Part 2. AZURE AD Config for AWS SSO

22nd August 2020
by [Kabir Vaderaa](/content/author/kb/ "Kabir Vaderaa"/index.html)

Azure Config

Select Non Gallery application as the AWS gallery application is for SSO into IAM not AWS SSO.

Give it a name and then go to the app click Single Sign on and select SAML

Then in the screen click on Upload the meta file and it will set the

When you upload the file it will set the Identifier and reply URL

Download the Azure MetaData XML

Quickly flip back to AWS and upload the file click next and that part of AWS is configured.

Now we need to setup provisioning so the users and groups who are added to this group in azure ad are provisioned on AWS SSO. To do this we need to go back to AWS SSO click on enable auto provisioning

AS part of this it will generate an SCIM ID and a Token take note of both of these as they will need to go into Azure

Add users and groups to the Azure APP, You can add as many groups as you need roles in AWS.

Setup Account Provisioning

In Azure AD go to provisioning, set to automatic. In the tenant URL enter the SCIM URL generated in AWS and for the secret enter the token Secret generated from AWS. Click the test button to validate.

Now we are still not done there are few other setting we needs to change on the mappings as outlined in the AWS Article but here are the highlights

Expand the mappings

Important:

Make sure that all users in Azure AD have filled out First name, Last name, and Display name values in their user properties. Otherwise, automatic provisioning won’t work with Azure AD.
On the Attribute Mapping page, delete the mappings for the two attributes facsimileTelephoneNumber and mobile.
Choose mailNickname in the attribute table, under Edit Attribute, change Source attribute from mailNickname to objectId, and then choose OK.

For the groups, you need to do point 3 Above only

Users should look something like below

Once you’re happy with your settings, Turn on the provisioning status and save the changes.

Note Azure AD will now only provision every 40 minutes so if you make additional changes you need to wait for the next sync cycle.

Once the provisioning has completed you will see them in AWS SSO

Users been replicated! Azure AD Group been replicated

You are now ready to assign AWS account permissions to the groups and users. Once you have done then when a users in the Azure AD group goes into office 365 or going to https://account.activedirectory.windowsazure.com/r#/applications and selects all app they should see the AWS Application now all they need to do is click on it

When they do they will be given a screen like below with a list of AWS account and permissions they are assigned in those accounts

Part 1. AWS-SSO Integrated with Azure AD

22nd August 2020
by [Kabir Vaderaa](/content/author/kb/ "Kabir Vaderaa"/index.html)

In this article I will show you how to create Aws SSO and integrate it with your Azure AD for Single Sign on (SSO)

Many organisations have multiple public cloud providers. The challenge with cloud for many organisation is having a good mechanism on user access management (UAM). Many organisation have also integrated their LDAP into Azure AD, and while there are better Identity provider (IdP) Microsoft have made good improvements in this space.

Aws SSO is Amazon's alternative to Azure AD and has many connectors to 3rd parties however in this scenario we are going to put Azure AD as the primary and use AWS SSO to integrate with an AWS organisation.

Before starting, you should have setup an AWS organisation if you don’t know how here a guide on how to set it up

AWS Config

When you login you will get a screen like below

Enable SSO

Click the Enable AWS SSO. In the background SSO is provisioned in each of the organisations accounts. You can see this but looking at the subscriptions IAM

IAM view of SSO

Once provisioned into SSO and click on choose Identity Source

Click Change identity Source from AWS SSO

Select External Identity provider and download the metadata file.