Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AWS Single Sign-On

aws.amazon.com

Post reply on HN
Print view View original

91–100 of 119 posts

Re: AWS Single Sign-On

#91

Post by dbolgheroni »

intrasight wrote: post #85
ianburrell wrote: post #35

Earlier quoted context omitted.

Cognito is for authenticating users while AWS SSO is for authenticating employees. Users don’t usually need to be stored in Active Directory, authenticate to other services with SAML, or assigned groups to control access. AWS SSO should also have better integration with AWS IAM.

Everyone is a user, and most are employees. So that doesn't really answer my question. Users need to be stored somewhere. The question is, is AD a good place to store them. AD is a standard, is flexible, and has been around a long time. So perhaps I should ask the question "Now that we have AWS SSO, why would I use Cognito?"

This blog post has a good explanation:

https://stormpath.com/blog/sso-vs-centralized-auth

Re: AWS Single Sign-On

#92

Post by tptacek »

lvh wrote: post #86
ak217 wrote: post #82

Earlier quoted context omitted.

Thanks. Can't say I agree on the basis of this list that JWT/OIDC is equally bad to SAML. SAML is an outdated, ill-designed piece of crap that is a ticking time bomb of an implementation nightmare, in large part because almost nobody truly understands the standard or the security implications of the underlying XML Security standards (having written https://github.com/XML-Security/signxml for much the same reasons you…

Your comments about SAML are valid, but we're not implementing _all of SAML_. We're implementing the tiny subset that we can do safely once that you're actually going to use, once. This sidesteps some of the issues you're referring to. (Also: while I agree dsig is horrendous, I don't think that stops implementors: there's like 2-3 truly unique implementations, mostly libxmlsec1. People regularly write their own JWT b…

If that's my trivialidp repo, in fairness, there are 2-3 other private repos that are important deps. :)

Re: AWS Single Sign-On

#93

Post by actualanswer »

ownagefool wrote: post #70
mankash666 wrote: post #46

Earlier quoted context omitted.

In your own words, you're a SAML IdP, not an SSO manger, like AWS SSO. I believe you're more akin to AWS Cognito than to AWS SSO. Unless I'm missing something in your description

What's the difference?

SAML IdP is the entity that stores the identities (source of truth), SSO provider can be the same IdP or a 3rd party entity that can federate this identity to different service providers (apps).

Re: AWS Single Sign-On

#94

Post by actualanswer »

tptacek wrote: post #29

If this is interesting to you but you're iffy about setting up another directory service or having AWS be your central list of identities for all your apps, we're open sourcing The Identity Mutilator, a Golang SAML IdP, in a couple weeks. It's self-contained (for now) so doesn't depend on AD or LDAP --- just Postgres --- and runs just fine in a tiny Docker container.

Sounds interesting! But AWS SSO doesn't integrate with 3rd party SAML IdP's yet and can only integrate with AD. How can I use this with AWS SSO?

Re: AWS Single Sign-On

#95

Post by andrewstuart2 »

actualanswer wrote: post #93
ownagefool wrote: post #70

Earlier quoted context omitted.

What's the difference?

SAML IdP is the entity that stores the identities (source of truth), SSO provider can be the same IdP or a 3rd party entity that can federate this identity to different service providers (apps).

It doesn't have to store the entities; it's just trusted by some set of service providers to provide identity claims. Nothing in the definition says an IdP can't federate further.

Re: AWS Single Sign-On

#96

Post by tptacek »

actualanswer wrote: post #93
ownagefool wrote: post #70

Earlier quoted context omitted.

What's the difference?

SAML IdP is the entity that stores the identities (source of truth), SSO provider can be the same IdP or a 3rd party entity that can federate this identity to different service providers (apps).

Yeah, I don't care about these terms at all. I'm happy to get directory integration working, or to proxy SAML from elsewhere (as long as it conforms to the minimal SAML I'm willing to speak).

