3 ms·

Tangential: Why Okta over some other provider? GSuite can be used as an SAML provider, can't it?

ejcx 9y ago
I honestly don't know of the feature parity between the two, but we are definitely Okta power-users having added close to 500 apps in the last year. I don't know if we could drive all of the same processes we have built (especially on the HR side) using GSuite.
marcc 9y ago
GSuite can be an IdP for SAML but it’s sometimes limited. AFAIK you can’t use it to connect to AWS using SAML because AWS makes some assumptions about attributes in the identity. I may be wrong here, but I tried to do this a few months ago (with Duo and Yubikeys added in) and was not able to get it working. I ended up using Okta and it was simple.
- debaserab2 9y ago
  You can do it. It feels a little hacky - you have to execute a few actions via gsuites API instead of via a UI. https://aws.amazon.com/blogs/security/how-to-set-up-federated-single-sign-on-to-aws-using-google-apps/ https://aws.amazon.com/blogs/security/how-to-set-up-federate...
- wgjordan 9y ago
  About a year ago, I migrated my team's AWS access from manually-provisioned AWS keys to GSuite authentication, using a combination of SAML and OpenID Connect (OIDC): - Detailed instructions for Google-federated login to the AWS Management Console through SAML are available [1], and worked more or less as described. - CLI/API access is a bit trickier and less thoroughly documented, but is possible using the 'Web Identity Federation' feature [2]. Basically, you generate/refresh temporary AWS credentials by passing a Google OIDC token to the AssumeRoleWithWebIdentity API. The tricky part is keeping both your Google OIDC and AWS STS tokens conveniently refreshed. I wrote some open-source glue code for this that hooks into the AWS Ruby SDK and CLI [3]. It's still a little rough around the edges and not yet extracted into a standalone project, but it's been working well enough for my team over the last year. [1] https://aws.amazon.com/blogs/security/how-to-set-up-federated-single-sign-on-to-aws-using-google-apps/ https://aws.amazon.com/blogs/security/how-to-set-up-federate... [2] https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_oidc.html https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_pr... [3] https://github.com/code-dot-org/code-dot-org/blob/staging/lib/cdo/aws/google_credentials.rb https://github.com/code-dot-org/code-dot-org/blob/staging/li...

ejcx 9y ago

I honestly don't know of the feature parity between the two, but we are definitely Okta power-users having added close to 500 apps in the last year. I don't know if we could drive all of the same processes we have built (especially on the HR side) using GSuite.

marcc 9y ago

GSuite can be an IdP for SAML but it’s sometimes limited. AFAIK you can’t use it to connect to AWS using SAML because AWS makes some assumptions about attributes in the identity. I may be wrong here, but I tried to do this a few months ago (with Duo and Yubikeys added in) and was not able to get it working. I ended up using Okta and it was simple.

debaserab2 9y ago
You can do it. It feels a little hacky - you have to execute a few actions via gsuites API instead of via a UI. https://aws.amazon.com/blogs/security/how-to-set-up-federated-single-sign-on-to-aws-using-google-apps/ https://aws.amazon.com/blogs/security/how-to-set-up-federate...
wgjordan 9y ago
About a year ago, I migrated my team's AWS access from manually-provisioned AWS keys to GSuite authentication, using a combination of SAML and OpenID Connect (OIDC): - Detailed instructions for Google-federated login to the AWS Management Console through SAML are available [1], and worked more or less as described. - CLI/API access is a bit trickier and less thoroughly documented, but is possible using the 'Web Identity Federation' feature [2]. Basically, you generate/refresh temporary AWS credentials by passing a Google OIDC token to the AssumeRoleWithWebIdentity API. The tricky part is keeping both your Google OIDC and AWS STS tokens conveniently refreshed. I wrote some open-source glue code for this that hooks into the AWS Ruby SDK and CLI [3]. It's still a little rough around the edges and not yet extracted into a standalone project, but it's been working well enough for my team over the last year. [1] https://aws.amazon.com/blogs/security/how-to-set-up-federated-single-sign-on-to-aws-using-google-apps/ https://aws.amazon.com/blogs/security/how-to-set-up-federate... [2] https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_oidc.html https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_pr... [3] https://github.com/code-dot-org/code-dot-org/blob/staging/lib/cdo/aws/google_credentials.rb https://github.com/code-dot-org/code-dot-org/blob/staging/li...