Identity Federation Flashcards
Federated Access Roles
Types of federated accesses?
SAML 2.0,
Federated Access Roles
Special names for the two acting systems in federation?
Identity Provider (like AD), Service Provider (controls access to resources)
Federated Access Roles
Examples of Identity Provicders
Facebook, Google, Amazon.com
Federated Access Roles
Two steps to use federated login?
Go to IdP, get a Token. Give token to AssumeRoleWithWebIdentity, get AWS keys
Federated Access Roles
AWS system that manages this federation for mobile apps?
Amazon Cognito
Federated Access Roles
Federated method for large scale, unknown users?
Web identity federation (Facebook, etc.)
Federated Access Roles
Federated method for enterprise use case with employees?
SAML (uses an existing directory of users)
SAML
What is SAML Federation?
Legacy! Use SSO instead. Use on-prem system to auth, swap for aws creds
SAML
What version of SAML does AWS support?
2.0
SAML
What Microsoft product uses SAML?
Microsoft Active Directory Federated Services (ADFS)
SAML
Use SAML with Google or Facebook?
Nope, there’s other federation for that. SAML is only about your ON-PREM auth system.
SAML
When do you switch from using AWS to manage identities and using SAML?
One example is when you hit the 5,000 IAM User limit per account.
SAML
How long (in general) are creds good for when you use SAML 2.0?
<= 12 hours
SAML
Setting up trust between on-prem and AWS for SAML. One-way or two-way trust?
Set up two way trust
SAML
What does a SAML enterprise system give you?
SAML Assertion (bearer token), exchange this with AWS for temp creds.
SAML
Two-step process to use SAML federation?
Go to SAML provider, login, get token. Give token to AssumeRoleWithSAML, get AWS creds
SSO
What are you required to have in place before using SSO?
AWS Organizations
SSO
New workload. Should you use SAML or SSO?
SSO. SAML is legacy.
SSO
Why SSO instead of SAML federation?
Other things can use SSO like DropBox and Slack.
SSO
What does SSO look like for a user?
Login, get a custom screen with all the apps they can login to with this portal. One is “AWS Account”.
SSO
What internal AWS thing is SSO most like?
Kinda like Midway and/or Isengard: login once to the thing, can use this to login to a bunch of AWS accounts.
SSO
What Identitiy Stores are available in SSO?
SSO’s internal Id Store, Microsoft AD (managed or on-prem), or SAML 2.0
SSO
When do you choose between Cognito and SSO?
Cognito when users have their own web identities, SSO when users have enterprise/corporate identities.
SSO
What are Permission Sets?
User-friendly names that show up for humans in the SSO portal. These become IAM Roles in all accounts you choose.
SSO
OK, can use SSO Portal to get to the AWS conosle, how do you use the CLI?
Just like Isengard. Use SSO Portal, login, select account & role, btn to get temp creds for cli.
SSO
How to SSO Group and IAM Groups relate?
Not at all. SSO Groups are only for the built-in identity provider just to group users.
SSO
What is “Assign” all about for the built-in SSO IdP?
Have groups, users, PermSets. Assign combines them on specific AWS accounts to actually login to the AWS accounts.
SSO
How do you do MFA with SSO users?
Easy, same as normal IAM Users: U2F devices like Yubikey, apps like Google Authenticator, etc.
