Live data from Hacker News

AWS Single Sign-On

aws.amazon.com

31–40 of 119 posts

Re: AWS Single Sign-On

#31

Wonder if and when we’ll see decent Excel/Word replacements from Amazon, perhaps coupled with a thin Linux distro. At that point you’d be able to completely do away with Microsoft in many organisations, and Amazon could simply gobble up those dollars. They’ve got enough money they could make it work.

Excel needs to go, better wait for it to fade, it is not a modern data analytics system, not at all.

Re: AWS Single Sign-On

#32
post #29

If this is interesting to you but you're iffy about setting up another directory service or having AWS be your central list of identities for all your apps, we're open sourcing The Identity Mutilator, a Golang SAML IdP, in a couple weeks. It's self-contained (for now) so doesn't depend on AD or LDAP --- just Postgres --- and runs just fine in a tiny Docker container.

What's the advantage of your thing over, say, LDAP?

Re: AWS Single Sign-On

#33
post #29

If this is interesting to you but you're iffy about setting up another directory service or having AWS be your central list of identities for all your apps, we're open sourcing The Identity Mutilator, a Golang SAML IdP, in a couple weeks. It's self-contained (for now) so doesn't depend on AD or LDAP --- just Postgres --- and runs just fine in a tiny Docker container.

What's the advantage of your thing over, say, LDAP?

It's an SSO system, so think LDAP plus a "universal login page" for all your applications. Ours is a stripped down, carefully audited Golang application that does TOTP and U2F.

But, like all modern SSO systems, we (unfortunately) speak SAML --- a godawful protocol, but one we did a from-scratch implementation of to avoid crazy deps.

Re: AWS Single Sign-On

#34
post #33

Earlier quoted context omitted.

What's the advantage of your thing over, say, LDAP?

It's an SSO system, so think LDAP plus a "universal login page" for all your applications. Ours is a stripped down, carefully audited Golang application that does TOTP and U2F. But, like all modern SSO systems, we (unfortunately) speak SAML --- a godawful protocol, but one we did a from-scratch implementation of to avoid crazy deps.

Out of curiosity (and ignorance), why SAML vs JWT or some less awful protocol?

Re: AWS Single Sign-On

#35

I'm trying to understand the use case of this over Cognito for a typical SaaS company. Anyone care to give a brief explanation?

Cognito is for authenticating users while AWS SSO is for authenticating employees. Users don’t usually need to be stored in Active Directory, authenticate to other services with SAML, or assigned groups to control access. AWS SSO should also have better integration with AWS IAM.

Re: AWS Single Sign-On

#36

Wonder if and when we’ll see decent Excel/Word replacements from Amazon, perhaps coupled with a thin Linux distro. At that point you’d be able to completely do away with Microsoft in many organisations, and Amazon could simply gobble up those dollars. They’ve got enough money they could make it work.

Google has been working on that for ~10 years, but still doesn't have a full replacement. Though it's about 80% there - we're a Google Docs office, but about 20% of employees (mostly finance and marketing) need real MS Office products.

This. It'd be a hell of a project for Amazon, considering that they've done nothing in this direction as far as anyone knows, while Google has been working at it for a decade+, and is still a long way from a full replacement.

Re: AWS Single Sign-On

#37
post #33

Earlier quoted context omitted.

What's the advantage of your thing over, say, LDAP?

It's an SSO system, so think LDAP plus a "universal login page" for all your applications. Ours is a stripped down, carefully audited Golang application that does TOTP and U2F. But, like all modern SSO systems, we (unfortunately) speak SAML --- a godawful protocol, but one we did a from-scratch implementation of to avoid crazy deps.

[deleted]

Re: AWS Single Sign-On

#38
post #34
post #33

Earlier quoted context omitted.

It's an SSO system, so think LDAP plus a "universal login page" for all your applications. Ours is a stripped down, carefully audited Golang application that does TOTP and U2F. But, like all modern SSO systems, we (unfortunately) speak SAML --- a godawful protocol, but one we did a from-scratch implementation of to avoid crazy deps.

Out of curiosity (and ignorance), why SAML vs JWT or some less awful protocol?

There is a massive amount of enterprise software on the market which predates JWT, and enough inertia that vendors keep implementing SAML support for new products. It's not going away soon.

Re: AWS Single Sign-On

#39
Nice to see this, one that Google Cloud always had a nice advantage with seamless identities when using G-Suite for productivity and email. I'm expecting the next version to integrate deeper into workspaces/docs/mail so that they reach parity with the other clouds here.

Re: AWS Single Sign-On

#40
post #34
post #33

Earlier quoted context omitted.

It's an SSO system, so think LDAP plus a "universal login page" for all your applications. Ours is a stripped down, carefully audited Golang application that does TOTP and U2F. But, like all modern SSO systems, we (unfortunately) speak SAML --- a godawful protocol, but one we did a from-scratch implementation of to avoid crazy deps.

Out of curiosity (and ignorance), why SAML vs JWT or some less awful protocol?

JWT is also an awful protocol, and it's also not an SSO standard. There's still time for us not to bet the farm on JWT, and I urge clients to avoid it.
Post reply on HN