Advertisements
RSS

Tag Archives: Azure

How to combine Azure AD SSO with AWS programmatic access ?

Since we both use Azure AD (Office365 / LDAP) for the companies user management and AWS for our hosting we already enabled federation between these cloud providers. This works perfectly by assuming an IAM Role through the Azure AD credentials and have console access through single-sing-on.

However to use the AWS CLI a user would need programmatic access and it’s access and secret keys. Luckily for us there is an excellent open-source project for that called aws-azure-login. And since it’s on npm very easy to run on Mac, Linux and Windows.

What do we need ?

  • install the package as mentioned: npm install -g aws-azure-login (or not global if you fancy that)
  • you will need your Azure Tenant ID which the Azure administrator can supply ( Azure AD -> Properties -> Directory ID )
  • and the Azure Application ID and again the Azure administrator ( Enterprise Applications -> Amazon Web Services -> Properties -> Application ID )
  • you might want to know the AWS IAM Role max session duration to prevent some trial on error which your AWS administrator can supply (default is 1 hour)

First we will create an Azure profile:

jvzoggel$ aws-azure-login --configure --profile rubix
Configuring profile 'rubix'
? Azure Tenant ID: some-guid-you-will-need-part-1
? Azure App ID URI: some-guid-you-will-need-part-2
? Default Username: jvzoggel@rubix.nl
? Default Role ARN (if multiple):
? Default Session Duration Hours (up to 12): 2

The max session duration on the AWS IAM Role is the last parameter, if you enter a to high value you will receive an error but only after the next step login. So ask first, or trial on error.

Then we actually login on Azure:

jvzoggel$ aws-azure-login --profile rubix --no-prompt
Logging in with profile 'rubix'...
? Password: [hidden]
Please type in the code displayed on your authenticator app from your device
? Verification Code: 424242
Assuming role arn:aws:iam::42:role/rbx-sso-myrole

Since we configured MFA on Azure AD there is also the Verification Code besides the password to provide. When we succeed the aws-azure-login actually generated a profile in the AWS credentials configuration which holds the access and secret key. So let’s check.

Connect to AWS

jvzoggel$ cat /Users/jvzoggel/.aws/credentials

[rubix]
aws_access_key_id=A..............
aws_secret_access_key=X.............
aws_session_token="F......."
aws_session_expiration=2019-01-31T23:01:14.000Z

jvzoggel$ export AWS_PROFILE=rubix
jvzoggel$ aws s3api list-buckets
{
    "Buckets": [
        {
            "Name": "awsamplify-20181220092431-deployment",
        .....

 

Advertisements
 
Leave a comment

Posted by on 01-02-2019 in Uncategorized

 

Tags: , , , ,

How to install Azure CLI on MacOS

The Azure CLI 2.0 is Microsoft’s command line interface for managing Azure resources. First install the CLI through brew

brew update && brew install azure-cli

Then run the login command which will launch a browser session for your login credentials

jvzoggel$ az login
Fail to load or parse file /Users/jvzoggel/.azure/azureProfile.json. It is overridden by default settings.
Fail to load or parse file /Users/jvzoggel/.azure/az.json. It is overridden by default settings.
Fail to load or parse file /Users/jvzoggel/.azure/az.sess. It is overridden by default settings.
Note, we have launched a browser for you to login. For old experience with device code, use "az login --use-device-code"
You have logged in. Now let us find all the subscriptions to which you have access...
{
  "cloudName": "AzureCloud",
  "id": "xxxxxx",
  "isDefault": true,
.....
},

The first time the 3 Azure configuration files in your home/.azure will automatically be created.

 

References

 
Leave a comment

Posted by on 06-08-2018 in Azure

 

Tags: ,

Cloud integration using federation between Microsoft Office 365 Azure Active Directory (AAD) and Amazon Web Service (AWS)

Not an Oracle blog for a change, but when an organization uses both Amazon Web Services (AWS) and Microsoft Office 365 it is possible to allow single sign-on with the internal LDAP Microsoft uses (Azure AD). Since RubiX uses both cloud products since day 1, I decided to look into integration between both products when Microsoft recently allowed SAML federation.

In this blog I will demonstrate how to connect Amazon Web Services (AWS) to the internal Azure Active Directory (AAD) that is used by Microsoft. As a result of this blog your users should be able to login to AWS from the Office 365 menu.

RESULT

1. Configure Microsoft Office 365 / Azure Active Directory (AAD)

Go to your Administration console and select Azure AD from ADMIN

AZURE000_01

In the Azure AD console select “Active Direcory”, click on your Office 365 domain name and the AD menu should open. Click on “Applications” from the top menu

AZURE000

By defaut you will see a lot of Microsoft web applications, so we click on “Add+” on the bottom menu. Then select “Add application from the gallery”

AZURE000-2

The AWS application will be added to your list. Select Configure Single Sign-On next.

AZURE001

We will select the 1st option (MS AAD SSO) to establish federation between AAD & AWS. The Federated Single Sign-On enables the users in your organization to be automatically signed in to a third-party application like AWS by using the AAD user account information. In this scenario, when you have already been logged into Office 365 the federation eliminates the need for you to login again to AWS.

AZURE002

In this case, we don’t need to perform any extra advanced settings. So NEXT

AZURE003

Download the metadata XML and store it for future use and make sure to accept the checkbox

AZURE004

Go to the users tab and assign (bottom button) your users that are allowed to login to AWS

AZURE011

Before we can finalize our SSO from AAD, we first need to setup AWS.

2. Configure Amazon Web Service (AWS)

Login to your AWS account and select the Identity & Access Management

EC2001

First we will create an Identity Provider for AAD.
Select SAML as Provider Type and choose a logical name (I use “Office365” in my example).
Browse to the exported metadata we downloaded from the AAD console earlier.

Important: check your metadata xml file

  • The exported metadata XML file from Azure might be encoded as UTF-8 with byte order mark (BOM). Make sure to convert it to UTF-8 without BOM otherwise the AWS console will not be able to import it.
  • Make sure to remove the <?xml version=”1.0″?> on line 1, otherwise AWS will not be able to parse the file

EC2001_provider

As a result we now have a SAML provider configured, so time to set some roles.
Select Roles in the IAM menu, select “Create New Role” and give your role a logical name (I use “RubixUsers” here)
In the Role Type select “Grant Web Single Sign-On (WebSSO) access to SAML providers“.

EC2004

  • Select the SAML provider we trust, so we use the earlier created “Office365” provider here.
  • Next step we can customize the policy, which we won’t do so next.
  • In the next step we can select the policy you want to attach to your SSO users.
    You can go fine grained with policies, but for now I will use the default PowerUser policy
  • The last screen you will receive a review of the configuration, make sure to note down the Role ARN and Thrusted Entities
    Role ARN = arn:aws:iam::[customerID]:role/[RoleName]
    Trust = arn:aws:iam::[customerID]:saml-provider/[ProviderName]

EC2001_review

 

3. Configure Microsoft Office 365 / Azure Active Directory (AAD) – part 2

Go back to the AAD management console (https://manage.windowsazure.com).
Select applications -> Amazon Web Services (AWS) -> Attributes

Add the following 2 attributes:

EC2_attributes

 

4. Result

With these configuration steps you are now able to login to AWS from your Office 365 apps tile.

RESULT

 
2 Comments

Posted by on 16-10-2015 in Uncategorized

 

Tags: , , , , , , ,