^/share/res ⇒ unprotect^/share/res => unprotect^/share/page/dologout ⇒ logout_app_sso^/share/page/dologout => logout_app_ssoSAML as the provider typeSAML / Saml 2.0 federationou: root
arn:aws:iam::account-number:role/role-name1,arn:aws:iam::account-number:saml-provider/provider-name. The parts you need to change are account-number, role-name1 and provier-name. The last two will be the provider name and role names you just set up in AWS.arn:aws:iam::account-number:role/role-name1,arn:aws:iam::account-number:saml-provider/provider-name. The parts you need to change are account-number, role-name1 and provier-name. The last two will be the provider name and role names you just set up in AWS.aws_eu_role → $ou =~ sysadmin ? “arn:aws…” : “arn:…”aws_eu_role -> $ou =~ sysadmin ? “arn:aws...” : “arn:...”z_aws_roles → join(“; ”, $role_name1, $role_name2, …)z_aws_roles -> join(“; ”, $role_name1, $role_name2, ...)SAML service providers, then Add SAML SP.ClickExported attributeson the left, thenAdd attributetwice to add two attributes. The first field is the name of a variable set in the user's session:
_whatToTrace → https://aws.amazon.com/SAML/Attributes/RoleSessionName (leave the rest)_whatToTrace -> https://aws.amazon.com/SAML/Attributes/RoleSessionName (leave the rest)z_aws_roles (the macro name you defined above) → https://aws.amazon.com/SAML/Attributes/Role (leave the rest)z_aws_roles (the macro name you defined above) -> https://aws.amazon.com/SAML/Attributes/Role (leave the rest)New application. 
- - -