Skip to main content

AWS IAM Identity Center

Mandaitor integrates with AWS IAM Identity Center (formerly AWS SSO) for customers who manage workforce identity through AWS. This is particularly relevant since Mandaitor itself runs on AWS.

When to Use AWS IAM Identity Center​

  • Organizations using AWS IAM Identity Center as their workforce identity provider
  • Companies with AWS-native infrastructure who want consistent identity across services
  • Multi-account AWS organizations with centralized identity management

Configuration​

curl -X PUT https://api.mandaitor.io/v1/tenants/{tenantId}/identity-providers \
  -H "Authorization: Bearer $TOKEN" \
  -d '{
    "enabled_providers": ["API_KEY", "COGNITO", "AWS_IAM_IDC"],
    "aws_iam_idc": {
      "issuer": "https://identitycenter.amazonaws.com/ssoins-xxxxxxxxxxxxx",
      "audience": "https://api.mandaitor.eu"
    }
  }'

Token Validation​

  1. Provider detection: Authorizer detects identitycenter.amazonaws.com or sso.amazonaws.com issuer
  2. JWKS verification: Signature verified against IAM Identity Center's JWKS endpoint
  3. Claims extraction: sub, email, name, custom:identityStoreId
  4. Identity resolution: Mapped to oidc:aws-idc:<sub> canonical subject ID

Agents acting for a user​

Mandaitor does not exchange IAM Identity Center tokens for delegation tokens. A person signs in with IAM Identity Center and issues mandates. An AI agent authenticates with its own registered key and acts only on the mandates that name it (Agent Identity Registry). Acting with the user's own token, on their behalf, is not available.