General Shib IdP install/config help

[Matthew X. Economou]

Mary-Catherine Martinez writes:

> I'm looking for a somewhat user-friendly guide on how to setup a Shib
> IdP from scratch. We're trying to deploy this via AWS Cognito to manage
> users/accounts and a Windows/EC2 server on AWS... This is one particular
> area that we are struggling with:
> https://wiki.shibboleth.net/confluence/display/IDP30/MetadataConfiguration

If I understand you correctly, you're deploying a Shibboleth IdP on a Windows-based EC2 instance, and you're configuring AWS Cognito to use that IdP to authenticate users.

According to the AWS Cognito developer guide (https://docs.aws.amazon.com/cognito/latest/developerguide/saml-identity-provider.html), you would configure your Shibboleth IdP to consume the AWS SP metadata at https://docs.aws.amazon.com/cognito/latest/developerguide/saml-identity-provider.html.  In my case, I've added the following to my metadata-providers.xml file:

<MetadataProvider
  metadataURL="https://signin.aws.amazon.com/static/saml-metadata.xml"
  xsi:type="FileBackedHTTPMetadataProvider"
  backingFile="%{idp.home}/metadata/d1400bed2d51772ab34da144f5c65222.xml"
  id="_d1400bed2d51772ab34da144f5c65222"/>

You also need to configure the IdP to release the necessary attributes to the Cognito service.  This requires adding several attribute definitions to attribute-resolver.xml, such as the following examples from my configuration:

<AttributeDefinition xsi:type="Simple" id="AmazonWebServicesIAMRole"
  sourceAttributeID="aws_role">
    <Dependency ref="staticAttributes"/>
    <AttributeEncoder xsi:type="SAML2String" encodeType="false"
      name="https://aws.amazon.com/SAML/Attributes/Role" />
</AttributeDefinition>

<AttributeDefinition xsi:type="Simple" id="AmazonWebServicesIAMRoleSessionName"
  sourceAttributeID="uid">
    <Dependency ref="uid"/>
    <AttributeEncoder xsi:type="SAML2String" encodeType="false"
      name="https://aws.amazon.com/SAML/Attributes/RoleSessionName" />
</AttributeDefinition>

<AttributeDefinition xsi:type="Simple" id="AmazonWebServicesIAMSessionDuration"
  sourceAttributeID="aws_session_duration">
    <Dependency ref="staticAttributes"/>
    <AttributeEncoder xsi:type="SAML2String" encodeType="false"
      name="https://aws.amazon.com/SAML/Attributes/SessionDuration" />
</AttributeDefinition>

Note the "sourceAttributeID" attributes and "Dependency" references.  These refer to other claims (such as "uid") or to data connectors (such as "staticAttributes").  For simplicity's sake, here's an example of a data connector that generates static values for the IAM role and session duration claims:

<DataConnector id="staticAttributes" xsi:type="Static">
  <Attribute id="aws_role">
    <Value>arn:aws:iam::123:role/MyRole,arn:aws:iam::123:saml-provider/MyIdP</Value>
  </Attribute>
  <Attribute id="aws_session_duration">
    <Value>43200</Value>
  </Attribute>
</DataConnector>

It's also possible to generate the necessary values from information provided by a data connector, such an an LDAP directory, but I believe this requires writing some Java. 

Best wishes,
Matthew

-- 
"The lyf so short, the craft so longe to lerne."