21 ms·

AWS Single Sign-On

212 points by yeukhon 9y ago

yeukhon 9y ago
Here is a blog post on AWS SSO. https://aws.amazon.com/blogs/security/introducing-aws-single-sign-on/ https://aws.amazon.com/blogs/security/introducing-aws-single... Would have been so smooth and so nice before implementing custom SSO...
youdontknowtho 9y ago
looking forward to kicking the tires. i think that companies like Amazon's are the one's with the scale needed to do thus well.
davidu 9y ago
Update: I realize now this is Amazon offering SSO services, not just supporting SAML / Federated authentication. Ignore rest of my comment: Proof you can build a massive, multi-billion dollar enterprise business without supporting SSO. I would not have immediately guessed that statement to be true, and I would have thought AWS already had SSO support.
- mrkurt 9y ago
  It helps if you have a massive, multi billion dollar consumer business everyone's already registered with.
- BillinghamJ 9y ago
  It was always pretty easy to build yourself with their federated auth system. Nice to have proper support now though. Edit: no, it still isn’t really anything like what I’m wanting. This particular product requires Microsoft AD. I just want our admins to be able to log into AWS via google apps. :(
  - will_hughes 9y ago
    You should be able to do this already[1]. What issues are you having? [1] https://support.google.com/a/answer/6194963 https://support.google.com/a/answer/6194963 via http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_saml_3rd-party.html http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_pro...
    - BillinghamJ 9y ago
      Thank you very much for those links. After a couple of hours of messing around I have managed to get that working well. :)
    - toddgower 9y ago
      I want the ability to use Google/G-Suite as an identity provider to log into multiple AWS accounts. We have dev and prod workloads that run in completely separate AWS accounts. I want to be able to use Google SSO and the ability to select which AWS account to log into
      - will_hughes 9y ago
        I don't have access to a G-Suite account to test this with, but afaict you should be able to do this by just adding each AWS account in turn and giving it a different Application Name and description in the G-Suite interface.
aynsof 9y ago
I tested this out just yesterday. It was fairly easy to set up - enable SSO, create a Directory Service, add a management EC2 instance, and you're pretty much up and running. You've got to set up your own Active Directory using Directory Services, which is $288USD/month minimum for two domain controllers. In order to have MFA for logging into the console (non-negotiable in my opinion), you have to configure your own RADIUS server. And the question of how to manage access keypairs still remains unanswered, as far as I can tell. I don't know if this is going to supplant Azure AD as our SSO method of choice.
- yeukhon 9y ago
  Hmm how did you calculate the DC to be $288 for total of two? I believe you can use AD connector to connect to on-premise AD.
  - aynsof 9y ago
    $288 comes from here: https://aws.amazon.com/directoryservice/pricing/ https://aws.amazon.com/directoryservice/pricing/ It looks like AD Connector is much less: https://aws.amazon.com/directoryservice/other-directories-pricing/ https://aws.amazon.com/directoryservice/other-directories-pr...
    - Johnny555 9y ago
      I think you're looking at the Enterprise domain controller pricing. the Standard size (up to 30,000 objects) is 12 cents/hour for two controllers. $0.12 * 24 * 30 = $86.40/month.
      - aynsof 9y ago
        You're right! Thanks for the pick-up. I'd change the statement in my parent post, but I don't seem to be able to edit it.
- unkoman 9y ago
  Azure AD to AWS is quite simple: * Create an AWS Cognito User pool * Create an Azure AD Enterprise Application * Set up Azure AD federation to the Cognito User Pool
tptacek 9y ago
If this is interesting to you but you're iffy about setting up another directory service or having AWS be your central list of identities for all your apps, we're open sourcing The Identity Mutilator, a Golang SAML IdP, in a couple weeks. It's self-contained (for now) so doesn't depend on AD or LDAP --- just Postgres --- and runs just fine in a tiny Docker container.
- angersock 9y ago
  What's the advantage of your thing over, say, LDAP?
  - tptacek 9y ago
    It's an SSO system, so think LDAP plus a "universal login page" for all your applications. Ours is a stripped down, carefully audited Golang application that does TOTP and U2F. But, like all modern SSO systems, we (unfortunately) speak SAML --- a godawful protocol, but one we did a from-scratch implementation of to avoid crazy deps.
    - eximius 9y ago
      Out of curiosity (and ignorance), why SAML vs JWT or some less awful protocol?
      - jvoorhis 9y ago
        There is a massive amount of enterprise software on the market which predates JWT, and enough inertia that vendors keep implementing SAML support for new products. It's not going away soon.
      - tptacek 9y ago
