# Authenticate with ADFS

> An AWS handler can authenticate through Active Directory Federation Services (ADFS) instead of an access key and secret key

---

Site [llms.txt](/llms.txt)

---

Use this where your organization already federates AWS access through ADFS and does not want to issue a key pair for Cloud Management Platform (CMP) to hold. CMP logs in to your ADFS server with the provided credentials, receives a SAML assertion, and exchanges it for temporary AWS credentials by assuming a SAML role.

## Prerequisites

- A SAML IAM role in AWS, and its role ARN. The role must appear in the ADFS assertion issued for the account you log in with.
- An ADFS server with the AWS relying party trust configured and IdP-initiated sign-on enabled, since that is the page CMP posts the credentials to.
- An Active Directory account with permission to log in there.

## Create the handler

1. Go to **Admin** > **Resource Handlers** and select **Add**.
1. Select the **Amazon Web Services** tile.
1. Set **Credentials Type** to **ADFS Credentials**.
1. Complete the fields that appear:

    | Field | Description |
    | --- | --- |
    | **Username** | The Active Directory username or email address, such as `admin@example.com`. |
    | **Password** | That account's password. |
    | **ADFS Domain Name** | The ADFS server's domain, such as `adserver.example.com`. |
    | **SAML IAM Role ARN** | The role CMP assumes, such as `arn:aws:iam::111111111111:role/YourADFSRole`. |
    | **ADFS Server SSL Verification** | Leave enabled unless the ADFS server presents a certificate CMP cannot verify. Disabling it stops CMP from checking the certificate at login. |

1. Select **Continue**, then complete the handler's settings and select at least one region, as described under [Add an AWS resource handler](/docs/cmp/configure/infrastructure/resource-handlers/aws/#add-an-aws-resource-handler).

![Screenshot of the Create a Resource Handler for Amazon Web Services with ADFS Credentials selected.](/img/cmp/configure/infrastructure/resource-handlers/aws/adfs/create-aws-resource-handler-adfs.png)

CMP creates the handler and starts a job to import the regions and sync the account's instances. Use **Verify Connection** on the handler to confirm the login works.

The handler's Overview tab shows the username, ADFS domain name, and SAML IAM Role ARN in place of an access key.

## Related

- [AWS](/docs/cmp/configure/infrastructure/resource-handlers/aws/): the other credentials types, and what an AWS handler needs permission to do.