Skip to content

Commit bdad599

Browse files
dominic-rdominic-r
committed
wip
1 parent d134907 commit bdad599

File tree

4 files changed

+333
-399
lines changed

4 files changed

+333
-399
lines changed

‎website/integrations/services/aws/index.md

-163
This file was deleted.

‎website/integrations/services/aws/index.mdx

+206
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,206 @@
1+
---
2+
title: Integrate with Amazon Web Services
3+
sidebar_label: Amazon Web Services
4+
support_level: authentik
5+
---
6+
7+
## What is AWS
8+
9+
> Amazon Web Services (AWS) is the world's most comprehensive and broadly adopted cloud, with more than 200 fully featured services available from data centers globally. Millions of customers—including the fastest-growing startups, largest enterprises, and leading government agencies—are using AWS to lower costs, increase security, become more agile, and innovate faster.
10+
>
11+
> -- https://www.aboutamazon.com/what-we-do/amazon-web-services
12+
13+
## Preparation
14+
15+
The following placeholders are used in this guide:
16+
17+
- `authentik.company` is the FQDN of the authentik installation.
18+
- `123412341234` is your AWS account ID.
19+
20+
:::note
21+
This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application.
22+
:::
23+
24+
import Tabs from "@theme/Tabs";
25+
import TabItem from "@theme/TabItem";
26+
27+
<Tabs>
28+
<TabItem value="iam" label="Classic IAM" default>
29+
30+
### Prerequisites
31+
32+
- An AWS account with permissions to create IAM roles and identity providers
33+
- An authentik instance with admin access
34+
35+
### authentik configuration
36+
37+
To support the integration of AWS with authentik using the classic IAM method, you need to create an application/provider pair and property mappings in authentik.
38+
39+
#### Create property mappings
40+
41+
1. Log in to authentik as an admin, and open the authentik Admin interface.
42+
2. Navigate to **Customization** > **Property Mappings** and click **Create**. Create two **SAML Provider Property Mapping**s with the following settings:
43+
44+
- **Role Mapping:**
45+
46+
- **Name**: Choose a descriptive name
47+
- **SAML Attribute Name**: <kbd>https://aws.amazon.com/SAML/Attributes/Role</kbd>
48+
- **Friendly Name**: Leave blank
49+
- **Expression**: Choose one of these options:
50+
51+
For a static role:
52+
53+
```python
54+
return "arn:aws:iam::123412341234:role/saml_role,arn:aws:iam::123412341234:saml-provider/authentik"
55+
```
56+
57+
For role assignment based on group membership:
58+
59+
```python
60+
role_name = user.group_attributes().get("aws_role", "")
61+
return f"arn:aws:iam::123412341234:role/{role_name},arn:aws:iam::123412341234:saml-provider/authentik"
62+
```
63+
64+
For multiple role choices:
65+
66+
```python
67+
return [
68+
"arn:aws:iam::123412341234:role/role_a,arn:aws:iam::123412341234:saml-provider/authentik",
69+
"arn:aws:iam::123412341234:role/role_b,arn:aws:iam::123412341234:saml-provider/authentik",
70+
"arn:aws:iam::123412341234:role/role_c,arn:aws:iam::123412341234:saml-provider/authentik",
71+
]
72+
```
73+
74+
- **Session Name Mapping:**
75+
- **Name**: Choose a descriptive name
76+
- **SAML Attribute Name**: <kbd>https://aws.amazon.com/SAML/Attributes/RoleSessionName</kbd>
77+
- **Friendly Name**: Leave blank
78+
- **Expression**: <kbd>return user.username</kbd>
79+
80+
#### Create an application and provider in authentik
81+
82+
1. Log in to authentik as an admin, and open the authentik Admin interface.
83+
2. Navigate to **Applications** > **Applications** and click **Create with Provider** to create an application and provider pair. (Alternatively you can create only an application, without a provider, by clicking **Create**.)
84+
85+
- **Application**: provide a descriptive name (e.g. "AWS"), an optional group for the type of application, the policy engine mode, and optional UI settings. The **slug** will be used in URLs and should match the `aws-slug` placeholder defined earlier.
86+
- **Choose a Provider type**: select **SAML Provider** as the provider type.
87+
- **Configure the Provider**: provide a name (or accept the auto-provided name), and configure the following required settings:
88+
- Set the **ACS URL** to <kbd>https://signin.aws.amazon.com/saml</kbd>
89+
- Set the **Audience** to <kbd>urn:amazon:webservices</kbd>
90+
- Under **Advanced protocol settings**, add both property mappings you created in the previous section
91+
- **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/flows-stages/bindings/) (policy, group, or user) to manage the listing and access to applications on a user's **My applications** page.
92+
93+
3. Click **Submit** to save the new application and provider.
94+
4. Download the **Metadata file** from the provider's page.
95+
96+
### AWS configuration
97+
98+
1. Log in to the AWS Management Console as an administrator
99+
2. Create an IAM role with the desired permissions and note the ARN
100+
3. Navigate to [IAM Identity Providers](https://console.aws.amazon.com/iam/home#/providers)
101+
4. Click **Create Provider** and configure:
102+
- Select **SAML** as the provider type
103+
- Upload the metadata file from authentik
