Enable federation to Amazon QuickSight accounts with Ping One

Amazon QuickSight is a scalable, serverless, embeddable, machine learning (ML)-powered business intelligence (BI) service built for the cloud that supports identity federation in both Standard and Enterprise editions. Organizations are working towards centralizing their identity and access strategy across all of their applications, including on-premises, third-party, and applications on AWS. Many organizations use Ping One to control and manage user authentication and authorization centrally. If your organization uses Ping One for cloud applications, you can enable federation to all of your QuickSight accounts without needing to create and manage users in QuickSight. This authorizes users to access QuickSight assets—analyses, dashboards, folders, and datasets—through centrally managed Ping One.

In this post, we go through the steps to configure federated single sign-on (SSO) between a Ping One instance and a QuickSight account. We demonstrate registering an SSO application in Ping One, creating groups, and mapping to an AWS Identity and Access Management (IAM) role that translates to QuickSight user license types (admin, author, and reader). These QuickSight roles represent three different personas supported in QuickSight. Administrators can publish the QuickSight app in Ping One to enable users to perform SSO to QuickSight using their Ping credentials.

Prerequisites

To complete this walkthrough, you must have the following prerequisites:

A Ping One subscription
One or more QuickSight account subscriptions

Solution overview

The walkthrough includes the following steps:

Create groups in Ping One for each of the QuickSight user license types.
Register an AWS application in Ping One.
Add Ping One as your SAML identity provider (IdP) in AWS.
Configure an IAM policy.
Configure an IAM role.
Configure your AWS application in Ping One.
Test the application from Ping One.

Create groups in Ping One for each of the QuickSight roles

To create groups in Ping One, complete the following steps:

Sign in to the Ping One portal using an administrator account.
Under Identities, choose Groups.
Choose the plus sign to add a group.
For Group Name, enter QuickSightReaders.
Choose Save.
Repeat these steps to create the groups QuickSightAdmins and QuickSightAuthors.

Register an AWS application in Ping One

To configure the integration of an AWS application in Ping One, you need to add AWS to your list of managed software as a service (SaaS) apps.

Sign in to the Ping One portal using an administrator account.
Under Connections, choose Application Catalog.
In the search box, enter amazon web services.
Choose Amazon Web Services – AWS from the results to add the application.
For Name, enter Amazon QuickSight.
Choose Next.
Under Map Attributes, there should be four attributes.
Delete the attribute related to SessionDuration.
Choose Username as the value for all the remaining attributes for now.
We update these values in later steps.
Choose Next.
In the Select Groups section, add the QuickSightAdmins, QuickSightAuthors, and QuickSightReaders groups you created.
Choose Save.
After the application is created, choose the application again and download the federation metadata XML.

You use this in the next step.

Add Ping One as your SAML IdP in AWS

To configure Ping One as your SAML IdP, complete the following steps:

Open a new tab in your browser.
Sign in to the IAM console in your AWS account with admin permissions.
On the IAM console, under Access Management in the navigation pane, choose Identity providers.
Choose Add provider.
For Provider name, enter PingOne.
Choose file to upload the metadata document you downloaded earlier.
Choose Add provider.
In the banner message that appears, choose View provider.
Copy the IdP ARN to use in a later step.

Configure an IAM policy

In this step, you create an IAM policy to map three different roles with permissions in QuickSight.

Use the following steps to set up QuickSightUserCreationPolicy. This policy grants privileges in QuickSight to the federated user based on the assigned groups in Ping One.

On the IAM console, choose Policies.
Choose Create policy.

On the JSON tab, replace the existing text with the following code:

{
   "Version": "2012-10-17",
    "Statement": [ 
         {  
            "Sid": "VisualEditor0", 
             "Effect": "Allow", 
             "Action": "quicksight:CreateAdmin", 
             "Resource": "*", 
             "Condition": { 
                 "StringEquals": { 
                     "aws:PrincipalTag/user-role": "QuickSightAdmins" 
 
                } 
             } 
         }, 
         { 
             "Sid": "VisualEditor1", 
             "Effect": "Allow", 
             "Action": "quicksight:CreateUser", 
             "Resource": "*", 
             "Condition": { 
                 "StringEquals": { 
                     "aws:PrincipalTag/user-role": "QuickSightAuthors" 
                 } 
             } 
         }, 
         { 
             "Sid": "VisualEditor2", 
             "Effect": "Allow", 
             "Action": "quicksight:CreateReader", 
             "Resource": "*", 
             "Condition": { 
                 "StringEquals": { 
                     "aws:PrincipalTag/user-role": "QuickSightReaders" 
                 } 
             } 
         } 
     ] 
 }

Choose Review policy.
For Name, enter QuickSightUserCreationPolicy.
Choose Create policy.