        JWT is also an awful protocol, and it's also not an SSO standard. There's still time for us not to bet the farm on JWT, and I urge clients to avoid it.
        9y ago
geofft 9y ago
I'm a little confused at the third-party thing - is AWS generating SAML assertions based on your internal AD that it sends to other websites like Box or Office 365 or Slack? Why would you want AWS in the loop? Is this an alternative to running ADFS? I guess the fact that you're not running ADFS servers is nice, but as far as I understand, your ADFS servers don't have to be publicly facing. (And honestly, not being able to sign in using corporate credentials if you're not on the corporate network is a security policy that will make lots of admins happy.) It looks like there's an old AWS blog post about using ADFS to enable SSO to AWS: https://aws.amazon.com/blogs/security/enabling-federation-to-aws-using-windows-active-directory-adfs-and-saml-2-0/ https://aws.amazon.com/blogs/security/enabling-federation-to...
- Spooky23 9y ago
  AWS SSO looks to be an IdP (identity provider) which maps artifacts from AD like ldap groups to entitle access to trusted service providers. This would be an alternative to ADFS. It solves a big problem, because for many customers of cloud services, you’re paying for 99.9% reliability from the service provider, but the ADFS farm in your office or in another cloud is a single point of failure with a lower uptime commitment.
intrasight 9y ago
I'm trying to understand the use case of this over Cognito for a typical SaaS company. Anyone care to give a brief explanation?
- ianburrell 9y ago
  Cognito is for authenticating users while AWS SSO is for authenticating employees. Users don’t usually need to be stored in Active Directory, authenticate to other services with SAML, or assigned groups to control access. AWS SSO should also have better integration with AWS IAM.
  - intrasight 9y ago
    Everyone is a user, and most are employees. So that doesn't really answer my question. Users need to be stored somewhere. The question is, is AD a good place to store them. AD is a standard, is flexible, and has been around a long time. So perhaps I should ask the question "Now that we have AWS SSO, why would I use Cognito?"
    - dbolgheroni 9y ago
      This blog post has a good explanation: https://stormpath.com/blog/sso-vs-centralized-auth https://stormpath.com/blog/sso-vs-centralized-auth
  - yeukhon 9y ago
    In some AWS blog posts, AWS discussed how to build a single sign on using cognito.
psergeant 9y ago
Wonder if and when we’ll see decent Excel/Word replacements from Amazon, perhaps coupled with a thin Linux distro. At that point you’d be able to completely do away with Microsoft in many organisations, and Amazon could simply gobble up those dollars. They’ve got enough money they could make it work.
- chx 9y ago
  Never. Can't happen. See, while it is true that 80% of the people only use 20% of the features but it is not the same 20%! The only viable Excel replacement would need to have the exact same functionality pile.
- Johnny555 9y ago
  Google has been working on that for ~10 years, but still doesn't have a full replacement. Though it's about 80% there - we're a Google Docs office, but about 20% of employees (mostly finance and marketing) need real MS Office products.
  - dfsegoat 9y ago
    Sheets... I just.. I can't. I was a business analyst (excel grunt) for 2+ years in a biotech startup. Sheets is just different in enough ways to positively irk even the "casual power user" of Excel, IMO.
    - petepete 9y ago
      Sheets isn't meant to make Excel power users happy. Nothing can without being a shameless clone. It's for the other 97%. A list here; a table and a chart there. Now to make it look pretty.
  - ufmace 9y ago
    This. It'd be a hell of a project for Amazon, considering that they've done nothing in this direction as far as anyone knows, while Google has been working at it for a decade+, and is still a long way from a full replacement.
jlgaddis 9y ago
While this will undoubtedly make a lot of people's lives easier, I'm a bit hesitant to use SAML just yet. SAML is still relatively new, isn't very widely used (AFAICT), and I'm not sure how much security research has been done on the topic thus far. To illustrate, just a few weeks ago there was "a new attack vector discovered that ... enables an attacker to create a ... forged SAML 'authentication object', and authenticate across every service that uses SAML 2.0 protocol ..." [0]. > In a golden SAML attack, attackers can gain access to any application that supports SAML authentication (e.g. Azure, AWS, vSphere, etc.) with any privileges they desire and be any user on the targeted application (even one that is non-existent in the application in some cases). Vulnerabilities like this one really do give up the proverbial "keys to the kingdom" and provide an attacker with pretty much everything they need to really ruin your day. Now, this particular attack isn't real practical as it requires things like the "token-signing private key". You don't need domain admin although you do need access to the ADFS account and if an attacker has access to that, well, you're