To integrate the SecSign ID Two-Factor Authentication with AWS you first need to setup an account with AWS and have administrative access rights. More information about setting up an account and managing user rights are available on the AWS website.
You also need access to the SecSign ID administrative panel. If you need assistance managing your administrative account please contact us.
Navigate to your SecSign ID Administration page and login. Select “SAML response attributes from the menu and create a new SAML response attribute.
Specify the following values:
Name in SAML response: https://aws.amazon.com/SAML/Attributes/Role
leave NameID Format, NameID Attribute-Store and
Fixed attribute value:
Save the settings.
Then choose SAML Service Provider from the menu and select “New SAML
service provider”. Specifiy the following parameter.
Name for example: AWS billing
NameID Attribute store: SecSign ID Server
NameID source attribute: SecSign ID
Service Provider Issuer: urn:amazon:webservices
SAML response URL: https://signin.aws.amazon.com/saml
RelayState remains blank.
Audience Restriction: urn:amazon:webservices
Auth Context remains blank.
User group to sign: The user group to which you have assigned a technical user owning the private key to sign SAML responses. Example user group name: “SAML response signers.”
Hash algorithm: Server selects.
PSS padding: Server selects.
SAML attribute: Please select:
https://aws.amazon.com/SAML/Attributes/RoleSessionName and the attribute
https://aws.amazon.com/SAML/Attributes/Role created in the first step.
Save the settings.
Select “User groups” and select the user groups whose members shall be allowed to log-in at Amazon Web Services having the permissions there which we will assign in a following step, in this example to view the bills.
Double click the newly created SAML Service Provider in the list and then click on the link beside “Import the IdP SAML meta data from this URL”. Save the downloaded SAML meta data to a file.
Open the AWS Management Console at https://aws.amazon.com/ and go the service IAM (identity and access management).
Select “Identity providers” from the left menu and “Create Provider”.
Choose “SAML” as Provider Type and enter a Provider Name, for example “SecSign-ID-Prod”.
At “Metadata Document” load the SAML meta data file which you have saved from the SecSign ID Server in step 2.
Select the newly created provider in the list and display its properties.
Copy the “Provider ARN” into a text file. We will need it later.
Select “Roles” from the left menu and click at “Create Role”.
Select SAML as type of trusted entity.
Select the SecSign ID Provider as SAML Provider.
Click at “Next: Permissions”
Click at “Create Policy” and select the permissions that the SecSign ID users, that are allowed to use this SAML log-in, shall get. For example “Billing”.
Click at “Next: Review”.
Provide a name and a description to the role, for example “Bill viewers” and “users who can view the bills”.
Select “Create role”.
Copy the “Role ARN” into a text file. We will need it later.
Go back to the admin page of the SecSign ID Server, select “SAML
response attributes” from the left menu.
Select the attribute with the name
“https://aws.amazon.com/SAML/Attributes/Role” and click “Details” and
Enter the “Role ARN” as a fixed attribute value from your temporary text
file, a comma and the “Provider ARN” from your temporary text file.
We provide an ever growing list of APIs and plugins to easily integrate the SecSign ID Two-Factor Authentication in any project. An overview is available at Plugin and APIs.
We do not only offer APIs in different programming languages but also plugins for CMS, Server and VPN environments, oAuth2 and many more. These plugins use our APIs and offer additional functionalities, for example user management, easy and native installation, logging or integration in firewalls or Active Directory.
The JIRA plugin for example uses the JAVA-API. The PHP-Api and JS-API is used by WordPress, Joomla, Drupal, Typo3 and many more. The ASP.net/C#-API is used for the Windows and Cisco VPN and the C-API is used for protecting Unix SSH services. The Objective-C API is used by our AppleTV and iPhone/iPad apps.
You can experience the SecSign ID two-factor authentication and the two-factor login by simply integrating the plugin into your website or test environment. Or you can try out the login process on our website without having to register first. You already have a SecSign ID or you want one? Login now and use the portal or use our hassle free registration.
See for yourself how fast and convenient the login process using challenge-response authentication with 2048-bit key pairs is. There is no need for passwords, and no passwords or other confidential information are ever transmitted. It is easy to integrate and simple to use.
For more information about the patented SafeKey procedure and it's unique security can be found here.
If you are missing an API for the programming language you are working with, feel free to contact us and we’ll find a solution with you. If you need help with the integration into an existing system or you can’t find the plugin for your content management system you are working with, don’t hesitate to contact our support team.
On premise installations of SecSign ID offer the flexibility to connect with your preferred servers, services, and devices. And you can customize the SecSign ID with your own organization’s branding.
Choose between our SecSign ID Cloud or operate your own on-premise Two-Factor Authentication server.
Operate your own YourBrand ID app - Two-Factor Authentication customized to your needs.
Integrate SecSign ID Two-Factor Authentication in existing apps with our ready-to-use SDK.
Use the Two-Factor Authentication Server to secure your company Active Directory/LDAP. Your own Identity and Access Management System, for example for mandatory updates and additional security features.
Integration in any login environment: web, local, VPN, remote desktop, mobile logins and many more.
No need for complex integration: we have plugins for almost all environments.
Want to learn more about SecSign’s innovative and highly secure
solutions for protecting your user accounts and sensitive data?
Use our contact form to submit your information, and a SecSign sales representative will contact you within one business day.
If you need assistance with an existing SecSign account or product
installation, please see the FAQs for more information on the most common questions. You don’t find the solution to your problem? Don’t hesitate to contact the
I am Interested in