This repository has been archived on 2024-05-31. You can view files and clone it, but cannot push or open issues or pull requests.
authentik/website/integrations/services/aws/index.md

78 lines
3.0 KiB
Markdown
Raw Normal View History

---
title: Amazon Web Services
---
2020-02-18 19:14:54 +00:00
<span class="badge badge--primary">Support level: authentik</span>
2020-02-18 19:14:54 +00:00
## What is AWS
:::note
Amazon Web Services (AWS) is the worlds most comprehensive and broadly adopted cloud platform, offering over 175 fully featured services from data centers globally. Millions of customers—including the fastest-growing startups, largest enterprises, and leading government agencies—are using AWS to lower costs, become more agile, and innovate faster.
:::
2020-02-18 19:14:54 +00:00
## Preparation
The following placeholders will be used:
- `authentik.company` is the FQDN of the authentik install.
2020-02-18 19:14:54 +00:00
2020-12-05 21:08:42 +00:00
Create an application in authentik and note the slug, as this will be used later. Create a SAML provider with the following parameters:
2020-02-18 19:14:54 +00:00
- ACS URL: `https://signin.aws.amazon.com/saml`
- Audience: `urn:amazon:webservices`
- Issuer: `authentik`
- Binding: `Post`
2020-02-18 19:14:54 +00:00
2020-06-18 18:44:25 +00:00
You can of course use a custom signing certificate, and adjust durations.
2020-02-18 19:14:54 +00:00
## AWS
2020-06-18 18:44:25 +00:00
Create a role with the permissions you desire, and note the ARN.
2020-02-18 19:14:54 +00:00
2020-09-24 13:36:29 +00:00
After you've created the Property Mappings below, add them to the Provider.
2020-02-18 19:14:54 +00:00
2020-09-24 13:36:29 +00:00
Create an application, assign policies, and assign this provider.
2020-02-18 19:14:54 +00:00
2020-12-05 21:08:42 +00:00
Export the metadata from authentik, and create an Identity Provider [here](https://console.aws.amazon.com/iam/home#/providers).
2020-02-18 19:14:54 +00:00
2020-09-24 13:36:29 +00:00
#### Role Mapping
The Role mapping specifies the AWS ARN(s) of the identity provider, and the role the user should assume ([see](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_saml_assertions.html#saml_role-attribute)).
This Mapping needs to have the SAML Name field set to "https://aws.amazon.com/SAML/Attributes/Role"
As expression, you can return a static ARN like so
```python
2020-12-05 21:08:42 +00:00
return "arn:aws:iam::123412341234:role/saml_role,arn:aws:iam::123412341234:saml-provider/authentik"
2020-09-24 13:36:29 +00:00
```
Or, if you want to assign AWS Roles based on Group membership, you can add a custom attribute to the Groups, for example "aws_role", and use this snippet below. Groups are sorted by name and later groups overwrite earlier groups' attributes.
```python
role_name = user.group_attributes().get("aws_role", "")
2020-12-05 21:08:42 +00:00
return f"arn:aws:iam::123412341234:role/{role_name},arn:aws:iam::123412341234:saml-provider/authentik"
2020-09-24 13:36:29 +00:00
```
If you want to allow a user to choose from multiple roles, use this snippet
```python
return [
2020-12-05 21:08:42 +00:00
"arn:aws:iam::123412341234:role/role_a,arn:aws:iam::123412341234:saml-provider/authentik",
"arn:aws:iam::123412341234:role/role_b,arn:aws:iam::123412341234:saml-provider/authentik",
"arn:aws:iam::123412341234:role/role_c,arn:aws:iam::123412341234:saml-provider/authentik",
2020-09-24 13:36:29 +00:00
]
```
### RoleSessionName Mapping
The RoleSessionMapping specifies what identifier will be shown at the top of the Management Console ([see](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_saml_assertions.html#saml_role-session-attribute)).
This mapping needs to have the SAML Name field set to "https://aws.amazon.com/SAML/Attributes/RoleSessionName".
To use the user's username, use this snippet
```python
return user.username
```