<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Sep 27, 2017, at 7:45 AM, Cantor, Scott <<a href="mailto:cantor.2@OSU.EDU" class="">cantor.2@OSU.EDU</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><blockquote type="cite" style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class=""><br class="Apple-interchange-newline">Perceived need for non-web SSO login with Duo 2FA to AWS [I'm assured not all AWS services are available from the web admin<br class="">interface] is pushing us to deploy ECP, not currently in use here.<br class=""></blockquote><br style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">Do you have an actual piece of code to glue the AWS command line tools to ECP? I ask because I probably need it.</span></div></blockquote><br class=""></div><div>Having had something come up that has me looking at using SAML for AWS CLI, I went thru this thread and looked at the Amazon AWS documentation. And I don't see how ECP can fit into the picture, at least not without entirely ignoring how ECP is intended to work. The AWS SP does not support ECP-type (PAOS) endpoints, so you cannot start the flow at the SP. And you cannot submit the response to a PAOS endpoint, because there is none. </div><div><br class=""></div><div> <a href="https://signin.aws.amazon.com/static/saml-metadata.xml" class="">https://signin.aws.amazon.com/static/saml-metadata.xml</a></div><div><br class=""></div><div>So all that trying to use ECP would save would be the screen scraping of the login form. (But that is something.)</div><div><br class=""></div><div>So if the "ECPish client" one writes has to generate its own AuthnRequest, and then "take out the Body of the response" and submit it to AWS using its AssumeRoleWithSAML:</div><div><br class=""></div><div> <a href="http://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithSAML.html" class="">http://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithSAML.html</a></div><div><br class=""></div> API call, is that still ECP?<div class=""><br class=""><div class="">
<div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;">--<br class="">Michael A. Grady<br class="">IAM Architect, Unicon, Inc.</div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class=""><br class=""></div><br class="Apple-interchange-newline">
</div>
<br class=""></div></body></html>