AWS Console and Shib

[David Bantz]

I won’t call it a solution, but we’re putting putting people into groups for different ARN + role combinations,
then using group membership to build the SAML attribute values needed by AWS.  You could say we’ve
just pushed the maintenance issue from one system (the IdP) to another (group membership).

David Bantz


On Wed, 1 Oct 2014, at 17:26 , Christopher J. Hubing <cjh at psu.edu> wrote:

> 
> Hello fellow shib users,
> 
> I recently set up an IDP with a bilateral trust to a single AWS account 
> (ARN). I documented the steps at the following URL: 
> https://wikispaces.psu.edu/display/AWS/AWS+SSO+with+Shibboleth
> 
> Despite the normal vendor annoyances of having to create a custom 
> relying party and conform what they think attributes should like like, 
> it works reasonably well.
> 
> However, with today's Net+/DLT/AWS announcement, I forsee a wave of 
> prospective campus AWS customers that want to be able to move their data 
> centers into the cloud.
> 
> Currently, I have the ARN (Amazon Resource Name) hard coded into the 
> attribute resolver. Obviously that won't scale well with having to 
> support multiple federated customers (ARNs). I can implement a lookup of 
> the ARN in some datastore, but was just wondering if anyone has been 
> thinking about this problem and how they might solve it.
> 
> -c
> 
> ______________________________________________________________________
> Christopher J. Hubing                Information Technology Services
> cjh at psu.edu                          Services and Solutions
> +1 814 865 8772                      The Pennsylvania State University
> http://www.personal.psu.edu/cjh
> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 163 bytes
Desc: Message signed with OpenPGP using GPGMail
Url : http://shibboleth.net/pipermail/users/attachments/20141002/f27a0806/attachment.bin