Integrate AWS SSO (SAML 2.0)

Overview

QueryPie supports integrating users from AWS IAM Identity Center with multiple cloud applications via SAML 2.0. You can synchronize users, grant access, and apply policies.

If you configure SAML under Identity Providers Integration with Type = SAML, periodic synchronization by schedule is not supported.

Add QueryPie as an application in AWS IAM Identity Center

Go to AWS IAM Identity Center .
Open the Applications menu in the left panel.
Click Add application at the top right.
Select Add a custom SAML 2.0 application and click Next.
In Application configuration > Display name, enter QueryPie.
In Application properties > Application start URL, enter your QueryPie domain as below.
1. Application Start URL: https://{querypie_host}
Enter the following in Application metadata:
1. Application ACS URL: https://{querypie_host}/saml/sp/acs
2. Application SAML audience: https://{querypie_host}/saml/sp/metadata
Click Submit to save.

Attribute mappings for QueryPie integration

In the application page, open Actions > Edit attribute mappings at the top right.
Refer to the screenshot and enter values as follows.

Application user attribute	Value or user attribute in IAM Identity Center	Format
Subject	$`{user:email}`	emailAddress
firstName	$`{user:givenName}`	basic
lastName	$`{user:familyName}`	basic
loginId	$`{user:email}`	basic
email	$`{user:email}`	basic

Click Save changes.

Configure AWS IAM Identity Center integration in QueryPie

Administrator > General > User Management > Authentication

Go to Administrator > Admin > General > System > Integration, and under Authentication select Identity Provider.
Click Add and register the IdP with Type = SAML.
- Name : Enter a suitable name for identification.
- Type : Select SAML.
- Identity Provider Metadata : In AWS, go to Application > Actions > Edit configuration and download the IAM Identity Center SAML metadata file. Paste the SAML metadata XML content here.
Click Save.

Click Login with SAML on the login page to authenticate with AWS and sign in to QueryPie.