Federated logins to AWS
Nathan Kinder
nkinder at redhat.com
Wed May 27 17:38:21 UTC 2015
On 05/27/2015 10:28 AM, Dmitri Pal wrote:
> On 05/27/2015 01:21 PM, Nathan Kinder wrote:
>>
>> On 05/27/2015 10:17 AM, Nathan Kinder wrote:
>>>
>>> On 05/27/2015 10:11 AM, Simo Sorce wrote:
>>>> On Wed, 2015-05-27 at 09:50 -0700, Nathan Kinder wrote:
>>>>> On 05/27/2015 06:32 AM, John Dennis wrote:
>>>>>> On 05/27/2015 01:43 AM, Eric Heydrick wrote:
>>>>>>> I am attempting to setup SSO with SAML to the AWS Console using the
>>>>>>> guide at [1]. I have Ipsilon configured to auth against FreeIPA
>>>>>>> and can
>>>>>>> login to /idp successfully. My problem is that Amazon expects the
>>>>>>> IdP to
>>>>>>> initiate the login but it seems that Ipsilon expects the SP to
>>>>>>> initiate
>>>>>>> the login. How would I accomplish this with Ipsilon?
>>>>>>>
>>>>>>> -Eric
>>>>>>>
>>>>>>> [1]
>>>>>>> http://docs.aws.amazon.com/STS/latest/UsingSTS/STSMgmtConsole-SAML.html
>>>>>>>
>>>>>> You are correct, the above is not a normal SAML Web SSO flow which at
>>>>>> the moment is all that Ipsilon supports. This can be accomplished
>>>>>> with
>>>>>> SAML ECP logic in your application. Using ECP you would generate an
>>>>>> AuthnRequest message and post it to Ipsilon which then would post
>>>>>> back a
>>>>>> SAML assertion you can POST to AWS. Your application has to be
>>>>>> able to
>>>>>> receive POST messages.
>>>>> This is not an ECP case as far as I can see. This appears to just be
>>>>> IdP initated SSO:
>>>>>
>>>>>
>>>>> http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0-cd-02.html#5.1.4.IdP-Initiated%20SSO:%20%20POST%20Binding|outline
>>>>>
>>>>>
>>>>> We would need the ability to register SP links in Ipsilon that can be
>>>>> used to perform IdP initiated SSO when clicked. The way I see this
>>>>> working would be:
>>>>>
>>>>> - User goes to Ipsilon and logs in.
>>>>>
>>>>> - Registered SPs that support IdP initiated SSO are shown as links.
>>>>>
>>>>> - User clicks on desired SP link, which generates an assertion and
>>>>> does
>>>>> a POST to the SP (using a configurable IdP intiated URL in the SP
>>>>> config)
>>>>>
>>>>> From a UI/configuration standpoint, I envision a checkbox on the SP
>>>>> config page to enable IdP initiated SSO per-SP. If this is
>>>>> checked, you
>>>>> can fill in a POST URL and the text to display for the link (a
>>>>> configurable image would be a nice addition too).
>>>> The POST url should come from the SP metadata file (at least by
>>>> default), otherwise I agree.
>>> OK. I was wondering about that too. If it's just the normal endpoint
>>> in the SP metadata, we should definitely use it.
>> I've filed a ticket for this in trac:
>>
>> https://fedorahosted.org/ipsilon/ticket/138
>>
>> This seems like a very good 1.1 candidate.
>
> Where would that list of SP URLs be displayed? On the first page where
> the picture is?
The picture you are referring to is only seen by admins. If you go to
Ipsilon and log in as a normal user, you just get a plain page with
almost nothing on it right now. You'll see what I mean if you try it on
the public demo with a non-admin user. This is where the links would be
displayed.
>
>>
>>>> Simo.
>>>>
>>> _______________________________________________
>>> ipsilon mailing list
>>> ipsilon at lists.fedorahosted.org
>>> https://lists.fedorahosted.org/mailman/listinfo/ipsilon
>>>
>> _______________________________________________
>> ipsilon mailing list
>> ipsilon at lists.fedorahosted.org
>> https://lists.fedorahosted.org/mailman/listinfo/ipsilon
>
>
More information about the ipsilon
mailing list