Creates an IAM resource that describes an identity provider (IdP) that supports SAML 2.0.
The SAML provider resource that you create with this operation can be used as a principal in an IAM role's trust policy. Such a policy can enable federated users who sign in using the SAML IdP to assume the role. You can create an IAM role that supports Web-based single sign-on (SSO) to the Amazon Web Services Management Console or one that supports API access to Amazon Web Services.
When you create the SAML provider resource, you upload a SAML metadata document that you get from your IdP. That document includes the issuer's name, expiration information, and keys that can be used to validate the SAML authentication response (assertions) that the IdP sends. You must generate the metadata document using the identity management software that is used as your organization's IdP.
This operation requires Signature Version 4.
For more information, see Enabling SAML 2.0 federated users to access the Amazon Web Services Management Console and About SAML 2.0-based federation in the IAM User Guide.
Parameters:
-
saml_metadata_document
(SAMLMetadataDocumentType)
–
An XML document generated by an identity provider (IdP) that supports SAML 2.0. The document includes the issuer's name, expiration information, and keys that can be used to validate the SAML authentication response (assertions) that are received from the IdP. You must generate the metadata document using the identity management software that is used as your organization's IdP.
For more information, see About SAML 2.0-based federation in the IAM User Guide
-
name
(SAMLProviderNameType)
–
The name of the provider to create.
This parameter allows (through its regex pattern) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-
-
tags
(Optional[tagListType], default:
None
)
–
A list of tags that you want to attach to the new IAM SAML provider. Each tag consists of a key name and an associated value. For more information about tagging, see Tagging IAM resources in the IAM User Guide.
If any one of the tags is invalid or if you exceed the allowed maximum number of tags, then the entire request fails and the resource is not created.
-
assertion_encryption_mode
(Optional[assertionEncryptionModeType], default:
None
)
–
Specifies the encryption setting for the SAML provider.
-
add_private_key
(Optional[privateKeyType], default:
None
)
–
The private key generated from your external identity provider. The private key must be a .pem file that uses AES-GCM or AES-CBC encryption algorithm to decrypt SAML assertions.
Raises:
-
ConcurrentModificationException
–
The request was rejected because multiple requests to change this object were submitted simultaneously. Wait a few minutes and submit your request again.
-
EntityAlreadyExistsException
–
The request was rejected because it attempted to create a resource that already exists.
-
InvalidInputException
–
The request was rejected because an invalid or out-of-range value was supplied for an input parameter.
-
LimitExceededException
–
The request was rejected because it attempted to create resources beyond the current Amazon Web Services account limits. The error message describes the limit exceeded.
-
ServiceFailureException
–
The request processing has failed because of an unknown error, exception or failure.
-
UnknownServiceError
–
The service returned an error code this client does not model.
Source code in docs_src/capo_iam/_services/iam.py
| def create_saml_provider(
self,
saml_metadata_document: "capo_iam.types.saml_metadata_document_type.SAMLMetadataDocumentType",
name: "capo_iam.types.saml_provider_name_type.SAMLProviderNameType",
*,
config_overrides: Optional[IAMClientConfig] = None,
tags: Optional["capo_iam.types.tag_list_type.tagListType"] = None,
assertion_encryption_mode: Optional[
"capo_iam.types.assertion_encryption_mode_type.assertionEncryptionModeType"
] = None,
add_private_key: Optional[
"capo_iam.types.private_key_type.privateKeyType"
] = None,
) -> "capo_iam.types.create_saml_provider_response.CreateSAMLProviderResponse":
"""<p>Creates an IAM resource that describes an identity provider (IdP) that supports SAML 2.0.</p> <p>The SAML provider resource that you create with this operation can be used as a principal in an IAM role's trust policy. Such a policy can enable federated users who sign in using the SAML IdP to assume the role. You can create an IAM role that supports Web-based single sign-on (SSO) to the Amazon Web Services Management Console or one that supports API access to Amazon Web Services.</p> <p>When you create the SAML provider resource, you upload a SAML metadata document that you get from your IdP. That document includes the issuer's name, expiration information, and keys that can be used to validate the SAML authentication response (assertions) that the IdP sends. You must generate the metadata document using the identity management software that is used as your organization's IdP.</p> <note> <p> This operation requires <a href="https://docs.aws.amazon.com/general/latest/gr/signature-version-4.html">Signature Version 4</a>.</p> </note> <p> For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_enable-console-saml.html">Enabling SAML 2.0 federated users to access the Amazon Web Services Management Console</a> and <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_saml.html">About SAML 2.0-based federation</a> in the <i>IAM User Guide</i>.</p>
