# Quick Sight SSO Issue

**URL:** <https://community.amazonquick.com/t/quick-sight-sso-issue/14271>\
**Category:** Q&A\
**Tags:** sso, error, quick-sight\
**Created:** [June 5, 2023, 1:20pm UTC](https://community.amazonquick.com/t/quick-sight-sso-issue/14271 "2023-06-05T13:20:53Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![lilith](https://avatars.discourse-cdn.com/v4/letter/l/e36b37/32.png) [@lilith](https://community.amazonquick.com/u/lilith)\
**Post date:** [June 5, 2023, 1:20pm UTC](https://community.amazonquick.com/t/quick-sight-sso-issue/14271/1 "2023-06-05T13:20:53Z")

</div>

I tried to enable SSO for Quick Sight, but when testing for the end-to-end experience in incognito mode, I got stuck at this screen, which kept loading forever.

 ![image](https://d1wl4jav5dp96l.cloudfront.net/original/2X/6/6f7ad1226a4c7c70e407f5360746493e08f03d71.png)

What I did to get this SSO is  
**1. Prerequisite**

- Having Quicksight ADMIN permissions
- AWS account ADMIN access on which Quicksight is hosted
- ANT groups for each tier of access needed to be provided (Reader, User/Writer, Admin)  
**2. Create Identity Provider** (using the metadata from the Federate profile to create a provider in IAM), naming it _federateQuick Sight_  
**3. Create three IAM polices** that gives different tier of Quick Sight permission (quicksight:CreateReader, quicksight:CreateUser, quicksight:CreateAdmin)  
Example:  
{  
“Version”: “2012-10-17”,  
“Statement”: [  
{  
“Effect”: “Allow”,  
“Action”: [  
“quicksight:CreateReader”  
],  
“Resource”: [  
“arn:aws:quicksight::myaccountid:user/${aws:userid}”  
]  
}  
]  
}  
With replacing myaccountid with my true AWS account ID

**4. Create 3 IAM roles (for three tiers of access)** and select SAML 2.0 Federation as the trusted entity type and choose the Identity Provider created above, naming respectively _AdminRole_, _AuthorRole_, _ReaderRole_  
**5. Follow the Amazon Federate Onboarding**  
a. In Allowed Groups, allow three ANT groups created in the prerequisites (ANT Group 1, ANT Group 2, ANT Group 3)  
b. Claims configuration are as followed  
The first three claims are pre-populated, which I then added two additional claims.  
o Claim 4:

- Name: [https://aws.amazon.com/SAML/Attributes/PrincipalTag:Email](https://aws.amazon.com/SAML/Attributes/PrincipalTag:Email)
- Claim type: FederateUserAttribute
- FederateUserAttribute: EMAIL
- Code: {

```auto
  "customName": "https://aws.amazon.com/SAML/Attributes/PrincipalTag:Email",
  "federateAttribute": "EMAIL"
}

```

o Claim 5:

- Name: [https://aws.amazon.com/SAML/Attributes/Role](https://aws.amazon.com/SAML/Attributes/Role)
- Claim Type: Group to Role/IdP ARN mapping
- GroupType: ANT
- Representation: LIST
- Code:

```auto
{
  "customMapper": [
    {
      "customKey": "ANT Group 1",
      "customValueList": [
        "arn:aws:iam::myaccountID:role/AdminRole, arn:aws:iam::myaccountID:saml-provider/federateQuick Sight"
      ]
    },
    {
      "customKey": "ANT Group 2",
      "customValueList": [
        "arn:aws:iam:: myaccountID:role/ReaderRole, arn:aws:iam::myaccountID:saml-provider/federateQuick Sight"
      ]
    },
    {
      "customKey": "ANT Group 3",
      "customValueList": [
        "arn:aws:iam:: myaccountID:role/AuthorRole, arn:aws:iam::myaccountID:saml-provider/federateQuick Sight"
      ]
    }
  ],
  "customName": "https://aws.amazon.com/SAML/Attributes/Role",
  "customValue": "AD_GROUPS",
  "attributeType": "LIST"
}

```

1. Submitted, got auto approved and paste the link in SSO in Quick Sight.

I’m unsure what went wrong, but seems like I passed through the SSO stage and then got stuck at the get-user-email screen. Thank you for your help.

---

<div class="post-metadata">

**Author:** ![Sanjeeb2022](https://d2orw1595917va.cloudfront.net/user_avatar/community.amazonquick.com/sanjeeb2022/32/20947_2.png) [@Sanjeeb2022](https://community.amazonquick.com/u/Sanjeeb2022)\
**Post date:** [June 5, 2023, 9:59pm UTC](https://community.amazonquick.com/t/quick-sight-sso-issue/14271/2 "2023-06-05T21:59:31Z")

</div>

Hi @lilith - To investigate this issue, it will be good to submit a ticket to AWS customer support so that they can validate e2e via screenshare and troubleshoot the issue. To raise the request, please follow the link - [Creating support cases and case management - AWS Support](https://docs.aws.amazon.com/awssupport/latest/user/case-management.html)

Regards - Sanjeeb

---

<div class="post-metadata">

**Author:** ![Max](https://d2orw1595917va.cloudfront.net/user_avatar/community.amazonquick.com/max/32/2288_2.png) [@Max](https://community.amazonquick.com/u/Max)\
**Post date:** [June 12, 2023, 10:43pm UTC](https://community.amazonquick.com/t/quick-sight-sso-issue/14271/3 "2023-06-12T22:43:13Z")

</div>