probably already screwed (or well on your way). The point is that SAML is still shiny and new and there will almost certainly be additional flaws found in the future -- flaws which may very well compromise you completely. It's certainly a nice solution to a big problem and, as I said, will make a lot of people's lives easier. I'm just not yet ready to trust it 100%. Edit: To prevent a dozen more "2005!?" comments, I mentioned this in a reply: > True, but it's still relatively new to most people, similar to how IPv6 has been around for a few decades but is still "new" to many. The spec has been around for a while. Common deployments -- outside of AWS, MS, RH, etc., haven't (unless I've just been unaware of them). [0]: https://www.cyberark.com/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-cloud-apps/ https://www.cyberark.com/threat-research-blog/golden-saml-ne...
- Spooky23 9y ago
  You might want to double check those facts. There are probably billions of SAML users. Any significant O365 implementation is using SAML. Any SaaS that allows enterprise login is using SAML. If you do business with Spectrum, you are using SAML when you login. If you interact with most government agencies, you are using SAML. That’s not to say that it does not have risk, but adoption is not an issue!
reilly3000 9y ago
Sad day for Saml SSO vendors I guess. I know I would pick this next time over auth0/stormpath/one login because it’s free.
- actualanswer 9y ago
  But would you though? They only integrate with AD and looks like they are trying to address a gap that AWS has with managing access to resources. These other IdaaS have a lot more functionality.
manigandham 9y ago
Nice to see this, one that Google Cloud always had a nice advantage with seamless identities when using G-Suite for productivity and email. I'm expecting the next version to integrate deeper into workspaces/docs/mail so that they reach parity with the other clouds here.
fulafel 9y ago
What's the advantage of SAML over Kerberos?
- mmalone 9y ago
  Kerberos / Needham-Schroeder usually refers to an authenticated encryption protocol that uses symmetric keys (shared secrets). It lets two parties who have never communicated, but who both mutually trust some third party, establish one another’s identities and negotiate a symmetric key for encrypted communication. The SAML core is an XML-based system for serializing, signing, and encrypting assertions. There are also SAML flows, and they likely use something Kerberos-esque. So SAML is to Kerberos what HTML is to HTTP, or what x.509 is to TLS, or something like that.
msoad 9y ago
Can SSO be used for SSH like Google Cloud? That's the coolest thing I miss from Google Cloud
- mmalone 9y ago
  Are you talking about the `gcloud compute ssh` stuff? I wonder what magic google is using to grt public keys on boxes. I’d think there’d have to be some coordination with the machine image being run for this to work, so it wouldn’t be something Amazon could just turn on for everybody. You could probably roll your own using an SSH CA though.
  - lmz 9y ago
    They have daemons running to manage that and do stuff like add IP addresses when IP forwarding rules are added; https://github.com/GoogleCloudPlatform/compute-image-packages https://github.com/GoogleCloudPlatform/compute-image-package...
    - mmalone 9y ago
      Daemons running on user VMs? Or is ssh terminated in a bastion and forwarded somehow? Edit: sorry didn’t read far enough and have now answered my own question. In VMs. So yea, Amazon could not duplicate without getting people to change AMIs or install some agent. Still seems like an SSH CA is a better option. Curious why google didn’t go that route. Maybe not an option when they built this?
- exidy 9y ago
  I have successfully integrated Okta SSO to SSH via Hashicorp Vault, using it as a SSH CA to issue short-lived SSH certificates.
erikb 9y ago
Finally, a 15th standard. Reference: https://xkcd.com/927/ https://xkcd.com/927/
- donselaar 9y ago
  They did not reinvent the wheel here. This is just the SAML 2.0 standard. The only consequence of launching this product is that there is another competitor on the SSO market, which is a good thing I think.
  - erikb 9y ago
    Technically true. But when it comes to writing a website, do you plan to add "SAML 2.0 auth" or "Google SSO, Facebook SSO, Amazon SSO"? I think all need to be configured, tested and debugged, even if they are based on the same communication protocol.
MSeven 9y ago
PSA: Remember to keep your contact data up to date when using 2FA. I lost my phone 2 weeks ago and i lost access to the reauth phone number years ago. I have not been able to get this resolved all this time. The German Website support is clueless about 2FA (that was recently introduced) and AWS support wants a form signed by an US Notary (which are hard to come by in Germany).... Really annoying
cratermoon 9y ago
Ugh SAML
mcculley 9y ago
This is confusing. Does this thing speak LDAP or provide a way to add an LDAP adapter? I would love to move my LDAP server into a hosted service.
- mcculley 9y ago
  Ah. Never mind. I see now that it requires AD as a prerequisite.