104+
5. Add the property mappings to the SAML Provider
105+
6. Create an application and assign the appropriate policies
106+
7. Connect the provider to your application
107+
108+
</TabItem>
109+
<TabItem value="identity-center" label="IAM Identity Center">
110+
111+
### Prerequisites
112+
113+
- An AWS account with IAM Identity Center enabled
114+
- An authentik instance with admin access
115+
- A certificate for signing SAML assertions (you can use authentik's default or provide your own)
116+
117+
### authentik configuration
118+
119+
To support the integration of AWS with authentik using IAM Identity Center, you need to create an application/provider pair in authentik.
120+
121+
#### Create an application and provider in authentik
122+
123+
1. Log in to authentik as an admin, and open the authentik Admin interface.
124+
2. Navigate to **Applications** > **Applications** and click **Create with Provider** to create an application and provider pair. (Alternatively you can create only an application, without a provider, by clicking **Create**.)
125+
126+
- **Application**: provide a descriptive name (e.g. "AWS Identity Center"), an optional group for the type of application, the policy engine mode, and optional UI settings. The **slug** will be used in URLs and should match the `aws-slug` placeholder defined earlier.
127+
- **Choose a Provider type**: select **SAML Provider from metadata** as the provider type.
128+
- **Configure the Provider**: provide a name (or accept the auto-provided name), and configure the following required settings:
129+
- Upload the metadata file from AWS (obtained in AWS Configuration steps)
130+
- Copy the **Issuer URL** to the **Audience** field
131+
- Under **Advanced Protocol Settings**, set your **Signing Certificate**
132+
- **Configure Bindings** _(optional)_: you can create a [binding](/docs/add-secure-apps/flows-stages/bindings/) (policy, group, or user) to manage the listing and access to applications on a user's **My applications** page.
133+
134+
3. Click **Submit** to save the new application and provider.
135+
4. Under **Related Objects**, download both:
136+
- The **Metadata file**
137+
- The **Signing Certificate**
138+
139+
### AWS configuration
140+
141+
1. Navigate to **IAM Identity Center -> Settings -> Identity Source**
142+
2. Click **Actions -> Change identity source**
143+
3. Select **External Identity Provider**
144+
4. Download the **Service Provider metadata** file
145+
5. Upload authentik's metadata file and signing certificate
146+
6. Under **Actions -> Manage Authentication**, note the AWS access portal sign-in URL
147+
7. Update your authentik application's **Start URL** to match the AWS portal URL.
148+
149+
</TabItem>
150+
<TabItem value="scim" label="SCIM Provisioning (Optional)">
151+
152+
### Prerequisites
153+
154+
- Completed either Classic IAM or IAM Identity Center setup
155+
- AWS Identity Center enabled with admin access
156+
- authentik instance with admin access
157+
158+
### authentik configuration
159+
160+
To support the integration of AWS with authentik using SCIM, you need to create a SCIM provider and custom mapping in authentik.
161+
162+
#### Create property mappings
163+
164+
1. Log in to authentik as an admin, and open the authentik Admin interface.
165+
2. Navigate to **Customization** > **Property Mappings** and click **Create**. Create a **SCIM Mapping** with the following settings:
166+
- **Name**: Choose a name lexically lower than `authentik default` (e.g. `AWS SCIM User mapping`)
167+
- **Expression**:
168+
```python
169+
# This expression strips the default mapping from its 'photos' attribute,
170+
# which is a forbidden property in AWS IAM.
171+
return {
172+
"photos": None,
173+
}
174+
```
175+
176+
#### Create a SCIM provider in authentik
177+
178+
1. Log in to authentik as an admin, and open the authentik Admin interface.
179+
2. Navigate to **Providers** > **Providers** and click **Create**.
180+
3. Select **SCIM Provider** as the provider type.
181+
4. Configure the provider with the following settings:
182+
- Set a descriptive name
183+
- Set **URL** to the AWS SCIM Endpoint
184+
- Set **Token** to the AWS Access Token
185+
- Configure user filtering as needed
186+
5. Under **User Property Mappings**, add:
187+
- The default mapping
188+
- Your custom mapping
189+
6. Add the SCIM provider to your AWS application's **Backchannel providers**
190+
191+
### AWS configuration
192+
193+
1. In AWS Identity Center **Settings**, locate the **Automatic Provisioning** information box
194+
2. Click **Enable**
195+
3. Note the provided **SCIM Endpoint** and **Access Token**
196+
197+
The SCIM provider will automatically sync when users, groups, or memberships change. You can manually sync from the provider page.
198+
199+
</TabItem>
200+
</Tabs>
201+
202+
## Additional Resources
203+
204+
- [AWS IAM SAML Documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_saml.html)
205+
- [AWS IAM Identity Center Documentation](https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html)
206+
- [AWS SCIM Documentation](https://docs.aws.amazon.com/singlesignon/latest/userguide/scim-profile.html)

0 commit comments

Comments
 (0)