Re: AWS Single Sign-On

#97

Post by tptacek »

actualanswer wrote: post #94
tptacek wrote: post #29

If this is interesting to you but you're iffy about setting up another directory service or having AWS be your central list of identities for all your apps, we're open sourcing The Identity Mutilator, a Golang SAML IdP, in a couple weeks. It's self-contained (for now) so doesn't depend on AD or LDAP --- just Postgres --- and runs just fine in a tiny Docker container.

Sounds interesting! But AWS SSO doesn't integrate with 3rd party SAML IdP's yet and can only integrate with AD. How can I use this with AWS SSO?

I have no idea. I don't really grok AWS SSO or Cogito as products, except that they make a lot of sense if you're trying to make your entire application footprint just a set of lambdas.

When first-class Golang support for lambdas arrives (it's on the roadmap apparently), I'm probably going to take a crack at getting the IdP to work as a set of lambdas as well. I wish I could say that was my idea, but someone DM'd it to me after I mentioned The Identity Mutilator on Twitter, and so now I'm stealing it.

But anyways that's why I'm chattering about it now, in case other people have ideas.

Re: AWS Single Sign-On

#98

Post by mankash666 »

tptacek wrote: post #96
actualanswer wrote: post #93

Earlier quoted context omitted.

SAML IdP is the entity that stores the identities (source of truth), SSO provider can be the same IdP or a 3rd party entity that can federate this identity to different service providers (apps).

Yeah, I don't care about these terms at all . I'm happy to get directory integration working, or to proxy SAML from elsewhere (as long as it conforms to the minimal SAML I'm willing to speak).

You should care about these terms while building and marketing software in the space. I'm not saying you're being deceitful, however, almost anyone who read your description assumed your offering to have feature parity with AWS SSO, but the feature list probably is closer to AWS Cognito. An open alternative to Cognito might be sufficient for most, but is still not the same as a comprehensive SSO manger

Re: AWS Single Sign-On

#99

Post by cratermoon »

Spooky23 wrote: post #24
jlgaddis wrote: post #19

Earlier quoted context omitted.

> I guess "relatively new" is a vague term, but SAML v2.0 (the current version) was standardised in March 2005 - it's now 12.5 years old, I don't call that new. True, but it's still relatively new to most people, similar to how IPv6 has been around for a few decades but is still "new" to many. > SAML is very widely used in certain segments. Perhaps but it's only been in the last few years that I've been hearing about…

It’s new if you’re not informed about identity as a technology area. Some people in that space consider SAML2 to be outdated! The beauty of a federated identity system is that you keep your credentials away from business partners. If you were a corporate customer of Dropbox relying on them to host your identity, you were kind of fucked when they had an account breach. If you used federated identity, Dropbox never had…

It's outdated enough that even the Enterprise vendors are starting to look at OpenID Connect to replace it.

The draw with SAML was definitely for enterprise requirements -- the main one, as I understand it, was the requirement of sharing metadata out-of-band between the IdP and SP to establish trust. While that sounded like a good idea at the time, it turns out that if your organization ends up needing to trust and exchange metadata with more than a few other entities, managing all those certificates and properly validating them is enough of a pain that metadata aggregators have sprung up to handle them.

Re: AWS Single Sign-On

#100

Post by cratermoon »

nl wrote: post #65
jlgaddis wrote: post #14

While this will undoubtedly make a lot of people's lives easier, I'm a bit hesitant to use SAML just yet. SAML is still relatively new, isn't very widely used (AFAICT), and I'm not sure how much security research has been done on the topic thus far. To illustrate, just a few weeks ago there was "a new attack vector discovered that ... enables an attacker to create a ... forged SAML 'authentication object', and authen…

I'd imagine every single Fortune 500 company uses SAML. I'd be surprised if many in the Fortune 5000 didn't use it. Sailpoint (a large enterprise SSO/SAML vendor) IPOed at $1B in early November. I think they are probably smaller than Ping Identity. Don't use SAML if you don't have to (it's horrible to program!). But it is very widely adopted.

Many large universities (ones that operate like enterprise-sized companies) also use SAML for SSO within and across institutions.
Post reply on HN