AWS Single Sign On Service

With the COVID-19 impact and increase in working from home nature, I have received more and more requests for Single Sign On integrations, specially in the education domain and workforce authentication. I will share the evaluation details of the available vendors we considered and their pros and cons in a separate post. In this post I am share the details of the Single Sign On option provided by AWS. This has been very convenient due to several reasons.
  • If you are thinking of installing an open source single sign on server for the purpose, this avoid all the installation efforts, maintenance etc. without much impact to the cost (of course might differ based on your resources and user base scales)
  • It has a quite a decent set of features. 
  • All the services under one roof. If your system is running on AWS already, this has the added advantage that your team is already familiar with dealing with AWS resources, logging facilities etc are integrated already.
Let's jump into the deep waters.
The configurations are pretty straight forward if you are familiar with the SAML protocol. We have the quick reach to define users, groups and application integrations as seen below.

As you can see there are 3 options to select from.
  1. If we have already maintained our user base in a separate identity source, in the 1st step you might want to configure the identity source. Otherwise, if we would depend on AWS SSO Identity Store, we can skip this step, rather we can directly go to 'Users' link in left menu and create the users and groups.
  2. This option is to be used if we are to use AWS SSO for AWS accounts itself, which is not the most common case when coming to businesses.
  3. This is the most important step. Here we do the configuration to inform AWS SSO service that there is an application that would use the service for user authentication and SSO functionality. Here we can get the AWS SSO service details that need to be used at the application side and let the AWS SSO service know what to send back to the application after user is authenticated.
 
With this 3rd option we can integrate with known third party service providers as ready-made integrations or add as a custom application in case it is an in-house developed application.
 
Once the application is configured with basic details, there configuration can be done secondarily to allow users to login to the applications via AWS SSO.
 
If the service provider/application is supporting to be configured for SAML SSO via an IDP Meta-data file, please download the below highlighted file in blue.

This is all we have to do in AWS side, to consume the SSO facilities. Once the application is also configured to have the SAML SSO flow honored for user authentication, we can test the end to end flow.

Cheers!

Comments

Post a Comment

Popular posts from this blog

Sign into Dokuwiki with Google

Image
Dokuwiki(https://www.dokuwiki.org/dokuwiki) is a nice and helpful gift by the opensource community. Being a favor of administrators for ease maintenance and integration options, it caters the needs of a content management system or as a corporate or a personal note keeper. In this post I am sharing an approach we followed to keep this simplicity as it is, while making it available for an existing Google user-base via Single Sign On capabilities. We made use of the extend-ability of Dokuwiki via plugins and OAuth 2.0 protocol based integration provided by Google for this purpose. Let's look at the flow and then how this was configured.   Flow As in the diagram, when the user comes to the Dokuwiki login page, we want to show them the option of login via Google. With this feature available, if they are already logged into Google, they will be automatically logged into Dokuwiki with Single Sign On in action. If not, they will go through the Google login procedure at Google site, as usu...
Read more

Single Sign On Integrations - Intro

Image
Single Sign on(SSO) is everywhere and provides lot of convenience to users. Let me give you few more examples. Have you noticed that when we are logged into our Gmail account and go to Youtube within the same browser, we are automatically logged into Youtube without any further requests for user credentials or authentication.  In today's cooperate world with COVID-19 impact, employees and partners heavily use cooperate applications such as Zoom, Salesforce, Jira in working from home efforts. Authenticating once and letting them securely use all these cooperate applications in another productive use of Single Sign On. In the Education sector also, COVID-19 impact has made the students and teachers to heavily depend on online tools. At such occasion also Single Sign On integration among these educational applications such as Moodle, Office365, Yammer etc, provide lot of convenience. User convenience is not the only benefit of Single Sign on though. It provides a lot more convenience ...
Read more

What is an API Gateway?

Image
API Gateways have become a critical component in the current Microservices based architectures, providing common functionalities required by APIs such as routing, API authentication, access control, rate limiting, billing, capturing analytics, monitoring and providing much needed decoupling between a client and the backend services. To understand further onto what an API gateway is, it is best to start from how it has evolved to exist. There are two clearly identifiable categories of API gateways in the market; Reverse proxy products that revolved into becoming API gateways, adding features to the core product eg. Nginx API Manager vendors who broke their monolithic application into microservices which let one of those to be API gateway. Starting from the first category is best to understand the initial requirements. Reverse proxies were already in the market, addressing the need of hiding the internal details of a system and providing an abstract interface for the external parties, i...
Read more