SAML:EduPersonOrgDN

https://iam.uconn.edu/supported-ldap-attributes/

Enabling SAML 2.0 federated users to access the AWS Management Console: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_enable-console-saml.html

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": {"Federated": "arn:aws:iam::account-id:saml-provider/ExampleOrgSSOProvider"},
    "Action": "sts:AssumeRoleWithSAML",
    "Condition": {"StringEquals": {
      "saml:edupersonorgdn": "ExampleOrg",
      "saml:aud": "https://signin.aws.amazon.com/saml"
    }}
  }]
}

Related

• AssumeRolePolicyDocument
• http://doc.isilon.com/ECS/3.5/DataAccessGuide/GUID-BA49B495-6E0A-445B-A93E-EDF3DECB4B40.html

SAML:aud https://signin.aws.amazon.com/saml
SAML:iss
SAML:sub
SAML:sub_type

See also

• SAML, IdP, AWS SAML, AWS IAM, AWS SAML endpoint, SAML:EduPersonOrgDN, SAML Role Attribute, assume-role-with-saml
• SAML, IdP, Assertion, Attribute, SCIM, Amazon Cognito, OpenID Connect (OIDC), SAML response, SAML:EduPersonOrgDN, Assertion Consumer Service (ACS), SAML examples, Entity ID, Name ID, SAMLResponse, saml-provider, saml2aws, aws_iam_saml_provider, Google Cloud Identity, Authentik, Audience (aud), claims, scope, /protocol/saml/descriptor, SAML 2.0