This article provides step-by-step instructions to configure MFA for Amazon WorkSpaces using ADSelfService Plus to strengthen security and protect user access.
Steps to configure MFA for Amazon WorkSpaces using ADSelfService Plus
Step 1: Configure SSO for Amazon WorkSpaces in ADSelfService Plus
Log in to ADSelfService Plus as an administrator.
Navigate to Configuration > Self-Service > Password Sync/Single Sign-On.
In the Configured Applications section, click Add Application.
In the All Applications page that opens, click Custom Application from the left menu.
In the Create Custom Application page, enter the Application Name and Description
Enter the Domain Name of the email address you use to log in to the application. For example, if your email address is johndoe@mydomain.com, then mydomain.com is the domain name.
Use the Assign Policies drop-down to select the policies to which you want this SSO configuration to apply. To learn more about creating an OU or a group-based policy, see this guide.
Upload a Small Icon and Large Icon mage to represent the Amazon WorkSpaces app in the ADSelfService Plus portal.
In the SSO section, the Enable Single Sign-On checkbox is selected by default. SAML is preselected in the Select Sign-On Method field.
From the Supported SSO Flow(s) drop-down, select IdP Initiated.
In the Upload Metadata field, you can upload the metadata available at AWS SAML Metadata, or manually enter the Entity ID and ACS URL corresponding to your AWS region from the provided link.
Note: Ensure that the value provided for the Entity ID matches the SAML:aud condition specified in the Trust Policy editor shown in the image under step 5.
Under IdP Settings:
Choose the RSA-SHA256 algorithm as the signature algorithm.
Choose the SIGNED as the SAML Response.
Choose the Exclusive Canonicalization with comments as the Canonicalization Method.
Choose Email Address as the Name ID Format.
Click IdP Details in the top-right corner of the page.
In the pop-up that opens download the IdP Metadata and copy the Login URL for use in the AWS configuration.
Click Create Custom Application to save the configuration. Steps to configure a custom SAML SSO application for Amazon WorkSpaces in ADSelfService Plus.
Step 2: Configure MFA for Amazon WorkSpaces in ADSelfService Plus
To enhance Amazon WorkSpaces security using MFA, follow the steps below:
In ADSelfService Plus, navigate to Configuration > Self-Service > Multi-factor Authentication.
From the Choose the Policy drop-down, select a policy for which Amazon Workspaces SSO has been assigned.
Navigate to MFA for Endpoints.
In the MFA for Enterprise Applications section, select Enable __ authentication factor(s) for application logins. Choose the number of authentication methods to be enforced. Configuring Amazon WorkSpaces MFA in ADSelfService Plus.
Select the desired authentication methods from the drop-down.
Click the asterisk (*) symbol next to an authentication method to set it as mandatory.
Click Save Settings.
Step 3: Create a SAML identity provider in Amazon WorkSpaces
Sign in to the AWS Management Console and open the AWS IAM Console.
In the left-hand navigation pane, select dentity providers under the Access management section, then click Add provider. Adding an identity provider to begin SAML configuration.
Under Add provider:
Choose SAML as the provider type.
Enter the Provider name.
Upload the metadata XML file downloaded from ADSelfService Plus under the Metadata document section.
Click Add provider to complete the setup. Steps to create a SAML identity provider in AWS.Information about the SAML identity provider created in AWS.
Step 4: Create a SAML federated IAM role
In the IAM console, navigate to Roles and click Create role.
Choose SAML 2.0 federation as the trusted entity type Steps to create a SAML federated IAM role and define its permissions for AWS access.
Select the SAML Provider created in the previous step.
Do not select the following options:
Allow programmatic access only
Allow programmatic and AWS Management Console access
Select SAML:sub_type as the Attribute and enter persistent as the Value. Step to choose the corresponding Attribute and Value for the SAML federated role.
Set a Role name and DescriptionStep showing where to assign a role name and description while creating a SAML federated IAM role in AWS for WorkSpaces access.
