AWS + ECP?

[Brent Putman]

On 2/5/16 4:49 PM, Cantor, Scott wrote:
>> This is *not* a valid ECP SOAP request. It's completely missing the
>> <paos:Request> and <ecp:Request> SOAP headers.
> Very true, but I'm mostly just concerned about adequate logging for errors right now. ;-)
>
> Clearly whatever this script/client is, it's not even close to usable though.
>

Well, I vaguely knew this from seeing this in the AWS docs before, just
skimmed again:  This AWS flow is not actually technically the SAML 2
ECP profile, as in: client does PAOS to SP, gets back the AuthnRequest
and so on.  It's not any official SAML flow or profile, AFAIK.  It's I
believe something they (Amazon) just made up.  Sort of like
"unsolicited ECP" I guess.  Client contacts IdP first, gets SAML
Response with Assertion, then exchanges that at an AWS notion of a
Security Token Service to get AWS creds. It's not WS-Trust, it's their
own RESTful API.  I'm not an expert.  But the main flow is detailed
here complete with flow diagram [1], and the way you use the
response/assertion at their "STS" is here. [2]

As far as the client <-> IdP interaction goes, AFAIK they're expecting
the customer to solve that or make something up.  Don't think it's
specified. 

All this is clearly problematic, but the issue here really isn't
necessarily with this guy's script, but rather with the AWS service and
requirements itself.   I think the script just tries to do something to
make this work with an existing SAML IdP, as crazy or invalid as
necessary.  For example the binding it's sending is bogus, since it's
not going to do that anyway, as would be the AWS SP metadata.

I am possibly going to be lucky enough to learn about all this for
real, as my school has "cloud" on the brain and is getting heavily into
AWS.  Oh joy.



[1]
http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_saml.html

[2]
http://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithSAML.html

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160205/b538c1cf/attachment.html>