Signing in to Amazon Web Services™ by Scanning a QR Code

Amazon Web Services™ (AWS) users can log in using their smartphones to scan a QR code displayed on the computer screen. After you integrate the web application with MicroStrategy Identity, the AWS login page displays a QR code.

The following steps contain only the information required to configure or use AWS with MicroStrategy Identity. The information provided is subject to change. See the appropriate third-party documentation for the latest information.

To Register Amazon Web Services with MicroStrategy Identity

If your AWS Management Console users are populated from an identity management (IDM) system such as Microsoft Active Directory or OpenLDAP, MicroStrategy recommends that you add users to your Identity Network by synchronizing MicroStrategy Identity with the same IDM system. This helps add user information to MicroStrategy Identity and may be easier than adding users manually or by importing a file. For steps, see Synchronizing Users from Microsoft Active Directory or Synchronizing Users from OpenLDAP.

1. Log into MicroStrategy Identity Manager.
2. Click Logical Gateways.
3. Under Web Application Login, click More, then click Amazon Web Services.
4. To change the image that is displayed on the AWS Management Console login page, click Import An Icon. Select an image to display, then click Open.
5. In the Enter Display Name field, provide a name to display for the AWS Management Console login page. The name can be up to 30 characters long.
6. If the users in your Identity Network are added from Microsoft Active Directory, you can enable users to sign in to AWS by typing their Active Directory user name and password, rather than scanning a QR code. For example, if not all users in your network have access to a smartphone, you can enable users to sign in with their user name and password. To do this, select the Enable user name and password as a login option check box.
7. If the users in your Identity Network are added from Microsoft Active Directory (see Synchronizing Users from Microsoft Active Directory), you can enable users to sign in to AWS by typing their Active Directory user name and password, rather than scanning a QR code. For example, if not all users in your network have access to a smartphone, you can enable users to sign in with their user name and password. To do this, select the Enable user name and password as a login option check box.
8. Download the MicroStrategy Identity provider metadata file. The metadata includes a configuration .xml file that AWS uses to automatically configure the settings for connecting to MicroStrategy Identity. Note the location on your computer where the metadata .xml file is saved.
9. In a new browser window or tab, log in to your AWS Management Console with an administrative account.
10. Open the AWS Identity and Access Management section, then open the Identity Providers tab. Create a new Identity Provider with the following values:
    • Provider type: Select the SAML option
    • Provider name: Type a name for the MicroStrategy Identity provider.
    • Metadata document: Upload the MicroStrategy Identity provider metadata that you downloaded from MicroStrategy Identity Manager.
11. From the AWS Identity and Access Management section, open the Roles tab. Create a new Role with the following values:
    • Role name: Type a role name.
    • Role type: Select Role for Identity Provider Access, then select Grant Web Single Sign-On (Web SSO) access to SAML providers
    • SAML provider: Select the MicroStrategy Identity provider that you created.
    • Attach policy: Select the policy that controls what access permissions you want to grant to the users who log into the AWS Management Console with MicroStrategy Identity. See your Amazon documentation for more information.
12. Locate the Amazon Resource Names (ARNs) for the Role and Identity Provider that you created. To do this, from the Identity and Access Management section of your AWS Management Console, do the following:
    • In the Roles tab, open the role that you created. Note the value for Role ARN.
    • In the Identity Providers tab, open the MicroStrategy Identity provider that you created. Note the value for Provider ARN.
13. In MicroStrategy Identity Manager, click Next.
14. In the SAML attribute consuming service, locate the attribute that has the SAML Attribute Name of https://aws.amazon.com/SAML/Attributes/Role. In the Sample/Value field for this attribute, type the ARNs for the Role and the Identity Provider, separated by a comma. Type the values in the format RoleARN,ProviderARN.
15. Click Next, The URL for the login page to your AWS Management Console is displayed. You can distribute this URL to users in your network.
16. Click Done.
    AWS users can log in to the AWS Management Console by scanning a QR code using the MicroStrategy Badge app on their smartphone.

To Determine the MicroStrategy Idenity Login Page URL for Amazon Web Services

Amazon Web Services (AWS) users can log in to the AWS Management Console by navigating to the MicroStrategy Identity single sign-on web portal, or by navigating to the Identity login page URL for AWS.

1. Log into MicroStrategy Identity Manager.
2. Click Logical Gateways.
3. Under Web Application Login, click Edit next to the AWS site whose login page URL you want to determine.
4. Click Configure Information for Your App. The URL for the login page to your AWS Management Console is displayed. You can distribute this URL to users in your network.

Related Topics

Signing in to MicroStrategy Identity-Enabled Web Applications from a Centralized Website

Categorizing MicroStrategy Badge Resources

Logical Gateways