Review the role details and click Create role.
Step 5: Modify the trust policy for the IAM role
Select the newly created IAM role and click the Trust relationships tab.
Click Edit trust policySteps to modify the trust policy for the IAM role.
Replace the placeholders in the JSON trust policy with the following:
<ACCOUNT-ID-WITHOUT-HYPHENS> → Replace the Account ID with the value you obtain from the Profile section.
<PROVIDER-NAME> → Replace with the name of the SAML provider you created in Step 1.
Ensure that the Action field includes both sts:AssumeRoleWithSAML and sts:TagSession permissions.
Click Update policy.
Step 6: Embed an inline policy for Amazon WorkSpaces SAML access
To allow SAML-based access to Amazon WorkSpaces, you need to add an inline policy to the IAM role.
In the IAM role, click the Permissions tab.In the Permissions policies section, find the Add permissions drop-down and select Create inline policy. Steps to add an inline policy to the IAM role to enable SAML-based access to Amazon WorkSpaces.
In the Policy editor wizard, click the JSON tab.
Replace the following placeholders:
<REGION-CODE> → Replace this with the AWS Region where your WorkSpaces directory is located. You can locate the current region in the top-right corner of the AWS Management Console.
<DIRECTORY-ID> → Replace the Directory ID with the value you obtain from the WorkSpaces management console.
<ACCOUNT ID> → Replace the Account ID with the value you obtain from the Profile section.
Refer to the image below to identify the Directory ID placeholder.
Step shows where to replace the Directory ID placeholder with your actual WorkSpaces Directory ID in the inline policy.
Refer to the image below to identify the Account ID placeholder.
Step shows where to replace the Account ID placeholder with your actual Account ID in the inline policy.
Review the policy and click Create policy to apply it. Final step to review and apply the inline policy for enabling SAML-based access to Amazon WorkSpaces.
Step 7: Enable integration with SAML 2.0 on your WorkSpaces directory
Sign in to the AWS Management Console and open the Amazon WorkSpaces console.
In the navigation pane, select Directories.
Choose the Directory ID for your WorkSpaces. Steps to select the desired Directory ID.
Under the Authentication section, choose Edit authentication. Navigating to the authentication section in Amazon WorkSpaces to edit authentication.
Choose Edit SAML 2.0 Identity Provider to configure SAML settings. Interface to configure SAML 2.0 Identity Provider settings for Amazon WorkSpaces.
Check Enable SAML 2.0 authentication.
Paste the Login URL copied from ADSelfService Plus into the User Access URL field, as outlined above in Step 1.
Manage fallback settings based on your preference by checking or unchecking Allow clients that do not support SAML 2.0 to login. Option to enable SAML 2.0 authentication and configure the User Access URL and IdP deep link for integration with ADSelfService Plus.
Choose SaveNotification indicating that SAML properties were successfully updated for the Amazon WorkSpaces directory.
Validation and confirmation
To validate the Amazon WorkSpaces MFA setup, attempt to access the Amazon WorkSpaces application. When the SSO process is initiated, ADSelfService Plus prompts the user to complete the configured MFA methods before access is granted. This ensures that MFA for Amazon WorkSpaces is properly enforced during the authentication process. After successfully completing the required authentication methods, the user is seamlessly redirected to Amazon WorkSpaces and signed in to their assigned WorkSpace session, confirming that MFA enforcement is functioning as expected.
Get seamless one-click access to 100+ cloud applications. With enterprise single sign-on, users can access all their cloud applications using their Active Directory credentials.
Synchronize Windows Active Directory user passwords and account changes across multiple systems automatically, including Microsoft 365, Google Workspace, IBM iSeries, and more.
Strong passwords resist various hacking threats. Enforce Active Directory users to adhere to compliant passwords by displaying password complexity requirements.
Enable Active Directory users to update their latest information themselves. Quick search features help admins scout for information using search keys like contact numbers.
Free Edition
