AWS SAML SSO

Requirements

1. Initial Doppler SAML SSO Configuration

Go to the Doppler dashboard and from the menu click Team, then select the Settings tab from the top menu. Choose the Default Roles for users who login via SSO.

πŸ“˜

The Role controls the initial permissions a user will receive when their account is created. We recommend keeping it at Collaborator access to follow the principle of least privilege. Users with the Owner role can adjust this after the user has logged in once. If you scroll down further on the Settings page, you'll see a breakdown of what permissions each Role has.

12011201

After setting the Default Roles, we need to enable SAML SSO in Doppler to get access to the URLs needed to configure the AWS SAML SSO application.

Select the SSO tab from the top menu and scroll down to the SAML Single Sign-On section. Click the + button in the corner and choose a verified domain from the Domain Domain dropdown menu and then click Save.

923923

Copy the ACS URL and Entity ID URLs to use when configuring the AWS SAML SSO application.

931931

2. Create SAML Application

In a separate window, browse to your AWS IAM Identity Center dashboard and select Applications under Application Assignments from the main menu on the left, then click the Add application button.

12901290

Select the Add custom SAML 2.0 application option and then click the Next button at the bottom of the page.

719719

Next, provide a name (required) and description (optional) for your custom application.

706706

Scroll down and download the SAML metadata XML file in the IAM Identity Center metadata section. The contents of this XML metadata file will be used when configuring Doppler in a later step.

707707

Scroll down to the Application properties section and set the Application start URL to https://dashboard.doppler.com.

887887

Scroll down to the Application metadata section, choose Manually type your metadata values and then add the ACS and Entity ID URLs you got from Step 1 above. Finally, click Submit.

887887

On the application details page you end up at after submitting, click the Actions button and choose Edit attribute mappings.

896896

Set the Subject attribute mapping so it maps to ${user.email} and has its format set to emailAddress. Click the Add new attribute mapping button and set its attributes to name, ${user:name} and unspecified. Finally, click Save changes.

994994

3. Update Doppler SAML SSO Configuration

Navigate to the Doppler Team page and click on the SSO tab.

Scroll down to the SAML Single Sign-On section and paste in the XML metadata from the file you downloaded earlier in Step 2. Check the Enable field, then click the Save button.

934934

You're now ready to test the AWS SAML application!

4. Testing

As an AWS administrator, it's presumed you'll know how to sufficiently test a new AWS SSO application, but here is a general guide.

πŸ“˜

Test sign-in flow using incognito window

Be sure to stay signed in to the Doppler dashboard until you've verified the AWS sign-in flow from an incognito window.

Staying signed in to the dashboard will allow you to update the SAML settings or disable SAML SSO in the event of misconfiguration.

From the application details page for your newly created Doppler SAML application, click the Assign Users button in the Assigned users section.

978978

Now select any users or groups you want to add and click the Assign Users button.

988988

Now test the Doppler SAML sign-in flow by opening an incognito window, browsing to https://dashboard.doppler.com and sign-in using the AWS user you assigned from the previous step.

This will redirect you to the AWS login page and you should then get redirected to the Doppler dashboard for the assigned user.

Once you've verified the Doppler SAML application is configured correctly, you can then apply your standard organization policies for people and groups assignment.

Troubleshooting

Here are some general troubleshooting tips:

  • Double-check that the Application ACS URL and Application SAML audience values match exactly what is displayed in the Doppler SAML section.
  • Check that your user attribute mappings are entered correctly.

If you're still running into issues, the error page should present you with a requestId value that can be used by our support team for further diagnosis.

πŸ‘

Awesome Work!

Your custom AWS Doppler SAML 2.0 application is now set up!


Did this page help you?