Args:
saml_metadata_document: <p>An XML document generated by an identity provider (IdP) that supports SAML 2.0. The document includes the issuer's name, expiration information, and keys that can be used to validate the SAML authentication response (assertions) that are received from the IdP. You must generate the metadata document using the identity management software that is used as your organization's IdP.</p> <p>For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_saml.html">About SAML 2.0-based federation</a> in the <i>IAM User Guide</i> </p>
name: <p>The name of the provider to create.</p> <p>This parameter allows (through its <a href="http://wikipedia.org/wiki/regex">regex pattern</a>) a string of characters consisting of upper and lowercase alphanumeric characters with no spaces. You can also include any of the following characters: _+=,.@-</p>
tags: <p>A list of tags that you want to attach to the new IAM SAML provider. Each tag consists of a key name and an associated value. For more information about tagging, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_tags.html">Tagging IAM resources</a> in the <i>IAM User Guide</i>.</p> <note> <p>If any one of the tags is invalid or if you exceed the allowed maximum number of tags, then the entire request fails and the resource is not created.</p> </note>
assertion_encryption_mode: <p>Specifies the encryption setting for the SAML provider.</p>
add_private_key: <p>The private key generated from your external identity provider. The private key must be a .pem file that uses AES-GCM or AES-CBC encryption algorithm to decrypt SAML assertions.</p>
Raises:
capo_iam.errors.concurrent_modification_exception.ConcurrentModificationException: <p>The request was rejected because multiple requests to change this object were submitted simultaneously. Wait a few minutes and submit your request again.</p>
capo_iam.errors.entity_already_exists_exception.EntityAlreadyExistsException: <p>The request was rejected because it attempted to create a resource that already exists.</p>
capo_iam.errors.invalid_input_exception.InvalidInputException: <p>The request was rejected because an invalid or out-of-range value was supplied for an input parameter.</p>
capo_iam.errors.limit_exceeded_exception.LimitExceededException: <p>The request was rejected because it attempted to create resources beyond the current Amazon Web Services account limits. The error message describes the limit exceeded.</p>
capo_iam.errors.service_failure_exception.ServiceFailureException: <p>The request processing has failed because of an unknown error, exception or failure.</p>
capo_iam.errors.UnknownServiceError: The service returned an error code this client does not model.
"""
def _handler(
req: "OperationRequest[capo_iam.types.create_saml_provider_request.CreateSAMLProviderRequest]",
) -> OperationResponse[
"capo_iam.types.create_saml_provider_response.CreateSAMLProviderResponse"
]:
import capo_iam._operations.aws_identity_management_v20100508.create_saml_provider
output, http_response = (
capo_iam._operations.aws_identity_management_v20100508.create_saml_provider.create_saml_provider(
req.options, req.input
)
)
return OperationResponse(output=output, response=http_response)
def _redact_input(
input_: "capo_iam.types.create_saml_provider_request.CreateSAMLProviderRequest",
) -> dict[str, Any]:
import capo_iam.types.create_saml_provider_request
return capo_iam.types.create_saml_provider_request.redact_sensitive(input_)
interceptors_, options_ = self.operation_options(
config_overrides,
OperationLogging("CreateSAMLProvider", redact_input=_redact_input),
)
input_: capo_iam.types.create_saml_provider_request.CreateSAMLProviderRequest = {
"saml_metadata_document": saml_metadata_document,
"name": name,
}
if tags is not None:
input_["tags"] = tags
if assertion_encryption_mode is not None:
input_["assertion_encryption_mode"] = assertion_encryption_mode
if add_private_key is not None:
input_["add_private_key"] = add_private_key
response = execute_pipeline(
OperationRequest(input=input_, options=options_),
handler=_handler,
interceptors=list(interceptors_),
)
response.response.close()
return response.output
|