Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

AWS Single Sign-On

aws.amazon.com

Post reply on HN
Print view View original

61–70 of 119 posts

Re: AWS Single Sign-On

#61

Post by unkoman »

aynsof wrote: post #7

I tested this out just yesterday. It was fairly easy to set up - enable SSO, create a Directory Service, add a management EC2 instance, and you're pretty much up and running. You've got to set up your own Active Directory using Directory Services, which is $288USD/month minimum for two domain controllers. In order to have MFA for logging into the console (non-negotiable in my opinion), you have to configure your own…

Azure AD to AWS is quite simple:

* Create an AWS Cognito User pool

* Create an Azure AD Enterprise Application

* Set up Azure AD federation to the Cognito User Pool

Re: AWS Single Sign-On

#63

Post by rajivm »

jlgaddis wrote: post #19
timv wrote: post #16

Earlier quoted context omitted.

While there are a thousand reasons to hate SAML, your concerns are not accurate. 1. I guess "relatively new" is a vague term, but SAML v2.0 (the current version) was standardised in March 2005 - it's now 12.5 years old, I don't call that new . 2. SAML is very widely used in certain segments. Every SSO product supports SAML, including cloud vendors like Azure, Google and now AWS, and also specialist vendors like Okta…

> I guess "relatively new" is a vague term, but SAML v2.0 (the current version) was standardised in March 2005 - it's now 12.5 years old, I don't call that new. True, but it's still relatively new to most people, similar to how IPv6 has been around for a few decades but is still "new" to many. > SAML is very widely used in certain segments. Perhaps but it's only been in the last few years that I've been hearing about…

We build non-technical SaaS software targeted at anywhere from pre-IPO to Fortune 25 companies. I'd say SSO is a hard requirement for at least half of our new customers (which to them means SAML 2.0 - ADFS, Azure AD, Okta, OneLogin, etc). And this number has been rapidly growing in the last 2 years as companies become comfortable with using cloud-hosted SaaS solutions rather than on-prem.

While it may not be the prettiest protocol, today it is the only broadly supported SSO option that does not expose your credentials to a third party. LDAP was the way to go at one point, but this only makes sense for on-prem software where you can trust your credentials to flow through.

Also, I am pleasantly surprised by the number of orgs that are introducing regular key-rotation into their SAML iDPs.

Re: AWS Single Sign-On

#64

Post by arekkas »

tptacek wrote: post #29

If this is interesting to you but you're iffy about setting up another directory service or having AWS be your central list of identities for all your apps, we're open sourcing The Identity Mutilator, a Golang SAML IdP, in a couple weeks. It's self-contained (for now) so doesn't depend on AD or LDAP --- just Postgres --- and runs just fine in a tiny Docker container.

As the author of a pluggable OAuth2 & OIDC Provider ( https://github.com/ory/hydra ) I am looking for an OSS IDP that solves just ID management. Is there a URL where I can expect this to land?

Re: AWS Single Sign-On

#65

Post by nl »

jlgaddis wrote: post #14

While this will undoubtedly make a lot of people's lives easier, I'm a bit hesitant to use SAML just yet. SAML is still relatively new, isn't very widely used (AFAICT), and I'm not sure how much security research has been done on the topic thus far. To illustrate, just a few weeks ago there was "a new attack vector discovered that ... enables an attacker to create a ... forged SAML 'authentication object', and authen…

I'd imagine every single Fortune 500 company uses SAML. I'd be surprised if many in the Fortune 5000 didn't use it.

Sailpoint (a large enterprise SSO/SAML vendor) IPOed at $1B in early November. I think they are probably smaller than Ping Identity.

Don't use SAML if you don't have to (it's horrible to program!). But it is very widely adopted.

Re: AWS Single Sign-On

#66

Post by petepete »

dfsegoat wrote: post #27
Johnny555 wrote: post #23

Earlier quoted context omitted.

Google has been working on that for ~10 years, but still doesn't have a full replacement. Though it's about 80% there - we're a Google Docs office, but about 20% of employees (mostly finance and marketing) need real MS Office products.

Sheets... I just.. I can't. I was a business analyst (excel grunt) for 2+ years in a biotech startup. Sheets is just different in enough ways to positively irk even the "casual power user" of Excel, IMO.

Sheets isn't meant to make Excel power users happy. Nothing can without being a shameless clone.

It's for the other 97%. A list here; a table and a chart there. Now to make it look pretty.

Re: AWS Single Sign-On

#67

Post by donselaar »

erikb wrote: post #62

Finally, a 15th standard. Reference: https://xkcd.com/927/

They did not reinvent the wheel here. This is just the SAML 2.0 standard. The only consequence of launching this product is that there is another competitor on the SSO market, which is a good thing I think.

Re: AWS Single Sign-On

#68

Post by thiht »

awalton wrote: post #54
eximius wrote: post #34

Earlier quoted context omitted.

Out of curiosity (and ignorance), why SAML vs JWT or some less awful protocol?

The Enterprise SSO market is close to defacto standardizing around SAML AFAICT. Either your product supports it, or the very large enterprises with very large budgets can't use it, and your competitor that does support SAML gets the dollars instead.

On a side note, is it necesary to use cryptic acronyms like "AFAICT"? If you don't want to write "as far a I can tell", why do you? It's kinda annoying to have to google for abbreviations like that all the time

Re: AWS Single Sign-On

#69

Post by koolba »

thiht wrote: post #68
awalton wrote: post #54

Earlier quoted context omitted.

The Enterprise SSO market is close to defacto standardizing around SAML AFAICT. Either your product supports it, or the very large enterprises with very large budgets can't use it, and your competitor that does support SAML gets the dollars instead.

On a side note, is it necesary to use cryptic acronyms like "AFAICT"? If you don't want to write "as far a I can tell", why do you? It's kinda annoying to have to google for abbreviations like that all the time

It’s more annoying to have to type out the full expression each time you use it. That acronym has been in use on the internet for decades.

Re: AWS Single Sign-On

#70

Post by ownagefool »

mankash666 wrote: post #46
tptacek wrote: post #29

If this is interesting to you but you're iffy about setting up another directory service or having AWS be your central list of identities for all your apps, we're open sourcing The Identity Mutilator, a Golang SAML IdP, in a couple weeks. It's self-contained (for now) so doesn't depend on AD or LDAP --- just Postgres --- and runs just fine in a tiny Docker container.

In your own words, you're a SAML IdP, not an SSO manger, like AWS SSO. I believe you're more akin to AWS Cognito than to AWS SSO. Unless I'm missing something in your description

What's the difference?
Post reply on HN