- \n
- A 黑料海角91入口 administrator account.<\/li>\n\n\n\n
- 黑料海角91入口 SSO Package or higher or SSO add-on feature.<\/li>\n\n\n\n
- AWS Admin account (AWS root user)<\/li>\n\n\n\n
- AWS organization<\/li>\n\n\n\n
- An Amazon VPC with an EC2 instance is required.\n
- \n
- See Create a VPC<\/a>.<\/li>\n\n\n\n
- Learn about Launching an EC2 instance<\/a>. In the instance Security Group allow ICMP traffic from the VPC CIDR range \u2013 this is needed for testing.<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- You need a private certificate imported into AWS Certificate Manager (ACM)<\/a>.\n
- \n
- See Generating and importing a certificate to ACM<\/a><\/li>\n<\/ul>\n<\/li>\n\n\n\n
- You need a Windows or Mac system running the latest AWS Client VPN software.\n
- \n
- You can download the software here<\/a>.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\n
Creating a new 黑料海角91入口 Application Integration<\/strong><\/h2>\n\n\n\n
- \n
- Log in to the 黑料海角91入口 Admin Portal<\/a>.<\/li>\n\n\n\n
- Go to\u00a0USER AUTHENTICATION\u00a0<\/strong>>\u00a0SSO<\/strong> Applications<\/strong>.<\/li>\n\n\n\n
- Click + Add New Application<\/strong>.<\/li>\n\n\n\n
- Type the name of the application in the Search <\/strong>field and select it.<\/li>\n\n\n\n
- Click Next<\/strong>.<\/li>\n\n\n\n
- In the Display Label<\/strong>, type your name for the application. Optionally, you can enter a Description<\/strong>, adjust the User Portal Image and choose to hide or Show in User Portal<\/strong>.<\/li>\n<\/ol>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/note-icon.png\")
<\/p><\/div>Note:<\/strong> \nIf this is a Bookmark Application, enter your sign-in URL in the Bookmark URL<\/strong> field.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
- \n
- Optionally, expand Advanced Settings<\/strong> to specify a value for the SSO IdP URL<\/strong>. If no value is entered, it will default to https:\/\/sso.jumpcloud.com\/saml2\/<applicationname><\/kbd>.<\/li>\n<\/ol>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/warning-icon.png\")
<\/p><\/div>Warning:<\/strong> \nThe SSO IdP URL<\/strong> is not editable after the application is created. You will have to delete and recreate the connector if you need to edit this field at a later time.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
- \n
- Click Save Application<\/strong>.<\/li>\n\n\n\n
- If successful, click:\n
- \n
- Configure Application<\/strong> and go to the next section <\/li>\n\n\n\n
- Close<\/strong> to configure your new application at a later time <\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n
Configuring the SSO Integration<\/strong><\/h2>\n\n\n\n
To configure 黑料海角91入口 <\/strong><\/h3>\n\n\n\n
- \n
- Create a new application<\/a> or select it from the Configured Application<\/strong>s list.<\/li>\n\n\n\n
- Select the SSO <\/strong>tab.<\/li>\n\n\n\n
- The SP Entity ID<\/strong> should be urn:amazon:webservices:clientvpn.<\/li>\n\n\n\n
- The ACS URL<\/strong> should be http:\/\/127.0.0.1:35001<\/kbd>.<\/li>\n\n\n\n
- In the IdP URL<\/strong>, either leave the default value or enter a plaintext string unique to this connector.<\/li>\n\n\n\n
- Click save<\/strong>.<\/li>\n<\/ol>\n\n\n\n
Download the 黑料海角91入口 metadata<\/strong> file<\/strong><\/h4>\n\n\n\n
- \n
- Find your application in the Configured Applications<\/strong> list and click anywhere in the row to reopen its configuration window.<\/li>\n\n\n\n
- Select the SSO <\/strong>tab and click Export Metadata<\/strong>.<\/li>\n\n\n\n
- The 黑料海角91入口-<applicationname>-metadata.xml<\/strong> will be exported to your local Downloads <\/strong>folder.<\/li>\n<\/ol>\n\n\n\n
![](\"\/wp-content\/themes\/jumpcloud\/assets\/images\/gutenberg-blocks\/tip-icon.png\")
<\/p><\/div>Tip:<\/strong> \nMetadata can also be downloaded from the Configured Applications<\/strong> list. Search for and select the application in the list and then click Export Metadata<\/strong> in the top right corner of the window.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
To configure AWS<\/strong><\/h3>\n\n\n\n
Configure 黑料海角91入口 as an AWS Identity Provider<\/strong><\/h4>\n\n\n\n
