<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Keith,</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Okay, I suspected it might be something like that. <span id="🙂">🙂</span><br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I have awscli-login working in my test environment after making that change.</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Next question - Does anyone have this working with v2 of the aws cli? I installed that first, but it uses an embedded Python interpreter. When I ran "pip3 install awscli-login", it pulled v1.18.3 of the aws cli into pip (which is what I used for testing).</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thanks,</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Andy<br>
</div>
<div>
<div id="appendonsend"></div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Wessel, Keith <kwessel@illinois.edu><br>
<b>Sent:</b> Thursday, February 20, 2020 10:29 AM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> RE: AWS ECP with awscli-login</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt">
<div class="PlainText">Andy,<br>
<br>
You've hit upon the dirty part of the implementation. I believe this is documented in the readme or the Github wiki for the project. If not, somebody please let me know so we can add it. The basic idea is:<br>
<br>
Step 1: take Scott's advice and don't remotely consume Amazon's metadata. You can pull it down once, but then store it locally and don't refresh it.<br>
Step 2: Add an ECP endpoint. The same ACS URL that you use to send web-based ACS responses to can be used. We added this:<br>
<br>
<AssertionConsumerService index="2" isDefault="true" Binding="urn:oasis:names:tc:SAML:2.0:bindings:PAOS" Location="<a href="https://signin.aws.amazon.com/saml"/">https://signin.aws.amazon.com/saml"/</a>><br>
<br>
Note you'll need to mke the same modification to the AWS Gov metadata if you're using that separate AWS instance.<br>
<br>
Keith<br>
<br>
<br>
<br>
From: users <users-bounces@shibboleth.net> On Behalf Of Morgan, Andrew Jason<br>
Sent: Thursday, February 20, 2020 11:55 AM<br>
To: users@shibboleth.net<br>
Subject: AWS ECP with awscli-login<br>
<br>
I'm running into an issue with Illinois' awscli-login module. When I run "aws login" to perform the ECP authentication, awscli-login sends a SAMLRequest to my IDP's ECP endpoint. This generates the following error in my IDP logs:<br>
<br>
WARN [net.shibboleth.idp.saml.profile.impl.PopulateBindingAndEndpointContexts:410] - Profile Action PopulateBindingAndEndpointContexts: Unable to resolve outbound message endpoint for relying party 'urn:amazon:webservices': EndpointCriterion [type={urn:oasis:names:tc:SAML:2.0:metadata}AssertionConsumerService,
Binding=urn:oasis:names:tc:SAML:2.0:bindings:PAOS, Location=https://urldefense.proofpoint.com/v2/url?u=https-3A__signin.aws.amazon.com_saml&d=DwQFAw&c=OCIEmEwdEq_aNlsP4fF3gFqSN-E3mlr2t9JcDdfOZag&r=2ERBnv_hmATkLrFo9IGgSTIJkkZL1ljF18WCoTc8nrI&m=P_VC6cUV3M9VyJ3Prd26_vbeli35MjsnLANmoYUUlPg&s=c7QkMF1uINQ4RhxCgcxQnokX1aVqckNC1lWPd4ZszPY&e=,
trusted=false]<br>
WARN [org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event occurred while processing the request: EndpointResolutionFailed<br>
WARN [net.shibboleth.idp.saml.profile.impl.SpringAwareMessageEncoderFactory:96] - Binding URI was not available, unable to lookup message encoder<br>
ERROR [org.opensaml.profile.action.impl.EncodeMessage:122] - Profile Action EncodeMessage: Unable to locate an outbound message encoder<br>
<br>
The metadata loaded dynamically from Amazon (<a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__signin.aws.amazon.com_static_saml-2Dmetadata.xml&d=DwMFAw&c=OCIEmEwdEq_aNlsP4fF3gFqSN-E3mlr2t9JcDdfOZag&r=2ERBnv_hmATkLrFo9IGgSTIJkkZL1ljF18WCoTc8nrI&m=P_VC6cUV3M9VyJ3Prd26_vbeli35MjsnLANmoYUUlPg&s=TT6r-rHsQmXhSh1hCYAVSUL5HJIB5Cc2mh9jvOgzJhc&e=">https://urldefense.proofpoint.com/v2/url?u=https-3A__signin.aws.amazon.com_static_saml-2Dmetadata.xml&d=DwMFAw&c=OCIEmEwdEq_aNlsP4fF3gFqSN-E3mlr2t9JcDdfOZag&r=2ERBnv_hmATkLrFo9IGgSTIJkkZL1ljF18WCoTc8nrI&m=P_VC6cUV3M9VyJ3Prd26_vbeli35MjsnLANmoYUUlPg&s=TT6r-rHsQmXhSh1hCYAVSUL5HJIB5Cc2mh9jvOgzJhc&e=</a>)
has just 1 ACS entry:<br>
<br>
<AssertionConsumerService index="1" isDefault="true" Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="<a href=""></a>https://urldefense.proofpoint.com/v2/url?u=https-3A__signin.aws.amazon.com_saml-2522_-253E&d=DwQFAw&c=OCIEmEwdEq_aNlsP4fF3gFqSN-E3mlr2t9JcDdfOZag&r=2ERBnv_hmATkLrFo9IGgSTIJkkZL1ljF18WCoTc8nrI&m=P_VC6cUV3M9VyJ3Prd26_vbeli35MjsnLANmoYUUlPg&s=VtKpP2gHvn4ScdbzFDEOEy863VlKE15_lv8OMHTQ9wo&e=<br>
<br>
So, Shibboleth is definitely correct that there is no PAOS binding for this SP.<br>
<br>
Am I doing something wrong? How have other awscli-login users solved this issue?<br>
<br>
Thanks,<br>
Andy Morgan<br>
Identity & Access Management<br>
Oregon State University<br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg">
https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
</div>
</span></font></div>
</div>
</body>
</html>