Federated logins to AWS

Nathan Kinder nkinder at redhat.com
Wed May 27 17:38:21 UTC 2015



On 05/27/2015 10:28 AM, Dmitri Pal wrote:
> On 05/27/2015 01:21 PM, Nathan Kinder wrote:
>>
>> On 05/27/2015 10:17 AM, Nathan Kinder wrote:
>>>
>>> On 05/27/2015 10:11 AM, Simo Sorce wrote:
>>>> On Wed, 2015-05-27 at 09:50 -0700, Nathan Kinder wrote:
>>>>> On 05/27/2015 06:32 AM, John Dennis wrote:
>>>>>> On 05/27/2015 01:43 AM, Eric Heydrick wrote:
>>>>>>> I am attempting to setup SSO with SAML to the AWS Console using the
>>>>>>> guide at [1]. I have Ipsilon configured to auth against FreeIPA
>>>>>>> and can
>>>>>>> login to /idp successfully. My problem is that Amazon expects the
>>>>>>> IdP to
>>>>>>> initiate the login but it seems that Ipsilon expects the SP to
>>>>>>> initiate
>>>>>>> the login. How would I accomplish this with Ipsilon?
>>>>>>>
>>>>>>> -Eric
>>>>>>>
>>>>>>> [1]
>>>>>>> http://docs.aws.amazon.com/STS/latest/UsingSTS/STSMgmtConsole-SAML.html
>>>>>>>
>>>>>> You are correct, the above is not a normal SAML Web SSO flow which at
>>>>>> the moment is all that Ipsilon supports. This can be accomplished
>>>>>> with
>>>>>> SAML ECP logic in your application. Using ECP you would generate an
>>>>>> AuthnRequest message and post it to Ipsilon which then would post
>>>>>> back a
>>>>>> SAML assertion you can POST to AWS. Your application has to be
>>>>>> able to
>>>>>> receive POST messages.
>>>>> This is not an ECP case as far as I can see.  This appears to just be
>>>>> IdP initated SSO:
>>>>>
>>>>>
>>>>> http://docs.oasis-open.org/security/saml/Post2.0/sstc-saml-tech-overview-2.0-cd-02.html#5.1.4.IdP-Initiated%20SSO:%20%20POST%20Binding|outline
>>>>>
>>>>>
>>>>> We would need the ability to register SP links in Ipsilon that can be
>>>>> used to perform IdP initiated SSO when clicked.  The way I see this
>>>>> working would be:
>>>>>
>>>>> - User goes to Ipsilon and logs in.
>>>>>
>>>>> - Registered SPs that support IdP initiated SSO are shown as links.
>>>>>
>>>>> - User clicks on desired SP link, which generates an assertion and
>>>>> does
>>>>> a POST to the SP (using a configurable IdP intiated URL in the SP
>>>>> config)
>>>>>
>>>>>  From a UI/configuration standpoint, I envision a checkbox on the SP
>>>>> config page to enable IdP initiated SSO per-SP.  If this is
>>>>> checked, you
>>>>> can fill in a POST URL and the text to display for the link (a
>>>>> configurable image would be a nice addition too).
>>>> The POST url should come from the SP metadata file (at least by
>>>> default), otherwise I agree.
>>> OK.  I was wondering about that too.  If it's just the normal endpoint
>>> in the SP metadata, we should definitely use it.
>> I've filed a ticket for this in trac:
>>
>>    https://fedorahosted.org/ipsilon/ticket/138
>>
>> This seems like a very good 1.1 candidate.
> 
> Where would that list of SP URLs be displayed? On the first page where
> the picture is?

The picture you are referring to is only seen by admins.  If you go to
Ipsilon and log in as a normal user, you just get a plain page with
almost nothing on it right now.  You'll see what I mean if you try it on
the public demo with a non-admin user.  This is where the links would be
displayed.

> 
>>
>>>> Simo.
>>>>
>>> _______________________________________________
>>> ipsilon mailing list
>>> ipsilon at lists.fedorahosted.org
>>> https://lists.fedorahosted.org/mailman/listinfo/ipsilon
>>>
>> _______________________________________________
>> ipsilon mailing list
>> ipsilon at lists.fedorahosted.org
>> https://lists.fedorahosted.org/mailman/listinfo/ipsilon
> 
> 


More information about the ipsilon mailing list