212 points by yeukhon 9y ago

Here is a blog post on AWS SSO. https://aws.amazon.com/blogs/security/introducing-aws-single-sign-on/ https://aws.amazon.com/blogs/security/introducing-aws-single... Would have been so smooth and so nice before implementing custom SSO...

youdontknowtho 9y ago

looking forward to kicking the tires. i think that companies like Amazon's are the one's with the scale needed to do thus well.

davidu 9y ago

Update: I realize now this is Amazon offering SSO services, not just supporting SAML / Federated authentication. Ignore rest of my comment: Proof you can build a massive, multi-billion dollar enterprise business without supporting SSO. I would not have immediately guessed that statement to be true, and I would have thought AWS already had SSO support.

mrkurt 9y ago
It helps if you have a massive, multi billion dollar consumer business everyone's already registered with.
BillinghamJ 9y ago
It was always pretty easy to build yourself with their federated auth system. Nice to have proper support now though. Edit: no, it still isn’t really anything like what I’m wanting. This particular product requires Microsoft AD. I just want our admins to be able to log into AWS via google apps. :(
- will_hughes 9y ago
  You should be able to do this already[1]. What issues are you having? [1] https://support.google.com/a/answer/6194963 https://support.google.com/a/answer/6194963 via http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_saml_3rd-party.html http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_pro...
  - BillinghamJ 9y ago
    Thank you very much for those links. After a couple of hours of messing around I have managed to get that working well. :)
  - toddgower 9y ago
    I want the ability to use Google/G-Suite as an identity provider to log into multiple AWS accounts. We have dev and prod workloads that run in completely separate AWS accounts. I want to be able to use Google SSO and the ability to select which AWS account to log into
    - will_hughes 9y ago
      I don't have access to a G-Suite account to test this with, but afaict you should be able to do this by just adding each AWS account in turn and giving it a different Application Name and description in the G-Suite interface.