Configure an IAM role

Next, create the role that Ping One users assume when federating into QuickSight. Use the following steps to set up the federated role:

On the IAM console, choose Roles.
Choose Create role.
For Trusted entity type, select SAML 2.0 federation.
For SAML 2.0-based provider, choose the provider you created earlier (PingOne).
Select Allow programmatic and AWS Management Console access.
For Attribute, choose SAML:aud.
For Value, enter https://signin.aws.amazon.com/saml.
Choose Next.
Under Permissions policies, select the QuickSightUserCreationPolicy IAM policy you created in the previous step.
Choose Next.
For Role name, enter QSPingOneFederationRole.
Choose Create role.
On the IAM console, in the navigation pane, choose Roles.
Choose the QSPingOneFederationRole role you created to open the role’s properties.
Copy the role ARN to use in later steps.
On the Trust relationships tab, under Trusted entities, verify that the IdP you created is listed.
Under Condition in the policy code, verify that SAML:aud with a value of https://signin.aws.amazon.com/saml is present.
Choose Edit trust policy to add an additional condition.

Under Condition, add the following code:

"StringLike": {
"aws:RequestTag/user-role": "*"
}

Under Action, add the following code:
```
  "sts:TagSession"
```
Choose Update policy to save changes.

Configure an AWS application in Ping One

To configure your AWS application, complete the following steps:

Sign in to the Ping One portal using a Ping One administrator account.
Under Connections, choose Application.
Choose the Amazon QuickSight application you created earlier.
On the Profile tab, choose Enable Advanced Configuration.
Choose Enable in the pop-up window.
On the Configuration tab, choose the pencil icon to edit the configuration.
Under SIGNING KEY, select Sign Assertion & Response.
Under SLO BINDING, for Assertion Validity Duration In Seconds, enter a duration, such as 900.
For Target Application URL, enter https://quicksight.aws.amazon.com/.
Choose Save.
On the Attribute Mappings tab, you now add or update the attributes as in the following table.

Attribute Name	Value
`saml_subject`	Username
`https://aws.amazon.com/SAML/Attributes/RoleSessionName`	Username
`https://aws.amazon.com/SAML/Attributes/Role`	‘arn:aws:iam::xxxxxxxxxx:role/QSPingOneFederationRole, arn:aws:iam::xxxxxxxxxx:saml-provider/PingOne’
`https://aws.amazon.com/SAML/Attributes/PrincipalTag:user-role`	user.memberOfGroupNames[0]

Enter https://aws.amazon.com/SAML/Attributes/PrincipalTag:user-role for the attribute name and use the corresponding value from the table for the expression.
Choose Save.

If you have more than one QuickSight user role (for this post, QuickSightAdmins, QuicksightAuthors, and QuickSightReaders), you can add all the appropriate role names as follows:

#data.containsAny(user.memberOfGroupNames,{'QuickSightAdmins'})? 'QuickSightAdmins' : 

#data.containsAny(user.memberOfGroupNames,{'QuickSightAuthorss'}) ? 'QuickSightAuthors' : 

#data.containsAny(user.memberOfGroupNames,{'QuickSightReaders'}) ?'QuickSightReaders' : null

To edit the role attribute, choose the gear icon next to the role.
Populate the corresponding expression from the table and choose Save.

The format of the expression is the role ARN (copied in the role creation step) followed by the IdP ARN (copied in the IdP creation step) separated by a comma.

Test the application

In this section, you test your Ping One SSO configuration by using a Microsoft application.

In the Ping One portal, under Identities, choose Groups.
Choose a group and choose Add Users Individually.
From the list of users, add the appropriate users to the group by choosing the plus sign.
Choose Save.
To test the connectivity, under Environment, choose Properties, then copy the URL under APPLICATION PORTAL URL.
Browse to the URL in a private browsing window.
Enter your user credentials and choose Sign On.
Upon a successful sign-in, you’re redirected to the All Applications page with a new application called Amazon QuickSight.
Choose the Amazon QuickSight application to be redirected to the QuickSight console.

Note in the following screenshot that the user name at the top of the page shows as the Ping One federated user.

Summary

This post provided step-by-step instructions to configure federated SSO between Ping One and the QuickSight console. We also discussed how to create policies and roles in IAM and map groups in Ping One to IAM roles for secure access to the QuickSight console.

For additional discussions and help getting answers to your questions, check out the QuickSight Community.

About the authors

Srikanth Baheti is a Specialized World Wide Sr. Solution Architect for Amazon QuickSight. He started his career as a consultant and worked for multiple private and government organizations. Later he worked for PerkinElmer Health and Sciences & eResearch Technology Inc, where he was responsible for designing and developing high traffic web applications, highly scalable and maintainable data pipelines for reporting platforms using AWS services and Serverless computing.

Raji Sivasubramaniam is a Sr. Solutions Architect at AWS, focusing on Analytics. Raji is specialized in architecting end-to-end Enterprise Data Management, Business Intelligence and Analytics solutions for Fortune 500 and Fortune 100 companies across the globe. She has in-depth experience in integrated healthcare data and analytics with wide variety of healthcare datasets including managed market, physician targeting and patient analytics.

Raj Jayaraman is a Senior Specialist Solutions Architect for Amazon QuickSight. Raj focuses on helping customers develop sample dashboards, embed analytics and adopt BI design patterns and best practices.

AWS Business Intelligence Blog