ECP

[Michael A Grady]

> On Sep 27, 2017, at 7:45 AM, Cantor, Scott <cantor.2 at OSU.EDU> wrote:
> 
>> 
>> Perceived need for non-web SSO login with Duo 2FA to AWS [I'm assured not all AWS services are available from the web admin
>> interface] is pushing us to deploy ECP, not currently in use here.
> 
> Do you have an actual piece of code to glue the AWS command line tools to ECP? I ask because I probably need it.

Having had something come up that has me looking at using SAML for AWS CLI, I went thru this thread and looked at the Amazon AWS documentation. And I don't see how ECP can fit into the picture, at least not without entirely ignoring how ECP is intended to work. The AWS SP does not support ECP-type (PAOS) endpoints, so you cannot start the flow at the SP. And you cannot submit the response to a PAOS endpoint, because there is none. 

   https://signin.aws.amazon.com/static/saml-metadata.xml <https://signin.aws.amazon.com/static/saml-metadata.xml>

So all that trying to use ECP would save would be the screen scraping of the login form. (But that is something.)

So if the "ECPish client" one writes has to generate its own AuthnRequest, and then "take out the Body of the response" and submit it to AWS using its AssumeRoleWithSAML:

      http://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithSAML.html <http://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithSAML.html>

 API call, is that still ECP?

--
Michael A. Grady
IAM Architect, Unicon, Inc.



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170927/8441c08d/attachment.html>