Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AWS Single Sign-On

aws.amazon.com

Post reply on HN
Print view View original

51–60 of 119 posts

Re: AWS Single Sign-On

#51

Post by ak217 »

tptacek wrote: post #40
eximius wrote: post #34

Earlier quoted context omitted.

Out of curiosity (and ignorance), why SAML vs JWT or some less awful protocol?

JWT is also an awful protocol, and it's also not an SSO standard. There's still time for us not to bet the farm on JWT, and I urge clients to avoid it.

Can you please elaborate on what's awful about JWT/OIDC? I ask because I've implemented SAML-based IdPs and SPs before, and SAML is a serious trainwreck of a protocol. Now I'm looking at implementing OIDC and at first glance it seems a lot more reasonable.

Re: AWS Single Sign-On

#52

Post by mmalone »

msoad wrote: post #48

Can SSO be used for SSH like Google Cloud? That's the coolest thing I miss from Google Cloud

Are you talking about the `gcloud compute ssh` stuff? I wonder what magic google is using to grt public keys on boxes. I’d think there’d have to be some coordination with the machine image being run for this to work, so it wouldn’t be something Amazon could just turn on for everybody. You could probably roll your own using an SSH CA though.

Re: AWS Single Sign-On

#53

Post by lmz »

mmalone wrote: post #52
msoad wrote: post #48

Can SSO be used for SSH like Google Cloud? That's the coolest thing I miss from Google Cloud

Are you talking about the `gcloud compute ssh` stuff? I wonder what magic google is using to grt public keys on boxes. I’d think there’d have to be some coordination with the machine image being run for this to work, so it wouldn’t be something Amazon could just turn on for everybody. You could probably roll your own using an SSH CA though.

They have daemons running to manage that and do stuff like add IP addresses when IP forwarding rules are added; https://github.com/GoogleCloudPlatform/compute-image-package...

Re: AWS Single Sign-On

#54

Post by awalton »

eximius wrote: post #34
tptacek wrote: post #33

Earlier quoted context omitted.

It's an SSO system, so think LDAP plus a "universal login page" for all your applications. Ours is a stripped down, carefully audited Golang application that does TOTP and U2F. But, like all modern SSO systems, we (unfortunately) speak SAML --- a godawful protocol, but one we did a from-scratch implementation of to avoid crazy deps.

Out of curiosity (and ignorance), why SAML vs JWT or some less awful protocol?

The Enterprise SSO market is close to defacto standardizing around SAML AFAICT. Either your product supports it, or the very large enterprises with very large budgets can't use it, and your competitor that does support SAML gets the dollars instead.

Re: AWS Single Sign-On

#55

Post by mmalone »

fulafel wrote: post #47

What's the advantage of SAML over Kerberos?

Kerberos / Needham-Schroeder usually refers to an authenticated encryption protocol that uses symmetric keys (shared secrets). It lets two parties who have never communicated, but who both mutually trust some third party, establish one another’s identities and negotiate a symmetric key for encrypted communication.

The SAML core is an XML-based system for serializing, signing, and encrypting assertions. There are also SAML flows, and they likely use something Kerberos-esque. So SAML is to Kerberos what HTML is to HTTP, or what x.509 is to TLS, or something like that.

Re: AWS Single Sign-On

#56

Post by mmalone »

lmz wrote: post #53
mmalone wrote: post #52

Earlier quoted context omitted.

Are you talking about the `gcloud compute ssh` stuff? I wonder what magic google is using to grt public keys on boxes. I’d think there’d have to be some coordination with the machine image being run for this to work, so it wouldn’t be something Amazon could just turn on for everybody. You could probably roll your own using an SSH CA though.

They have daemons running to manage that and do stuff like add IP addresses when IP forwarding rules are added; https://github.com/GoogleCloudPlatform/compute-image-package...

Daemons running on user VMs? Or is ssh terminated in a bastion and forwarded somehow?

Edit: sorry didn’t read far enough and have now answered my own question. In VMs. So yea, Amazon could not duplicate without getting people to change AMIs or install some agent. Still seems like an SSH CA is a better option. Curious why google didn’t go that route. Maybe not an option when they built this?

Re: AWS Single Sign-On

#57

Post by jf »

tptacek wrote: post #33
angersock wrote: post #32

Earlier quoted context omitted.

What's the advantage of your thing over, say, LDAP?

It's an SSO system, so think LDAP plus a "universal login page" for all your applications. Ours is a stripped down, carefully audited Golang application that does TOTP and U2F. But, like all modern SSO systems, we (unfortunately) speak SAML --- a godawful protocol, but one we did a from-scratch implementation of to avoid crazy deps.

> SAML --- a godawful protocol, but one we did a from-scratch implementation of to avoid crazy deps.

Agree that SAML is godawful (to put it lightly) and also very curious about your from-scratch implementation. I assume that by "crazy deps" you're referring to xmlsec1 (which, disturbingly, nearly every non Java/.NET library uses) Did you implement XML-DSig yourself? (!)

I'd be very interested in comparing notes on test cases. I wrote a SAML testing tool [1][2] inspired by the "On Breaking SAML" paper [3] but the tool is incomplete and essentially abandoned because I hoped that people would stop implementing SAML.

Would you be open to comparing notes on test suites for SAML implementations?

Footnotes:

1: http://saml.oktadev.com/

2: https://bitbucket.org/jfranusic/saml-messenger

3: https://www.usenix.org/system/files/conference/usenixsecurit...

Re: AWS Single Sign-On

#58

Post by jf »

tptacek wrote: post #40
eximius wrote: post #34

Earlier quoted context omitted.

Out of curiosity (and ignorance), why SAML vs JWT or some less awful protocol?

JWT is also an awful protocol, and it's also not an SSO standard. There's still time for us not to bet the farm on JWT, and I urge clients to avoid it.

By "JWT" do you mean the the format? (RFC 7519) Or perhaps you meant OpenID Connect?

I can think of reasons for you to urge your clients to avoid JWT-the-format and certainly OIDC-the-standard. What do you suggest as the alternative?

Re: AWS Single Sign-On

#59

Post by cwyers »

psergeant wrote: post #12

Wonder if and when we’ll see decent Excel/Word replacements from Amazon, perhaps coupled with a thin Linux distro. At that point you’d be able to completely do away with Microsoft in many organisations, and Amazon could simply gobble up those dollars. They’ve got enough money they could make it work.

Decent Excel/Word replacements are a hard problem to solve. OOo/LibreOffice and Google Docs have been at it for a while, and aren't there. Meanwhile, I can't imagine wanting an Amazon office suite. I've used their video and music streaming services, and holy wow, the usability is awful. Their photo storage service is so pants compared to Microsoft or Google in terms of usability. I shudder to think what an Amazon equivalent of Google Docs would be like.

Re: AWS Single Sign-On

#60

Post by timv »

jlgaddis wrote: post #14

While this will undoubtedly make a lot of people's lives easier, I'm a bit hesitant to use SAML just yet. SAML is still relatively new, isn't very widely used (AFAICT), and I'm not sure how much security research has been done on the topic thus far. To illustrate, just a few weeks ago there was "a new attack vector discovered that ... enables an attacker to create a ... forged SAML 'authentication object', and authen…

> unless I've just been unaware of them

Is there a reason you would expect to be aware of them? Is this a field that you work in?

Your experience doesn't align with those of us who work in the application security and identity management space, yet you seem to be speaking so confidently about it.

Post reply on HN