Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AWS Single Sign-On

aws.amazon.com

Post reply on HN
Print view View original

1–10 of 119 posts

Re: AWS Single Sign-On

#4

Post by davidu »

Update: I realize now this is Amazon offering SSO services, not just supporting SAML / Federated authentication.

Ignore rest of my comment:

  Proof you can build a massive, multi-billion dollar enterprise business without supporting SSO.

  I would not have immediately guessed that statement to be true, and I would have thought AWS already had SSO support.

Re: AWS Single Sign-On

#5

Post by mrkurt »

davidu wrote: post #4

Update: I realize now this is Amazon offering SSO services, not just supporting SAML / Federated authentication. Ignore rest of my comment: Proof you can build a massive, multi-billion dollar enterprise business without supporting SSO. I would not have immediately guessed that statement to be true, and I would have thought AWS already had SSO support.

It helps if you have a massive, multi billion dollar consumer business everyone's already registered with.

Re: AWS Single Sign-On

#6

Post by BillinghamJ »

davidu wrote: post #4

Update: I realize now this is Amazon offering SSO services, not just supporting SAML / Federated authentication. Ignore rest of my comment: Proof you can build a massive, multi-billion dollar enterprise business without supporting SSO. I would not have immediately guessed that statement to be true, and I would have thought AWS already had SSO support.

It was always pretty easy to build yourself with their federated auth system. Nice to have proper support now though.

Edit: no, it still isn’t really anything like what I’m wanting. This particular product requires Microsoft AD. I just want our admins to be able to log into AWS via google apps. :(

Re: AWS Single Sign-On

#7

Post by aynsof »

I tested this out just yesterday. It was fairly easy to set up - enable SSO, create a Directory Service, add a management EC2 instance, and you're pretty much up and running.

You've got to set up your own Active Directory using Directory Services, which is $288USD/month minimum for two domain controllers.

In order to have MFA for logging into the console (non-negotiable in my opinion), you have to configure your own RADIUS server.

And the question of how to manage access keypairs still remains unanswered, as far as I can tell.

I don't know if this is going to supplant Azure AD as our SSO method of choice.

Re: AWS Single Sign-On

#8

Post by yeukhon »

aynsof wrote: post #7

I tested this out just yesterday. It was fairly easy to set up - enable SSO, create a Directory Service, add a management EC2 instance, and you're pretty much up and running. You've got to set up your own Active Directory using Directory Services, which is $288USD/month minimum for two domain controllers. In order to have MFA for logging into the console (non-negotiable in my opinion), you have to configure your own…

Hmm how did you calculate the DC to be $288 for total of two?

I believe you can use AD connector to connect to on-premise AD.

Re: AWS Single Sign-On

#9

Post by will_hughes »

BillinghamJ wrote: post #6
davidu wrote: post #4

Update: I realize now this is Amazon offering SSO services, not just supporting SAML / Federated authentication. Ignore rest of my comment: Proof you can build a massive, multi-billion dollar enterprise business without supporting SSO. I would not have immediately guessed that statement to be true, and I would have thought AWS already had SSO support.

It was always pretty easy to build yourself with their federated auth system. Nice to have proper support now though. Edit: no, it still isn’t really anything like what I’m wanting. This particular product requires Microsoft AD. I just want our admins to be able to log into AWS via google apps. :(

You should be able to do this already[1]. What issues are you having?

[1] https://support.google.com/a/answer/6194963 via http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_pro...

Re: AWS Single Sign-On

#10

Post by geofft »

I'm a little confused at the third-party thing - is AWS generating SAML assertions based on your internal AD that it sends to other websites like Box or Office 365 or Slack? Why would you want AWS in the loop?

Is this an alternative to running ADFS? I guess the fact that you're not running ADFS servers is nice, but as far as I understand, your ADFS servers don't have to be publicly facing. (And honestly, not being able to sign in using corporate credentials if you're not on the corporate network is a security policy that will make lots of admins happy.)

It looks like there's an old AWS blog post about using ADFS to enable SSO to AWS: https://aws.amazon.com/blogs/security/enabling-federation-to...

Post reply on HN