search

pulumi / docs

All things Pulumi docs!
https://pulumi.com
Apache License 2.0
128 stars 221 forks source link

Add a doc for setting up SAML SSO using AWS #11799

Open praneetloke opened 5 years ago

praneetloke commented 5 years ago

...it would also be nice to have a doc that explains the various attributes that users are asked to configure.

lukehoban commented 4 years ago

@praneetloke Do you mean using AWS SSO with Pulumi, like as a fourth entry in https://www.pulumi.com/docs/guides/saml/?

praneetloke commented 4 years ago

Do you mean using AWS SSO with Pulumi, like as a fourth entry in https://www.pulumi.com/docs/guides/saml/?

@lukehoban yep that's right. However, I do think the SAML SSO overview doc should help users figure out the values in the absence of an AWS specific configuration doc.

susanev commented 3 years ago

@praneetloke is this still an issue?

interurban commented 11 months ago

hiya; We've created specific docs guides now for https://www.pulumi.com/docs/pulumi-cloud/oidc/ providers, and a specific guide for AWS https://www.pulumi.com/docs/pulumi-cloud/oidc/aws/ and example code to make this easy to configure : https://github.com/pulumi/examples/tree/master/aws-py-oidc-provider-pulumi-cloud . thank you!

ericrudder commented 11 months ago

@interurban ... I don't think this is at all what @praneetloke was asking for ... I think this request is for SAML settings

praneetloke commented 11 months ago

That's right. My comment above clarifies this a bit. Admittedly, the issue title wasn't clear that this was for SAML. I've updated it now.

Glad that a doc exists for configuring AWS for OIDC though. That's very helpful!

thoward commented 2 weeks ago

After some internal inquiry, it looks like this is still a gap in our documentation coverage that should be documented (both how to wire up AWS SAML, and better documentation of the required SAML attributes. Assigned @GeoffMillerAZ to pick this one up and get it over the finish line.

GeoffMillerAZ commented 3 days ago

Sorry. I'm having a lot of trouble on this one. I actually don't think it's possible. I wasn't super familiar with SAML to start and by failing a few times at this I think I've got it much better and I believe the confusion is that AWS does offer SAML integration and can be a SAML service provider. This can be done with AWS SSO and AWS Cognito. But it does not have the capability to act as a SAML Identity Provider (IdP). It can, however, act as a OIDC IdP. As such, the docs can get confused between these two protocols leading someone to believe it's possible. The AWS Q copilot/ai will also tell you explicitly that no AWS service has the capability of being a SAML IdP. It does seem like AWS have hinted that they may one day offer this capability.

But until AWS offers this SAML IdP capability, you have to provide an existing third-party and external IdP into AWS SSO and AWS Cognito.

I also looked at other major tools that might have SSO SAML integration guides with AWS and I found they also don't have guides on this topic -- which helped me to be more confident with my research. There are also plenty of forums stating that AWS doesn't yet have this capability even though the posts were years old, which is why I kept researching incase the capability was added more recently.