<ahref="https://aws.amazon.com"class="urlextern"title="https://aws.amazon.com"rel="nofollow">Amazon Web Services</a> allows one to delegate authentication through SAML2.
<liclass="level1"><divclass="li"> Make sure you have followed the steps <ahref="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_enable-console-saml.html"class="urlextern"title="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_enable-console-saml.html"rel="nofollow">here</a>.</div>
</li>
<liclass="level1"><divclass="li"> Go to <ahref="https://your.portal.com/saml/metadata"class="urlextern"title="https://your.portal.com/saml/metadata"rel="nofollow">https://your.portal.com/saml/metadata</a> and save the resulting file locally.</div>
</li>
<liclass="level1"><divclass="li"> In each AWS account, go to IAM → Identity providers → Create Provider.</div>
</li>
<liclass="level1"><divclass="li"> Select <code><abbrtitle="Security Assertion Markup Language">SAML</abbr></code> as the provider type</div>
</li>
<liclass="level1"><divclass="li"> Choose a name (best if kept consistent between accounts), and then choose the metadata file you saved above.</div>
</li>
<liclass="level1"><divclass="li"> Looking again at the links on the left side of the page, go to Roles → Create role</div>
<liclass="level1"><divclass="li"> Select the provider you just configured, click <code>Allow programmatic and AWSManagement Console access</code> which will fill in the rest of the form for you, then click next.</div>
</li>
<liclass="level1"><divclass="li"> Set whatever permissions you need to and then click <code>Review</code>.</div>
</li>
<liclass="level1"><divclass="li"> Choose a name for the role. These will shown to people when they log in, so make them descriptive. We have different accounts for different regions of the world, so I put the region into the role name so people know which account is which.</div>
</li>
</ul>
<divclass="noteclassic">If you have only one role, the configuration is simple. If you have multiple
roles for different people, it is a little trickier. As you will see, the <abbrtitle="Security Assertion Markup Language">SAML</abbr>
attributes are not dynamic, so you have to set them in the session when a user
logs in or use a custom function. In this example, I wanted to avoid managing
custom functions on all the servers, so the <abbrtitle="Security Assertion Markup Language">SAML</abbr> attributes are set in
the session. We also use LDAP for user information, so I will describe that.
In our LDAP tree, each user has attributes which are used quite heavily for
dynamic groups and authorisation. You will want something
similar, using whatever attribute makes sense to you. For example:<preclass="code file ldif"><spanclass="re0">dn</span>:<spanclass="re1"> uid=user,ou=people,dc=your,dc=com</span>
<liclass="level1"><divclass="li"> Assuming you use the web interface to manage lemonldap, go to General Parameters → Authentication parameters → LDAP parameters → Exported variables. Here set the key to the LDAP attribute and the value to something sensible. I keep them the same to make it easy.</div>
</li>
<liclass="level1"><divclass="li"> Now go to *Variables → Macros*. Here set up variables which will be computed based on the attributes you exported above. You will need to emit strings in this format <code>arn:aws:iam::account-number:role/role-name1,arn:aws:iam::account-number:saml-provider/provider-name</code>. The parts you need to change are <code>account-number</code>, <code>role-name1</code> and <code>provier-name</code>. The last two will be the provider name and role names you just set up in AWS.</div>
</li>
<liclass="level1"><divclass="li"> Perl works in here, so something like this is valid: <code>aws_eu_role</code> → <code>$ou =~ sysadmin ? “arn:aws…” : “arn:…”</code></div>
</li>
<liclass="level1"><divclass="li"> If it easier, split multiple roles into different macros. Then tie all the variables you define together into one string concatenating them with whatever is in General Parameters → Advanced Parameters → Separator. Actually click into this field and move around with the arrow keys to see if there is a space, since spaces can be part of the separator.</div>
</li>
<liclass="level1"><divclass="li"> Remember macros are defined alphanumerically, so you want one right at the end, like <code>z_aws_roles</code> → <code>join(“; ”, $role_name1, $role_name2, …)</code></div>
</li>
<liclass="level1"><divclass="li"> On the left again, click <code><abbrtitle="Security Assertion Markup Language">SAML</abbr> service providers</code>, then <code>Add <abbrtitle="Security Assertion Markup Language">SAML</abbr> SP</code>.</div>
</li>
<liclass="level1"><divclass="li"> Enter a name, click ok, then select it on the left. Select <code>Metadata</code>, then enter `<ahref="https://signin.aws.amazon.com/static/saml-metadata.xml"class="urlextern"title="https://signin.aws.amazon.com/static/saml-metadata.xml"rel="nofollow">https://signin.aws.amazon.com/static/saml-metadata.xml</a>` in the <code><abbrtitle="Uniform Resource Locator">URL</abbr></code> field, then click load.</div>
</li>
<liclass="level1"><divclass="li"> Click <code>Exported attributes</code> on the left, then <code>Add attribute</code> twice to add two attributes. The first field is the name of a variable set in the user's session:</div>
<ul>
<liclass="level2"><divclass="li"><code>_whatToTrace</code> → <code><ahref="https://aws.amazon.com/SAML/Attributes/RoleSessionName"class="urlextern"title="https://aws.amazon.com/SAML/Attributes/RoleSessionName"rel="nofollow">https://aws.amazon.com/SAML/Attributes/RoleSessionName</a></code> (leave the rest)</div>
</li>
<liclass="level2"><divclass="li"><code>z_aws_roles</code> (the macro name you defined above) → <code><ahref="https://aws.amazon.com/SAML/Attributes/Role"class="urlextern"title="https://aws.amazon.com/SAML/Attributes/Role"rel="nofollow">https://aws.amazon.com/SAML/Attributes/Role</a></code> (leave the rest)</div>
</li>
</ul>
</li>
<liclass="level1"><divclass="li"> On the left, select Options → Security → Enable use of IDP initiated <abbrtitle="Uniform Resource Locator">URL</abbr> → On</div>
</li>
<liclass="level1"><divclass="li"> Select General Parameters → Portal → Menu → Categories and applications</div>
</li>
<liclass="level1"><divclass="li"> Select a category or create a new one if you need to. Then click <code>New application</code>. </div>
</li>
<liclass="level1"><divclass="li"> Enter a name etc. For the <abbrtitle="Uniform Resource Locator">URL</abbr>, use <code><ahref="https://your.portal.com/saml/singleSignOn?IDPInitiated=1&sp=urn:amazon:webservices"class="urlextern"title="https://your.portal.com/saml/singleSignOn?IDPInitiated=1&sp=urn:amazon:webservices"rel="nofollow">https://your.portal.com/saml/singleSignOn?IDPInitiated=1&sp=urn:amazon:webservices</a></code></div>
</li>
<liclass="level1"><divclass="li"> Display application should be set to <code>Enabled</code></div>
</li>
<liclass="level1"><divclass="li"> Go to your portal, click on the link, and check that it works!</div>