- \n
- Log in to the Amazon Web Services console for your organization as an administrator.<\/li>\n\n\n\n
- In the main console, go to All Services<\/strong>, under Security, Identity & Compliance<\/strong> select IAM.<\/strong><\/li>\n\n\n\n
- On the left hand side nav, select Identity Providers.<\/strong><\/li>\n\n\n\n
- Select Create Provider.<\/strong><\/li>\n\n\n\n
- For Provider Type<\/strong>, select SAML.<\/strong><\/li>\n\n\n\n
- For Provider Name<\/strong>, enter 黑料海角91入口. If another name is chosen, this string will need to replace 黑料海角91入口 in the role attribute value in the 黑料海角91入口 configuration.<\/li>\n\n\n\n
- Select Choose File<\/strong>, then upload the metadata file.<\/li>\n<\/ol>\n\n\n\n
<\/p><\/div>Note:<\/strong> \nBy default, the 黑料海角91入口 metadata file is saved as 黑料海角91入口-aws-metadata.xml.<\/p>\n <\/div><\/div><\/div><\/div>\n\n\n\n
- \n
- Select Next Step.<\/strong><\/li>\n\n\n\n
- On the next screen, select Create.<\/strong><\/li>\n<\/ol>\n\n\n\n
Create an AWS Client VPN Endpoint<\/strong><\/h4>\n\n\n\n
After you set up 黑料海角91入口 as the identity provider in AWS, create an AWS Client VPN Endpoint.<\/p>\n\n\n\n
- \n
- Log in to the Amazon Web Services console for your organization as an administrator.<\/li>\n\n\n\n
- In the Find Services<\/strong> search bar, enter VPC<\/strong>, then select VPC from the results. <\/li>\n\n\n\n
- One the left hand side nav, select Client VPN Endpoints<\/strong> under Virtual Private Network<\/strong> (VPN)<\/strong>. <\/li>\n\n\n\n
- Click Create Client VPN Endpoint<\/strong>. <\/li>\n\n\n\n
- Enter information for Name Tag<\/strong> and Description<\/strong>.<\/li>\n\n\n\n
- To allocate an IP range for your remote users, enter the IP range In Client IPv4 CIDR<\/strong>. <\/li>\n\n\n\n
- For Server Certificate ARN, select the certificate you created. See Prerequisites<\/a>. <\/strong><\/li>\n\n\n\n
- For Authentication Options<\/strong>, select Use user-based authentication<\/strong>, then Federated authentication<\/strong>. <\/li>\n\n\n\n
- For SAML provider ARN<\/strong>, select 黑料海角91入口, the identity provider you created in Configure 黑料海角91入口 as an AWS Identity Provider<\/a>.<\/strong><\/li>\n\n\n\n
- To log connections in Amazon CloudWatch, select Yes<\/strong> for Do you want to log the details on client connections?<\/strong>. If you don\u2019t want to log connections, select No<\/strong>. <\/li>\n\n\n\n
- To ensure that only the traffic to the VCP IP range is forwarded using the VPN, select the check box for Enable split-tunnel<\/strong>. <\/li>\n\n\n\n
- Click Create Client VPN Endpoint<\/strong>. <\/li>\n<\/ol>\n\n\n\n
Configure AWS Client VPN Endpoint Options<\/strong><\/h4>\n\n\n\n
Finish configuring your AWS Client VPN endpoint by associating it with a target VPC and setting up SAML group-specific authorization. <\/p>\n\n\n\n
To associate a Client VPN with a Target VPC<\/strong><\/h5>\n\n\n\n
- \n
- Log in to the Amazon Web Services console for your organization as an administrator.<\/li>\n\n\n\n
- In the Find Services<\/strong> search bar, enter VPC<\/strong>, then select VPC from the results. <\/li>\n\n\n\n
- One the left hand side nav, select Client VPN Endpoints<\/strong> under Virtual Private Network<\/strong> (VPN)<\/strong>. <\/li>\n\n\n\n
- Select the Client VPN endpoint created in Create an AWS Client VPN Endpoint<\/a>. It\u2019s in a Pending state. <\/strong><\/li>\n\n\n\n
- Select Associations,<\/strong> then click Associate<\/strong>.<\/li>\n\n\n\n
- From the drop-down, select the target VPC and subnet you want to associate your endpoint with.<\/li>\n\n\n\n
- (Optional) Repeat the previous steps to associate your Client VPN endpoint to another subnet for high availability.<\/li>\n<\/ol>\n\n\n\n
To set up SAML group-specific authorization<\/strong><\/h5>\n\n\n\n
- \n
- Select Authorization<\/strong> in the Client VPN options, then click Authorize Ingress<\/strong>.<\/li>\n\n\n\n
- For Destination network to enable<\/strong>, enter the IP address of your EC2 instance created in the prerequisites.<\/li>\n\n\n\n
- For Grant access to<\/strong>, select Allow access to users in a specific access group<\/strong>.<\/li>\n\n\n\n
