Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AWS Single Sign-On

aws.amazon.com

Post reply on HN
Print view View original

21–30 of 119 posts

Re: AWS Single Sign-On

#21

Post by Johnny555 »

aynsof wrote: post #11
yeukhon wrote: post #8

Earlier quoted context omitted.

Hmm how did you calculate the DC to be $288 for total of two? I believe you can use AD connector to connect to on-premise AD.

$288 comes from here: https://aws.amazon.com/directoryservice/pricing/ It looks like AD Connector is much less: https://aws.amazon.com/directoryservice/other-directories-pr...

I think you're looking at the Enterprise domain controller pricing. the Standard size (up to 30,000 objects) is 12 cents/hour for two controllers.

$0.12 * 24 * 30 = $86.40/month.

Re: AWS Single Sign-On

#22

Post by Spooky23 »

geofft wrote: post #10

I'm a little confused at the third-party thing - is AWS generating SAML assertions based on your internal AD that it sends to other websites like Box or Office 365 or Slack? Why would you want AWS in the loop? Is this an alternative to running ADFS? I guess the fact that you're not running ADFS servers is nice, but as far as I understand, your ADFS servers don't have to be publicly facing. (And honestly, not being ab…

AWS SSO looks to be an IdP (identity provider) which maps artifacts from AD like ldap groups to entitle access to trusted service providers.

This would be an alternative to ADFS. It solves a big problem, because for many customers of cloud services, you’re paying for 99.9% reliability from the service provider, but the ADFS farm in your office or in another cloud is a single point of failure with a lower uptime commitment.

Re: AWS Single Sign-On

#23

Post by Johnny555 »

psergeant wrote: post #12

Wonder if and when we’ll see decent Excel/Word replacements from Amazon, perhaps coupled with a thin Linux distro. At that point you’d be able to completely do away with Microsoft in many organisations, and Amazon could simply gobble up those dollars. They’ve got enough money they could make it work.

Google has been working on that for ~10 years, but still doesn't have a full replacement. Though it's about 80% there - we're a Google Docs office, but about 20% of employees (mostly finance and marketing) need real MS Office products.

Re: AWS Single Sign-On

#24

Post by Spooky23 »

jlgaddis wrote: post #19
timv wrote: post #16

Earlier quoted context omitted.

While there are a thousand reasons to hate SAML, your concerns are not accurate. 1. I guess "relatively new" is a vague term, but SAML v2.0 (the current version) was standardised in March 2005 - it's now 12.5 years old, I don't call that new . 2. SAML is very widely used in certain segments. Every SSO product supports SAML, including cloud vendors like Azure, Google and now AWS, and also specialist vendors like Okta…

> I guess "relatively new" is a vague term, but SAML v2.0 (the current version) was standardised in March 2005 - it's now 12.5 years old, I don't call that new. True, but it's still relatively new to most people, similar to how IPv6 has been around for a few decades but is still "new" to many. > SAML is very widely used in certain segments. Perhaps but it's only been in the last few years that I've been hearing about…

It’s new if you’re not informed about identity as a technology area. Some people in that space consider SAML2 to be outdated!

The beauty of a federated identity system is that you keep your credentials away from business partners. If you were a corporate customer of Dropbox relying on them to host your identity, you were kind of fucked when they had an account breach. If you used federated identity, Dropbox never had access to your account credentials.

Federated identity also lets you control posture and control access better. Perhaps your email system requires multi-factor auth, but your time card system does not, unless you are approving expenses. You can build that “step up” to multi factor auth on your servers, and use a single MFA credential to do so.

Re: AWS Single Sign-On

#25

Post by 013a »

Spooky23 wrote: post #15
jlgaddis wrote: post #14

While this will undoubtedly make a lot of people's lives easier, I'm a bit hesitant to use SAML just yet. SAML is still relatively new, isn't very widely used (AFAICT), and I'm not sure how much security research has been done on the topic thus far. To illustrate, just a few weeks ago there was "a new attack vector discovered that ... enables an attacker to create a ... forged SAML 'authentication object', and authen…

You might want to double check those facts. There are probably billions of SAML users. Any significant O365 implementation is using SAML. Any SaaS that allows enterprise login is using SAML. If you do business with Spectrum, you are using SAML when you login. If you interact with most government agencies, you are using SAML. That’s not to say that it does not have risk, but adoption is not an issue!

