I'm working on a website deployed to AWS using S3 as storage and CloudFront CDN. It's a static website with a single html file using JS to display the content based on the querystring. The owner is an enterprise that already has established SSO within their organization, they use IBM Tivoli as the IdP. The part I'm missing is how does the request for authorization get generated?

I've read through these:

http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers.html http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_saml.html http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-idp.html http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-idp_saml.html http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_saml.html http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_saml_relying-party.html

Many of these are close but just off the mark. It's not an EC2 instance, it's not Elastic Beanstalk, I'm not trying access the AWS console, and they don't use AD for SSO. It's just a website.

So far I have:

• created the SAML provider in AWS and imported the metadata from their IdP
• created the IAM role
• established the trust relationship between role and provider
• established the s3:getObject permission for the role
• provided them with the metadata from AWS with the specifics about the SAML assertions that need to be provided.

My question is how the two sides get connected. Is it automatically done by AWS when anyone attempts to access the site? Does the enterprise create a special link in their portal to start the site with the SAML? What happens if the user just types in the domain name in the browser? Does code need to be added to the website?

TIA, Mike