aynsof 9y ago

I tested this out just yesterday. It was fairly easy to set up - enable SSO, create a Directory Service, add a management EC2 instance, and you're pretty much up and running. You've got to set up your own Active Directory using Directory Services, which is $288USD/month minimum for two domain controllers. In order to have MFA for logging into the console (non-negotiable in my opinion), you have to configure your own RADIUS server. And the question of how to manage access keypairs still remains unanswered, as far as I can tell. I don't know if this is going to supplant Azure AD as our SSO method of choice.

yeukhon 9y ago
Hmm how did you calculate the DC to be $288 for total of two? I believe you can use AD connector to connect to on-premise AD.
- aynsof 9y ago
  $288 comes from here: https://aws.amazon.com/directoryservice/pricing/ https://aws.amazon.com/directoryservice/pricing/ It looks like AD Connector is much less: https://aws.amazon.com/directoryservice/other-directories-pricing/ https://aws.amazon.com/directoryservice/other-directories-pr...
  - Johnny555 9y ago
    I think you're looking at the Enterprise domain controller pricing. the Standard size (up to 30,000 objects) is 12 cents/hour for two controllers. $0.12 * 24 * 30 = $86.40/month.
    - aynsof 9y ago
      You're right! Thanks for the pick-up. I'd change the statement in my parent post, but I don't seem to be able to edit it.
unkoman 9y ago
Azure AD to AWS is quite simple: * Create an AWS Cognito User pool * Create an Azure AD Enterprise Application * Set up Azure AD federation to the Cognito User Pool

tptacek 9y ago

If this is interesting to you but you're iffy about setting up another directory service or having AWS be your central list of identities for all your apps, we're open sourcing The Identity Mutilator, a Golang SAML IdP, in a couple weeks. It's self-contained (for now) so doesn't depend on AD or LDAP --- just Postgres --- and runs just fine in a tiny Docker container.

angersock 9y ago
What's the advantage of your thing over, say, LDAP?
- tptacek 9y ago
  It's an SSO system, so think LDAP plus a "universal login page" for all your applications. Ours is a stripped down, carefully audited Golang application that does TOTP and U2F. But, like all modern SSO systems, we (unfortunately) speak SAML --- a godawful protocol, but one we did a from-scratch implementation of to avoid crazy deps.
  - eximius 9y ago
    Out of curiosity (and ignorance), why SAML vs JWT or some less awful protocol?
    - jvoorhis 9y ago
      There is a massive amount of enterprise software on the market which predates JWT, and enough inertia that vendors keep implementing SAML support for new products. It's not going away soon.
    - tptacek 9y ago
      JWT is also an awful protocol, and it's also not an SSO standard. There's still time for us not to bet the farm on JWT, and I urge clients to avoid it.
      - 9y ago

geofft 9y ago

I'm a little confused at the third-party thing - is AWS generating SAML assertions based on your internal AD that it sends to other websites like Box or Office 365 or Slack? Why would you want AWS in the loop? Is this an alternative to running ADFS? I guess the fact that you're not running ADFS servers is nice, but as far as I understand, your ADFS servers don't have to be publicly facing. (And honestly, not being able to sign in using corporate credentials if you're not on the corporate network is a security policy that will make lots of admins happy.) It looks like there's an old AWS blog post about using ADFS to enable SSO to AWS: https://aws.amazon.com/blogs/security/enabling-federation-to-aws-using-windows-active-directory-adfs-and-saml-2-0/ https://aws.amazon.com/blogs/security/enabling-federation-to...