Chase Bank is another one, off the top of my head. SAML is huge. I have no idea where the guy above us is getting is intel.

Re: AWS Single Sign-On

#26

Post by timv »

jlgaddis wrote: post #19
timv wrote: post #16

Earlier quoted context omitted.

While there are a thousand reasons to hate SAML, your concerns are not accurate. 1. I guess "relatively new" is a vague term, but SAML v2.0 (the current version) was standardised in March 2005 - it's now 12.5 years old, I don't call that new . 2. SAML is very widely used in certain segments. Every SSO product supports SAML, including cloud vendors like Azure, Google and now AWS, and also specialist vendors like Okta…

> I guess "relatively new" is a vague term, but SAML v2.0 (the current version) was standardised in March 2005 - it's now 12.5 years old, I don't call that new. True, but it's still relatively new to most people, similar to how IPv6 has been around for a few decades but is still "new" to many. > SAML is very widely used in certain segments. Perhaps but it's only been in the last few years that I've been hearing about…

> Perhaps but it's only been in the last few years that I've been hearing about it, mostly WRT the cloud vendors (AWS, specifically).

As business have become more willing to move core services to cloud platforms, they've demanded that those platforms provide a single sign on solution that integrates with their corporate directory.

So, the popularity of SAML has certainly risen with the popularity of cloud / SaaS, but it's perfectly normal for a technology to become more popular with time (until it eventually goes into decline), and that increase in popularity means that it becomes more widely known, and some people who have never had to deal with it before, now come into contact with it.

I've been involved in SAML implementations at fairly conservative technology organisations (banks, pharma) for more than 6 years (and for most of that time it wasn't my core role). It's old tech, that's in wide usage, it just isn't something that most people need to deal with because it's boring identity management infrastructure that most application developers don't get involved in.

Re: AWS Single Sign-On

#27

Post by dfsegoat »

Johnny555 wrote: post #23
psergeant wrote: post #12

Wonder if and when we’ll see decent Excel/Word replacements from Amazon, perhaps coupled with a thin Linux distro. At that point you’d be able to completely do away with Microsoft in many organisations, and Amazon could simply gobble up those dollars. They’ve got enough money they could make it work.

Google has been working on that for ~10 years, but still doesn't have a full replacement. Though it's about 80% there - we're a Google Docs office, but about 20% of employees (mostly finance and marketing) need real MS Office products.

Sheets... I just.. I can't.

I was a business analyst (excel grunt) for 2+ years in a biotech startup. Sheets is just different in enough ways to positively irk even the "casual power user" of Excel, IMO.

Re: AWS Single Sign-On

#28

Post by xenophonf »

jlgaddis wrote: post #14

While this will undoubtedly make a lot of people's lives easier, I'm a bit hesitant to use SAML just yet. SAML is still relatively new, isn't very widely used (AFAICT), and I'm not sure how much security research has been done on the topic thus far. To illustrate, just a few weeks ago there was "a new attack vector discovered that ... enables an attacker to create a ... forged SAML 'authentication object', and authen…

There's a lot of FUD here, starting with SAML being new. SAML 1.0 was ratified in 2002, and SAML 2.0 was ratified in 2005. Compare that to OAuth, with version 1.0 published by IETF in 2010 and version 2.0 in 2012. Likewise, there are multiple, mature SAML implementations including the open source Shibboleth project, which started in 2000, and SimpleSAMLphp, which started in 2007. I consider Shibboleth the gold standard, against which I measure all SAML implementations.

In just the global research and higher educational community (eduGAIN), there are currently 2588 SAML identity providers and 1792 SAML service providers.

> Now, this [golden SAML] attack isn't real practical as it requires things like the "token-signing private key".

It isn't a flaw in the SAML protocol. If an attacker compromises your IAM infrastructure, be that a domain controller, directory server, KDC, IdP, or OP, they can impersonate your users.

Re: AWS Single Sign-On

#29

Post by tptacek »

If this is interesting to you but you're iffy about setting up another directory service or having AWS be your central list of identities for all your apps, we're open sourcing The Identity Mutilator, a Golang SAML IdP, in a couple weeks. It's self-contained (for now) so doesn't depend on AD or LDAP --- just Postgres --- and runs just fine in a tiny Docker container.
Post reply on HN