on the area particulars web page as proven in Determine 23. The primary entry to Amazon SageMaker Unified Studio URL redirects you to the Okta login display screen.
   

   Determine 23. Validating Okta person entry with Amazon SageMaker Unified Studio

2. Copy and paste the Amazon SageMaker Unified Studio URL in your browser and enter the person credentials.
3. After profitable login, you can be redirected to the Amazon SageMaker Unified Studio residence web page.

   

   

   Determine 24. SAML authenticated Amazon SageMaker Unified Studio

4. As soon as logged into Amazon SageMaker Unified Studio, you possibly can assign authorization insurance policies based mostly in your necessities. Select Govern after which select, Area models and select your SageMaker area to pick appropriate authorization insurance policies. For this instance, we’re selecting challenge creation coverage as proven in Determine 25.

   

   

   
   Determine 25. Amazon SageMaker unified studio authorization insurance policies

5. Select Mission membership coverage after which select ADD POLICY GRANT choice to assign person teams or customers to respective challenge. For this instance, we’re selecting challenge membership coverage as proven in Determine 26.

   

   

   Determine 26. Amazon SageMaker unified studio authorization insurance policies project

You’ve now efficiently configured single sign-on for Amazon SageMaker Unified Studio utilizing Okta credentials via AWS IAM Id Middle.

Clear up

To keep away from ongoing prices, delete the sources you created:

Conclusion

On this publish, we confirmed you the way to arrange Okta as an id supplier utilizing SAML authentication for Amazon SageMaker Unified Studio entry via AWS IAM Id Middle federation. This setup permits your customers to entry SageMaker Unified Studio with their current company credentials, eliminating the necessity for separate AWS accounts.

Get began by checking the Amazon SageMaker Unified Studio Developer Information, which offers steering on the way to construct knowledge and AI purposes utilizing Amazon SageMaker platform

Concerning the authors