Institutional Shibboleth IdP with Amazon Web Services SP?

[John C. Pfeifer]

Below are the AttributeDefinitions that I use for AWS.  The roles are defined by membership in LDAP groups.  The “amazonEntitlement” definition takes all the groups that the user is a member of, selects the ones with a particular prefix, strips the prefix and encodes as eduPersonEntitlement.  The “amazonRole” definition takes the values from the previous definition and encodes them the way that amazon expects (my actual template is more complex due to the fact that I use the same attribute-resolver.xml file in dev, qa, & prod).  The “amazonRoleSessionName” definition take the user’s directory id and encodes it an AWS RoleSessionName.



    <resolver:AttributeDefinition id="amazonEntitlement" xsi:type="ad:Mapped" xmlns="urn:mace:shibboleth:2.0:resolver:ad"
                                  sourceAttributeID="ibm-allGroups">
        <resolver:Dependency ref="directory" />
        <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="eduPersonEntitlement" />
        <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="urn:oid:1.3.6.1.4.1.5923.1.1.1.7" friendlyName="eduPersonEntitlement" />
        <ad:DefaultValue passThru="false" />
        <ad:ValueMap>
            <ad:ReturnValue>$1</ad:ReturnValue>
            <ad:SourceValue>uid=webhosting-aws-([^,]+),ou=group,dc=umd,dc=edu</ad:SourceValue>
        </ad:ValueMap>
    </resolver:AttributeDefinition>

    <resolver:AttributeDefinition xsi:type="ad:Template" id="amazonRole" xmlns="urn:mace:shibboleth:2.0:resolver:ad">
        <resolver:Dependency ref="amazonEntitlement" />
        <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="Role" />
        <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="https://aws.amazon.com/SAML/Attributes/Role" friendlyName="Role" />

        <Template>
            #set ( $aws_account = “your-aws-account-number” )
            #set ( $provider = “your-aws-provider-name" )
            arn:aws:iam::${aws_account}:role/shib-${amazonEntitlement},arn:aws:iam::${aws_account}:saml-provider/${provider}
        </Template>

        <SourceAttribute>amazonEntitlement</SourceAttribute>
    </resolver:AttributeDefinition>

    <resolver:AttributeDefinition xsi:type="ad:Simple" id="amazonRoleSessionName" sourceAttributeID="uid">
        <resolver:Dependency ref="directory" />
        <resolver:AttributeEncoder xsi:type="enc:SAML1String" name="RoleSessionName" />
        <resolver:AttributeEncoder xsi:type="enc:SAML2String" name="https://aws.amazon.com/SAML/Attributes/RoleSessionName" friendlyName="RoleSessionName" />
    </resolver:AttributeDefinition>


On Aug 4, 2014, at 12:39 PM, Bryan E. Wooten <bryan.wooten at utah.edu> wrote:

> Hi all,
>  
> We too just got hit with a request for AWS integration.
>  
> We are a bit concerned about the required attributes. Specifically RoleEntitlement and RoleSessionName.
>  
> How did anyone map these?
>  
> All the eduPerson attributes are “not required”.
>  
> Thanks,
>  
> Bryan
>  
> From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of David Bantz
> Sent: Tuesday, July 01, 2014 6:48 PM
> To: Shib Users
> Subject: Institutional Shibboleth IdP with Amazon Web Services SP?
>  
> I’ve been asked whether our IdP can readily support AWS logins as outlined in:
> http://docs.aws.amazon.com/STS/latest/UsingSTS/STSMgmtConsole-SAML.html and
> http://blogs.aws.amazon.com/security/post/TxRTTT5PLUE6B5/How-to-use-Shibboleth-for-single-sign-on-to-the-AWS-Management-Console
>  
> A quick read gave me the impression it should almost straightforward, but I would appreciate hearing from other institutions with generic Shibboleth IdP (i.e., not hosted at AWS) that have succeeded (or failed!) providing institutional authN/attributes to AWS service via institutional IdP.
>  
> Anyone trying to get them in InC?
>  
> David Bantz
> U Alaska
> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net


//
John Pfeifer
Division of Information Technology
University of Maryland, College Park