On 05/27/2015 06:32 AM, John Dennis wrote:
On 05/27/2015 01:43 AM, Eric Heydrick wrote:
> I am attempting to setup SSO with SAML to the AWS Console using the
> guide at [1]. I have Ipsilon configured to auth against FreeIPA and can
> login to /idp successfully. My problem is that Amazon expects the IdP to
> initiate the login but it seems that Ipsilon expects the SP to initiate
> the login. How would I accomplish this with Ipsilon?
>
> -Eric
>
> [1]
http://docs.aws.amazon.com/STS/latest/UsingSTS/STSMgmtConsole-SAML.html
You are correct, the above is not a normal SAML Web SSO flow which at
the moment is all that Ipsilon supports. This can be accomplished with
SAML ECP logic in your application. Using ECP you would generate an
AuthnRequest message and post it to Ipsilon which then would post back a
SAML assertion you can POST to AWS. Your application has to be able to
receive POST messages.
This is not an ECP case as far as I can see. This appears to just be
IdP initated SSO:
http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-...
We would need the ability to register SP links in Ipsilon that can be
used to perform IdP initiated SSO when clicked. The way I see this
working would be:
- User goes to Ipsilon and logs in.
- Registered SPs that support IdP initiated SSO are shown as links.
- User clicks on desired SP link, which generates an assertion and does
a POST to the SP (using a configurable IdP intiated URL in the SP config)
From a UI/configuration standpoint, I envision a checkbox on the SP
config page to enable IdP initiated SSO per-SP. If this is checked, you
can fill in a POST URL and the text to display for the link (a
configurable image would be a nice addition too).
Thanks,
-NGK