---
title: "GET /workspaces/{workspaceId}/authentication"
method: GET
path: "/workspaces/{workspaceId}/authentication"
---

# GET /workspaces/{workspaceId}/authentication

`GET /workspaces/{workspaceId}/authentication`

Displays information about the authentication methods used in one Amazon Managed Grafana workspace.

## Path parameters

- `workspaceId` string, required

## Response `200`

Success

- DescribeWorkspaceAuthenticationResponse
  - `authentication` object, required — A structure containing information about the authentication methods used in the workspace.
    - `providers` AuthenticationProviderTypes[], required — Specifies whether this workspace uses IAM Identity Center, SAML, or both methods to authenticate users to use the Grafana console in the Amazon Managed Grafana workspace.
    - `saml` object — A structure containing information about how this workspace works with SAML, including what attributes within the assertion are to be mapped to user information in the workspace.
      - `status` 'CONFIGURED' | 'NOT_CONFIGURED', required — Specifies whether the workspace's SAML configuration is complete.
      - `configuration` object — A structure containing details about how this workspace works with SAML.
        - `idpMetadata` object, required — A structure containing the identity provider (IdP) metadata used to integrate the identity provider with this workspace.
          - `url` string — The URL of the location containing the IdP metadata.
          - `xml` string — The full IdP metadata, in XML format.
        - `assertionAttributes` object — A structure that defines which attributes in the SAML assertion are to be used to define information about the users authenticated by that IdP to use the workspace.
          - `name` string — The name of the attribute within the SAML assertion to use as the user full "friendly" names for SAML users.
          - `login` string — The name of the attribute within the SAML assertion to use as the login names for SAML users.
          - `email` string — The name of the attribute within the SAML assertion to use as the email names for SAML users.
          - `groups` string — The name of the attribute within the SAML assertion to use as the user full "friendly" names for user groups.
          - `role` string — The name of the attribute within the SAML assertion to use as the user roles.
          - `org` string — The name of the attribute within the SAML assertion to use as the user full "friendly" names for the users' organizations.
        - `roleValues` object — A structure containing arrays that map group names in the SAML assertion to the Grafana <code>Admin</code> and <code>Editor</code> roles in the workspace.
          - `editor` RoleValue[] — A list of groups from the SAML assertion attribute to grant the Grafana <code>Editor</code> role to.
          - `admin` RoleValue[] — A list of groups from the SAML assertion attribute to grant the Grafana <code>Admin</code> role to.
        - `allowedOrganizations` AllowedOrganization[] — Lists which organizations defined in the SAML assertion are allowed to use the Amazon Managed Grafana workspace. If this is empty, all organizations in the assertion attribute have access.
        - `loginValidityDuration` integer — How long a sign-on session by a SAML user is valid, before the user has to sign on again.
    - `awsSso` object — A structure containing information about how this workspace works with IAM Identity Center.
      - `ssoClientId` string — The ID of the IAM Identity Center-managed application that is created by Amazon Managed Grafana.

## Other responses

- `480` — ResourceNotFoundException
- `481` — ThrottlingException
- `482` — ConflictException
- `483` — ValidationException
- `484` — AccessDeniedException
- `485` — InternalServerException

---

[API](https://skmtc.net/aws/apis/grafana.md) · [All operations](https://skmtc.net/aws/apis/grafana/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/aws/grafana/versions/76cc5bd3d508/schema)