Spooky23 9y ago
AWS SSO looks to be an IdP (identity provider) which maps artifacts from AD like ldap groups to entitle access to trusted service providers. This would be an alternative to ADFS. It solves a big problem, because for many customers of cloud services, you’re paying for 99.9% reliability from the service provider, but the ADFS farm in your office or in another cloud is a single point of failure with a lower uptime commitment.

intrasight 9y ago

I'm trying to understand the use case of this over Cognito for a typical SaaS company. Anyone care to give a brief explanation?

ianburrell 9y ago
Cognito is for authenticating users while AWS SSO is for authenticating employees. Users don’t usually need to be stored in Active Directory, authenticate to other services with SAML, or assigned groups to control access. AWS SSO should also have better integration with AWS IAM.
- intrasight 9y ago
  Everyone is a user, and most are employees. So that doesn't really answer my question. Users need to be stored somewhere. The question is, is AD a good place to store them. AD is a standard, is flexible, and has been around a long time. So perhaps I should ask the question "Now that we have AWS SSO, why would I use Cognito?"
  - dbolgheroni 9y ago
    This blog post has a good explanation: https://stormpath.com/blog/sso-vs-centralized-auth https://stormpath.com/blog/sso-vs-centralized-auth
- yeukhon 9y ago
  In some AWS blog posts, AWS discussed how to build a single sign on using cognito.

psergeant 9y ago

Wonder if and when we’ll see decent Excel/Word replacements from Amazon, perhaps coupled with a thin Linux distro. At that point you’d be able to completely do away with Microsoft in many organisations, and Amazon could simply gobble up those dollars. They’ve got enough money they could make it work.

chx 9y ago
Never. Can't happen. See, while it is true that 80% of the people only use 20% of the features but it is not the same 20%! The only viable Excel replacement would need to have the exact same functionality pile.
Johnny555 9y ago
Google has been working on that for ~10 years, but still doesn't have a full replacement. Though it's about 80% there - we're a Google Docs office, but about 20% of employees (mostly finance and marketing) need real MS Office products.
- dfsegoat 9y ago
  Sheets... I just.. I can't. I was a business analyst (excel grunt) for 2+ years in a biotech startup. Sheets is just different in enough ways to positively irk even the "casual power user" of Excel, IMO.
  - petepete 9y ago
    Sheets isn't meant to make Excel power users happy. Nothing can without being a shameless clone. It's for the other 97%. A list here; a table and a chart there. Now to make it look pretty.
- ufmace 9y ago
  This. It'd be a hell of a project for Amazon, considering that they've done nothing in this direction as far as anyone knows, while Google has been working at it for a decade+, and is still a long way from a full replacement.

jlgaddis 9y ago

While this will undoubtedly make a lot of people's lives easier, I'm a bit hesitant to use SAML just yet. SAML is still relatively new, isn't very widely used (AFAICT), and I'm not sure how much security research has been done on the topic thus far. To illustrate, just a few weeks ago there was "a new attack vector discovered that ... enables an attacker to create a ... forged SAML 'authentication object', and authenticate across every service that uses SAML 2.0 protocol ..." [0]. > In a golden SAML attack, attackers can gain access to any application that supports SAML authentication (e.g. Azure, AWS, vSphere, etc.) with any privileges they desire and be any user on the targeted application (even one that is non-existent in the application in some cases). Vulnerabilities like this one really do give up the proverbial "keys to the kingdom" and provide an attacker with pretty much everything they need to really ruin your day. Now, this particular attack isn't real practical as it requires things like the "token-signing private key". You don't need domain admin although you do need access to the ADFS account and if an attacker has access to that, well, you're probably already screwed (or well on your way). The point is that SAML is still shiny and new and there will almost certainly be additional flaws found in the future -- flaws which may very well compromise you completely. It's certainly a nice solution to a big problem and, as I said, will make a lot of people's lives easier. I'm just not yet ready to trust it 100%. Edit: To prevent a dozen more "2005!?" comments, I mentioned this in a reply: > True, but it's still relatively new to most people, similar to how IPv6 has been around for a few decades but is still "new" to many. The spec has been around for a while. Common deployments -- outside of AWS, MS, RH, etc., haven't (unless I've just been unaware of them). [0]: https://www.cyberark.com/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-cloud-apps/ https://www.cyberark.com/threat-research-blog/golden-saml-ne...

