This is confusing. Does this thing speak LDAP or provide a way to add an LDAP adapter? I would love to move my LDAP server into a hosted service.
Ah. Never mind. I see now that it requires AD as a prerequisite.
AWS Single Sign-On
111–119 of 119 posts
Re: AWS Single Sign-On
#112I'm trying to understand the use case of this over Cognito for a typical SaaS company. Anyone care to give a brief explanation?
Cognito is for authenticating users while AWS SSO is for authenticating employees. Users don’t usually need to be stored in Active Directory, authenticate to other services with SAML, or assigned groups to control access. AWS SSO should also have better integration with AWS IAM.
In some AWS blog posts, AWS discussed how to build a single sign on using cognito.
Re: AWS Single Sign-On
#113Earlier quoted context omitted.
Sorry for the term confusion: TinySAML is what I’m informally calling the tiny subset of SAML we’re choosing to care about. Neither full-SAML nor full-OIDC fit in my head; I’ll also concede that full-SAML is much more complicated than full-OIDC, but that doesn’t matter: narrowing scope is much more effective for SAML than OIDC. I hope both protocols become obsolete. SAML may not be the future, but it’s definitely the…
The actual Go package is "trivialsaml". :)
Would be interested to see the source (for reference purposes only, anyway - I prefer Python myself) or any other resources you recommend.
Re: AWS Single Sign-On
#114Can SSO be used for SSH like Google Cloud? That's the coolest thing I miss from Google Cloud
I have successfully integrated Okta SSO to SSH via Hashicorp Vault, using it as a SSH CA to issue short-lived SSH certificates.
Re: AWS Single Sign-On
#115Finally, a 15th standard. Reference: https://xkcd.com/927/
They did not reinvent the wheel here. This is just the SAML 2.0 standard. The only consequence of launching this product is that there is another competitor on the SSO market, which is a good thing I think.
Technically true. But when it comes to writing a website, do you plan to add "SAML 2.0 auth" or "Google SSO, Facebook SSO, Amazon SSO"? I think all need to be configured, tested and debugged, even if they are based on the same communication protocol.
Re: AWS Single Sign-On
#116Re: AWS Single Sign-On
#117Earlier quoted context omitted.
It was always pretty easy to build yourself with their federated auth system. Nice to have proper support now though. Edit: no, it still isn’t really anything like what I’m wanting. This particular product requires Microsoft AD. I just want our admins to be able to log into AWS via google apps. :(
You should be able to do this already[1]. What issues are you having? [1] https://support.google.com/a/answer/6194963 via http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_pro...
I want the ability to use Google/G-Suite as an identity provider to log into multiple AWS accounts. We have dev and prod workloads that run in completely separate AWS accounts. I want to be able to use Google SSO and the ability to select which AWS account to log into
Re: AWS Single Sign-On
#118Earlier quoted context omitted.
Sounds interesting! But AWS SSO doesn't integrate with 3rd party SAML IdP's yet and can only integrate with AD. How can I use this with AWS SSO?
I have no idea. I don't really grok AWS SSO or Cogito as products, except that they make a lot of sense if you're trying to make your entire application footprint just a set of lambdas. When first-class Golang support for lambdas arrives (it's on the roadmap apparently), I'm probably going to take a crack at getting the IdP to work as a set of lambdas as well. I wish I could say that was my idea, but someone DM'd it…
I believe they announced Go support for Lambda at re:Invent this year.
Re: AWS Single Sign-On
#119Earlier quoted context omitted.
You should be able to do this already[1]. What issues are you having? [1] https://support.google.com/a/answer/6194963 via http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_pro...
I want the ability to use Google/G-Suite as an identity provider to log into multiple AWS accounts. We have dev and prod workloads that run in completely separate AWS accounts. I want to be able to use Google SSO and the ability to select which AWS account to log into
I don't have access to a G-Suite account to test this with, but afaict you should be able to do this by just adding each AWS account in turn and giving it a different Application Name and description in the G-Suite interface.