On 05/27/2015 01:43 AM, Eric Heydrick wrote:
I am attempting to setup SSO with SAML to the AWS Console using the
guide at [1]. I have Ipsilon configured to auth against FreeIPA and can
login to /idp successfully. My problem is that Amazon expects the IdP to
initiate the login but it seems that Ipsilon expects the SP to initiate
the login. How would I accomplish this with Ipsilon?
-Eric
[1]
http://docs.aws.amazon.com/STS/latest/UsingSTS/STSMgmtConsole-SAML.html
You are correct, the above is not a normal SAML Web SSO flow which at
the moment is all that Ipsilon supports. This can be accomplished with
SAML ECP logic in your application. Using ECP you would generate an
AuthnRequest message and post it to Ipsilon which then would post back a
SAML assertion you can POST to AWS. Your application has to be able to
receive POST messages.
We have been actively adding ECP support to Ipsilon, it's almost done
but it's not released yet. But it's coming real soon.
--
John