Part 2. AZURE AD Config for AWS SSO

22nd August 2020 20th January 2022
by [Kabir Vaderaa](/content/author/kb/ "Kabir Vaderaa"/index.html)

Azure Config

Select Non Gallery application as the AWS gallery application is for SSO into IAM not AWS SSO.

Give it a name and then go to the app click Single Sign on and select SAML.

Then in the screen click on Upload the meta file and it will set the identifier and reply URL.

When you upload the file it will set the Identifier and reply URL.

Download the Azure MetaData XML.

Quickly flip back to AWS and upload the file, click next and that part of AWS is configured.

Now we need to setup provisioning so the users and groups who are added to this group in azure ad are provisioned on AWS SSO. To do this we need to go back to AWS SSO click on enable auto provisioning.

As part of this it will generate an SCIM ID and a Token take note of both of these as they will need to go into Azure.

Add users and groups to the Azure APP. You can add as many groups as you need roles in AWS.

Setup Account Provisioning

In Azure AD go to provisioning, set to automatic. In the tenant URL enter the SCIM URL generated in AWS and for the secret enter the token Secret generated from AWS. Click the test button to validate.

Now we are still not done there are a few other setting we need to change on the mappings as outlined in the AWS Article but here are the highlights.

Expand the mappings.

Important:

Make sure that all users in Azure AD have filled out First name, Last name, and Display name values in their user properties. Otherwise, automatic provisioning won’t work with Azure AD.
On the Attribute Mapping page, delete the mappings for the two attributes facsimileTelephoneNumber and mobile.
Choose mailNickname in the attribute table, under Edit Attribute, change Source attribute from mailNickname to objectId, and then choose OK.

For the groups you need to do point 3 Above only.

Users should look something like below.

Once you’re happy with your settings, Turn on the provisioning status and save the changes.

Note Azure AD will now only provision every 40 minutes so if you make additional changes you need to wait for the next sync cycle.

Once the provisioning has completed you will see them in AWS SSO.

Users been replicated!

Azure AD Group been replicated.

You are now ready to assign aws account permissions to the groups and users. Once you have done so, when a user in the Azure AD group goes into office 365 or going to https://account.activedirectory.windowsazure.com/r#/applications and selects all apps they should see the AWS Application now all they need to do is click on it.

When they do they will be given a screen like below with a list of AWS accounts and permissions they are assigned in those accounts.

Part 1. AWS-SSO Integrated with Azure AD

22nd August 2020 24th August 2020
by [Kabir Vaderaa](/content/author/kb/ "Kabir Vaderaa"/index.html)

In this article I will show you how to create Aws SSO and integrate it with your azure AD for Single Sign on (SSO).

Many organizations have multiple public cloud providers. The challenge with the cloud for many organizations is having a good mechanism on user access management (UAM). Many organizations have also integrated their LDAP into Azure AD, and while there are better Identity provider (IdP), Microsoft has made good improvements in this space.

Aws SSO is Amazon's alternative to Azure AD and has many connectors to 3rd parties however in this scenario we are going to put Azure AD as the primary and use AWS SSO to integrate with an AWS organization.

Before starting you should have setup an AWS organisation if you don’t know how here is a guide on how to set it up.

AWS Config

When you login you will get a screen like below.

Enable SSO.

Click the Enable AWS SSO. In the background SSO is provisioned in each of the organization's accounts. You can see this by looking at the subscriptions IAM.

IAM view of SSO.

Once provisioned into SSO and click on choose Identity Source.

Click Change identity Source from AWS SSO.

Select External Identity provider and download the metadata file.

Next go to Azure AD Config Part 2.