search

Noovolari / leapp

Leapp is the DevTool to access your cloud
https://www.leapp.cloud/
Mozilla Public License 2.0
1.6k stars 146 forks source link

Azure AD Login to AWS with AWS SAML #160

Closed mholttech closed 3 years ago

mholttech commented 3 years ago

Is your feature request related to a problem? Please describe. My company uses AzureAD to authenticate into AWS using SAML Authentication (Not AWS SSO). It does not appear that Leapp currently supports this. This is accomplished by logging into AWS using a AWS SAML URL like https://signin.aws.amazon.com/saml/AWS-ACCOUNT-1

Describe the solution you'd like Would like to accomplish the login flow with Leapp.

Describe alternatives you've considered We currently use https://github.com/sportradar/aws-azure-login for this and when it comes to CI/CD to access AWS and it works well, however it has proven to be a barrier for our developers.

andreacavagna01 commented 3 years ago

Hi, the issue refers to this specific use case: https://docs.leapp.cloud/use-cases/aws_iam_role/#aws-iam-federated-role

at the moment we are not supporting Azure AD as Identity Provider, but it's a little addition to be made in order to make Azure AD working with Leapp.

As you can see in this pull request allowing Okta as an identity provider the only thing to be done is to add the correct filter for the SAML response of the callback on Azure AD here:

https://github.com/Noovolari/leapp/blob/00b89d74ec7439cd172be45f6c7e1e47201e7a8b/src/app/services/session/aws/methods/aws-iam-role-federated.service.ts#L162

I can help you in doing this but at the moment I do have not an Azure AD account to test it and find the correct filter on the SAML response.

I'll add a Help needed label, since, when I found someone with this Identity provider in the community wanting to collaborate, we can implement this feature in some hours together

Also, I will add this enhancement in the roadmap.

mholttech commented 3 years ago

Hey @andreacavagna01,

I'd be happy to work with you to find the correct filter for AzureAD.

edit: I just joined the slack team so you can find me there as well