SSO authentication

Before you use SSO

AWS Single Sign-On (SSO) is the previous name for AWS IAM Identity Center. This page uses the term SSO because the AWS configuration keys use it.

You need:

• An IAM Identity Center start URL.
• An AWS account and role that your organization assigned to you.
• An SSO profile in ~/.aws/config.

SSO profiles are included in the 14-day trial and in Professional and Enterprise. For a profile that uses login_session, see AWS Login.

Your Dynomate sign-in and AWS SSO sign-in are separate. The Dynomate account controls the app license. AWS SSO controls access to AWS resources.

Configure an SSO profile

Use the AWS CLI to create the profile, or edit the AWS config file. The AWS CLI reduces configuration errors:

A current SSO configuration can use a named session:

[sso-session company]sso_start_url = https://example.awsapps.com/startsso_region = ap-southeast-2sso_registration_scopes = sso:account:access[profile production-read]sso_session = companysso_account_id = 123456789012sso_role_name = ReadOnlyregion = ap-southeast-2

Dynomate also supports the earlier profile format:

[profile production-read]sso_start_url = https://example.awsapps.com/startsso_region = ap-southeast-2sso_account_id = 123456789012sso_role_name = ReadOnlyregion = ap-southeast-2

Restart Dynomate after you add or rename the profile.

Sign in from Dynomate

Table discovery

1. Open Settings and select Table discovery. You can also select Manage AWS profiles in Global Search.
2. Select the SSO profile.
3. Select Login if the session is not valid.
4. Complete the AWS sign-in in the browser that opens.
5. Return to Dynomate.
6. Wait for Dynomate to confirm the AWS identity.
7. Select one or more Regions.
8. Select Load Tables.

Dynomate checks for completion every five seconds for up to two minutes. If the sign-in takes longer, select Login and try again.

Use an existing session

Dynomate reads and writes SSO sessions in the standard AWS cache at ~/.aws/sso/cache. If a valid session is present, Dynomate uses it without opening the browser.

You can also start a session with the AWS CLI:

Return to Dynomate and select Refresh for the profile. Dynomate then checks the cached session and the AWS identity.

The Dynomate CLI reuses this session.

Session expiry

Your AWS administrator controls the SSO session duration. When the session expires, Dynomate marks the profile as invalid and disables table loading.

1. Select Login.
2. Complete the AWS sign-in in your browser.
3. Return to Dynomate.
4. Wait for the identity check to succeed.

Authentication state belongs to the AWS profile. Open table tabs keep the profile and Region that were used during discovery.

Troubleshooting

The profile is not detected as SSO

• Check that the profile has sso_start_url or sso_session.
• Check the referenced [sso-session name] section.
• Restart Dynomate after you change the config file.

The browser does not open

• Check that your system has a default browser.
• Run aws sso login --profile profile-name in a terminal.
• Return to Dynomate and select Refresh.

The sign-in times out

• Complete the browser step within two minutes.
• Check that sso_start_url and sso_region are correct.
• Select Login to start a new device authorization.

Access is denied after sign-in

• Check the sso_account_id and sso_role_name.
• Check that the assigned role can list the required DynamoDB tables.
• Check that you selected the correct AWS Region.

To see the STS, SSO, and SSO OIDC calls, open Logs.