AWS Console and Shib

[Christopher J. Hubing]

Hello fellow shib users,

I recently set up an IDP with a bilateral trust to a single AWS account 
(ARN). I documented the steps at the following URL: 
https://wikispaces.psu.edu/display/AWS/AWS+SSO+with+Shibboleth

Despite the normal vendor annoyances of having to create a custom 
relying party and conform what they think attributes should like like, 
it works reasonably well.

However, with today's Net+/DLT/AWS announcement, I forsee a wave of 
prospective campus AWS customers that want to be able to move their data 
centers into the cloud.

Currently, I have the ARN (Amazon Resource Name) hard coded into the 
attribute resolver. Obviously that won't scale well with having to 
support multiple federated customers (ARNs). I can implement a lookup of 
the ARN in some datastore, but was just wondering if anyone has been 
thinking about this problem and how they might solve it.

-c

______________________________________________________________________
Christopher J. Hubing                Information Technology Services
cjh at psu.edu                          Services and Solutions
+1 814 865 8772                      The Pennsylvania State University
http://www.personal.psu.edu/cjh