Spooky23 9y ago
You might want to double check those facts. There are probably billions of SAML users. Any significant O365 implementation is using SAML. Any SaaS that allows enterprise login is using SAML. If you do business with Spectrum, you are using SAML when you login. If you interact with most government agencies, you are using SAML. That’s not to say that it does not have risk, but adoption is not an issue!

reilly3000 9y ago

Sad day for Saml SSO vendors I guess. I know I would pick this next time over auth0/stormpath/one login because it’s free.

actualanswer 9y ago
But would you though? They only integrate with AD and looks like they are trying to address a gap that AWS has with managing access to resources. These other IdaaS have a lot more functionality.

manigandham 9y ago

Nice to see this, one that Google Cloud always had a nice advantage with seamless identities when using G-Suite for productivity and email. I'm expecting the next version to integrate deeper into workspaces/docs/mail so that they reach parity with the other clouds here.

fulafel 9y ago

What's the advantage of SAML over Kerberos?

mmalone 9y ago
Kerberos / Needham-Schroeder usually refers to an authenticated encryption protocol that uses symmetric keys (shared secrets). It lets two parties who have never communicated, but who both mutually trust some third party, establish one another’s identities and negotiate a symmetric key for encrypted communication. The SAML core is an XML-based system for serializing, signing, and encrypting assertions. There are also SAML flows, and they likely use something Kerberos-esque. So SAML is to Kerberos what HTML is to HTTP, or what x.509 is to TLS, or something like that.

msoad 9y ago

Can SSO be used for SSH like Google Cloud? That's the coolest thing I miss from Google Cloud

mmalone 9y ago
Are you talking about the `gcloud compute ssh` stuff? I wonder what magic google is using to grt public keys on boxes. I’d think there’d have to be some coordination with the machine image being run for this to work, so it wouldn’t be something Amazon could just turn on for everybody. You could probably roll your own using an SSH CA though.
- lmz 9y ago
  They have daemons running to manage that and do stuff like add IP addresses when IP forwarding rules are added; https://github.com/GoogleCloudPlatform/compute-image-packages https://github.com/GoogleCloudPlatform/compute-image-package...
  - mmalone 9y ago
    Daemons running on user VMs? Or is ssh terminated in a bastion and forwarded somehow? Edit: sorry didn’t read far enough and have now answered my own question. In VMs. So yea, Amazon could not duplicate without getting people to change AMIs or install some agent. Still seems like an SSH CA is a better option. Curious why google didn’t go that route. Maybe not an option when they built this?
exidy 9y ago
I have successfully integrated Okta SSO to SSH via Hashicorp Vault, using it as a SSH CA to issue short-lived SSH certificates.

erikb 9y ago

Finally, a 15th standard. Reference: https://xkcd.com/927/ https://xkcd.com/927/

donselaar 9y ago
They did not reinvent the wheel here. This is just the SAML 2.0 standard. The only consequence of launching this product is that there is another competitor on the SSO market, which is a good thing I think.
- erikb 9y ago
  Technically true. But when it comes to writing a website, do you plan to add "SAML 2.0 auth" or "Google SSO, Facebook SSO, Amazon SSO"? I think all need to be configured, tested and debugged, even if they are based on the same communication protocol.

MSeven 9y ago

PSA: Remember to keep your contact data up to date when using 2FA. I lost my phone 2 weeks ago and i lost access to the reauth phone number years ago. I have not been able to get this resolved all this time. The German Website support is clueless about 2FA (that was recently introduced) and AWS support wants a form signed by an US Notary (which are hard to come by in Germany).... Really annoying

cratermoon 9y ago

Ugh SAML

mcculley 9y ago

This is confusing. Does this thing speak LDAP or provide a way to add an LDAP adapter? I would love to move my LDAP server into a hosted service.

mcculley 9y ago
Ah. Never mind. I see now that it requires AD as a prerequisite.