ECP

[Cantor, Scott]

On 9/26/17, 7:28 PM, "users on behalf of IAM David Bantz" <users-bounces at shibboleth.net on behalf of dabantz at alaska.edu> wrote:

> Perceived need for non-web SSO login with Duo 2FA to AWS [I'm assured not all AWS services are available from the web admin
> interface] is pushing us to deploy ECP, not currently in use here.

Do you have an actual piece of code to glue the AWS command line tools to ECP? I ask because I probably need it.

> https://wiki.shibboleth.net/confluence/display/IDP30/ECPConfiguration looked straightforward at first glance provided
> the JAAS authN configuration can be different than the JAAS config used for "normal" web-based (we'd point to Duo proxy to get
> 2FA for ECP).

See Advanced JAAS Usage. Needs to be managed like any other triggering of behavior based on custom principal rules to enforce MFA.

> But then a guru suggested we need to base configuration on RemoteUser:

You can, but you don't have to.

> which is sufficiently generic I don't know where to begin.

I'm not sure I understand the comment. It's generic because everything on the web is generic, that's just how standards are. Authentication of that type relies on general principles and abstractions that all web servers support.

> Where do I begin? What are the major tasks needed to deploy ECP (with Duo Proxy).?

Well, firstly, you ignore that entire ECP HowTo, because it's very incomplete and misleading about how to do this (*). You can use RemoteUser-based authentication, but you certainly don't have to, the UsernamePassword flow already handles basic-auth for ECP out of the box. Your case is only "special" because of the Duo requirement, and the need to, apparently, support multiple co-existing password validation approaches, which is inherently complex and brittle, but it's possible.

Secondly, the major task is to have a client, because that's much harder than anything else to pull off, and without one it doesn't matter much. But if you have one, then that's a major hurdle cleared. I have not seen anything out there that adds ECP to the AWS CLI.

-- Scott

(*) I know the question coming. I don't know how to answer it. If I start deleting or messing around with community-contributed documentation, then I'm sending the message that we don't want it, so I don't know how to handle that. The HowTo section is, quite simply, always going to be a mixed bag.