- For Access group ID field,<\/strong> enter the name of the group you want to allow access to the EC2 instance. <\/li>\n\n\n\n
- Optionally, provide a description. <\/li>\n\n\n\n
- Click Add authorization rule<\/strong>.<\/li>\n<\/ol>\n\n\n\n
<\/a>Testing the AWS VPN Client Connection<\/strong><\/h3>\n\n\n\n
To verify you configured your AWS VPN Client correctly, test connecting to the AWS VPN client. <\/p>\n\n\n\n
To test connecting to the AWS VPN client<\/strong><\/h4>\n\n\n\n
- \n
- Log in to the Amazon Web Services console for your organization as an administrator.<\/li>\n\n\n\n
- In the Find Services<\/strong> search bar, enter VPC<\/strong>, then select VPC from the results. <\/li>\n\n\n\n
- One the left hand side nav, select Client VPN Endpoints<\/strong> under Virtual Private Network<\/strong> (VPN)<\/strong>. <\/li>\n\n\n\n
- Select the Client VPN endpoint you configured in Configure AWS Client VPN Endpoint Options<\/a>. It\u2019s in an Active state. <\/strong><\/li>\n\n\n\n
- To download the configuration profile to your desktop, click Download Client Configuration<\/strong>.<\/li>\n\n\n\n
- Open the AWS Client VPN desktop app on your system. See Prerequisites<\/a>.<\/strong><\/li>\n\n\n\n
- In the menu, go to File<\/strong> > Manage Profiles<\/strong>.<\/li>\n\n\n\n
- Click Add Profile<\/strong> and select the configuration profile you downloaded in step 2. Give it a display name. <\/li>\n\n\n\n
- You see the profile in the AWS Client VPN list. Select it, then click Connect<\/strong>.<\/li>\n<\/ol>\n\n\n\n
Authorizing User SSO Access<\/strong><\/h2>\n\n\n\n
Users are implicitly denied access to applications. After you connect an application to 黑料海角91入口, you need to authorize user access to that application. You can authorize user access from the Application Configuration<\/strong> panel or from the Groups Configuration<\/strong> panel. <\/p>\n\n\n\n
To authorize user access from the Application Configuration panel<\/strong><\/h3>\n\n\n\n
- \n
- Log in to the <\/a>黑料海角91入口 Admin Portal<\/a>.<\/li>\n\n\n\n
- Go to USER AUTHENTICATION > SSO<\/strong> Applications<\/strong>, then select the application to which you want to authorize user access.<\/li>\n\n\n\n
- Select the User Groups<\/strong> tab. If you need to create a new group of users, see Get Started: User Groups<\/a>.<\/li>\n\n\n\n
- Select the check box next to the group of users you want to give access.<\/li>\n\n\n\n
- Click save<\/strong>. <\/li>\n<\/ol>\n\n\n\n
- Go to USER AUTHENTICATION > SSO<\/strong> Applications<\/strong>, then select the application to which you want to authorize user access.<\/li>\n\n\n\n
- One the left hand side nav, select Client VPN Endpoints<\/strong> under Virtual Private Network<\/strong> (VPN)<\/strong>. <\/li>\n\n\n\n
- For Destination network to enable<\/strong>, enter the IP address of your EC2 instance created in the prerequisites.<\/li>\n\n\n\n
- One the left hand side nav, select Client VPN Endpoints<\/strong> under Virtual Private Network<\/strong> (VPN)<\/strong>. <\/li>\n\n\n\n
- One the left hand side nav, select Client VPN Endpoints<\/strong> under Virtual Private Network<\/strong> (VPN)<\/strong>. <\/li>\n\n\n\n
- On the next screen, select Create.<\/strong><\/li>\n<\/ol>\n\n\n\n
- On the left hand side nav, select Identity Providers.<\/strong><\/li>\n\n\n\n
- Select the SSO <\/strong>tab and click Export Metadata<\/strong>.<\/li>\n\n\n\n
- Select the SSO <\/strong>tab.<\/li>\n\n\n\n
- Close<\/strong> to configure your new application at a later time <\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n
- If successful, click:\n
- Click Save Application<\/strong>.<\/li>\n\n\n\n
- Go to\u00a0USER AUTHENTICATION\u00a0<\/strong>>\u00a0SSO<\/strong> Applications<\/strong>.<\/li>\n\n\n\n
- Log in to the 黑料海角91入口 Admin Portal<\/a>.<\/li>\n\n\n\n
- You need a Windows or Mac system running the latest AWS Client VPN software.\n
- Learn about Launching an EC2 instance<\/a>. In the instance Security Group allow ICMP traffic from the VPC CIDR range \u2013 this is needed for testing.<\/li>\n<\/ul>\n<\/li>\n\n\n\n
- See Create a VPC<\/a>.<\/li>\n\n\n\n