quicksite and datazone change

they require an email attribute, which requires the policy to allow the IDP to do a "sts:SetSourceIdentity"
internet2 · Aug 8, 2023 · f24efb1 · f24efb1
1 parent 04b798e
commit f24efb1
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/shibpolicy.json b/shibpolicy.json
@@ -3,7 +3,8 @@
   "Statement": [
     {
       "Effect": "Allow",
-      "Action": "sts:AssumeRoleWithSAML",
+      "Action": [ "sts:AssumeRoleWithSAML",
+                 "sts:SetSourceIdentity" ]
       "Principal": {
         "Federated": "arn:aws:iam::135656781587:saml-provider/SATOSA"
       },