3 ms·

My personal issue right now is that I have multiple accounts with MFA and there’s no easy way to differentiate them besides this generated account ID in the aut

My personal issue right now is that I have multiple accounts with MFA and there’s no easy way to differentiate them besides this generated account ID in the auth app. This means I have to create some type of mapping table between the ID and the account, or try to remember what’s available

mdaniel 6y ago
Every MFA app I've used has the ability to rename the entry, since the MFA key and the text that are displayed to the user are 100% unrelated to one another. And I recognize that you might not have the correct privilege level to carry it out, but AWS does allow you to create account aliases, which helpfully shows up in the console login URL
- NomDePlum 6y ago
  Exactly what I was about to say. For reference account aliases are documented at: https://docs.aws.amazon.com/sdk-for-javascript/v2/developer-guide/iam-examples-account-aliases.html https://docs.aws.amazon.com/sdk-for-javascript/v2/developer-...
tsimionescu 6y ago
We have a very funny situation in our org, where AWS auth is setup using our MS domain, with app push-based MFA. However, the AWS MFA workflow seems to not know about push based notifications, so it asks for a verification code which can literally be anything. After you provide some code and click Verify, only then does it send the push notification, and the UI just freezes until you either accept the auth request or some timeout happens. Not to mention, we actually have to provide the Domain password in the AWS UI, which seems to go against any kind of security I know...
- vladvasiliu 6y ago
  If you already have an MS domain you could set up SAML login with ADFS (tried this, works fairly well) or AWS SSO if you have a managed AD in AWS (may not be available in your region). Also works very well with AzureAD as the provider, if you use that synced to your on-prem AD.
philliphaydon 6y ago
Can't you just use an account alias? https://docs.aws.amazon.com/IAM/latest/UserGuide/console_account-alias.html https://docs.aws.amazon.com/IAM/latest/UserGuide/console_acc...

mdaniel 6y ago

Every MFA app I've used has the ability to rename the entry, since the MFA key and the text that are displayed to the user are 100% unrelated to one another. And I recognize that you might not have the correct privilege level to carry it out, but AWS does allow you to create account aliases, which helpfully shows up in the console login URL

NomDePlum 6y ago
Exactly what I was about to say. For reference account aliases are documented at: https://docs.aws.amazon.com/sdk-for-javascript/v2/developer-guide/iam-examples-account-aliases.html https://docs.aws.amazon.com/sdk-for-javascript/v2/developer-...

tsimionescu 6y ago

We have a very funny situation in our org, where AWS auth is setup using our MS domain, with app push-based MFA. However, the AWS MFA workflow seems to not know about push based notifications, so it asks for a verification code which can literally be anything. After you provide some code and click Verify, only then does it send the push notification, and the UI just freezes until you either accept the auth request or some timeout happens. Not to mention, we actually have to provide the Domain password in the AWS UI, which seems to go against any kind of security I know...

vladvasiliu 6y ago
If you already have an MS domain you could set up SAML login with ADFS (tried this, works fairly well) or AWS SSO if you have a managed AD in AWS (may not be available in your region). Also works very well with AzureAD as the provider, if you use that synced to your on-prem AD.

philliphaydon 6y ago

Can't you just use an account alias? https://docs.aws.amazon.com/IAM/latest/UserGuide/console_account-alias.html https://docs.aws.amazon.com/IAM/latest/UserGuide/console_acc...