Field Notes: Integrating a Multi-Forest Source Environment with AWS SSO
AWS Architecture BlogField Notes: Integrating a Multi-Forest Source Environment with AWS SSOby Sudhir Amin and Donny Vasquez | on26 AUG 2020| inArchitecture,AWS IAM Identity Center,Technical How-to|Permalink|ShareDuringre:Invent 2019, AWSannounced a new wayto integrate external identity sources such as Azure Active Directory with auto provisioning of identities and groups inAWS Single Sign-On(AWS SSO). In March 2020, AWS SSO afforded customers the possibility to connect theirOkta Identity Cloud to AWS Single Sign-On (SSO)in order to manage access to AWS centrally in AWS SSO.AWS SSO helps centralize management access to multiple AWS accounts and some cases tying back to corporate identities. This provides ready access to business applications and services. With this feature, companies can leverage AWS SSO for allowing federated access to multiple AWS accounts and cloud applications.In this blog post, we discuss the challenges faced by customers running multi-forest environments or multiple Azure tenant subscriptions with this feature. We also provide a different approach to solving this challenge with a brief overview of each solution presented.Large enterprise companies often require their security team to build centralized identity solutions that work across different Active Directory forests environments. This is commonly due to a merger, acquisition or partnership. Challenges include complex networking with different IP routes, DNS forwarding configurations, and firewall rules to enable trust relationships between different Active Directory forests to support compliance of a single identity to manage the account lifecycle and password policies. This becomes even more challenging when your organization is working in multiple cloud platforms within a centralized identity solution, with hybrid networking connectivity.Customer ExampleTo illustrate our point, we use the following example of a real life customer scenario, under the fictitious name of “Acme Corporation.”Acme Corporationis a capital wealth management company operating in three countries: USA, Canada, and Brazil. Business is growing and they are exploring cloud services.Their corporate headquarters is located in NY, USA, and they have established offices (branches) in Canada and Brazil. The organization operates in a decentralized model, which consists of different governance over their identity structure. An Active Directory Forest is established per region with a cross-forest trust relationship. The company is looking to adopt cloud technologies and needed a common identity solution across on-premises and cloud services with Azure Active Directory and AWS.We’ve outlined the solution in the following diagram:Figure 1 – Solution OverviewOptions to source identities into AWS Single Sign-OnAWS SSO offers the following 3 options to establish as an identity source:AWS SSOActive DirectoryExternal Identity ProviderFigure 2 – Identity Source OptionsThe first option;“AWS SSO”is a default native identity store. You can create and delete users and groups.The second option;“Active Directory”allows administrators to source users and groups from Active Directory running On-Premises Active Directory, or Active Directory in EC2 (usingAD Connectoras the directory gateway) orAWS Managed Microsoft AD directory hosted in the AWS Cloud.The third option;“External Identity Provider”enables administrators to provision users and groups from external identity providers (IdPs) through the Security Assertion Markup Language (SAML) 2.0 standard.Note:AWS SSO allowsonly one identity source at any given time. In this post, we focus on two options that help integrate a multi-forest environment with AWS Single Sign-On and Azure Active Directory.SolutionOption 1. Federating with Active DirectoryIn the hub-and-spoke model, theAWS Managed Microsoft Active Directory(AD) is the hub and the spoke is the Active Directory forests.Provision a AWS Managed Microsoft AD.If you already have an AWS Managed Microsoft AD for a hub, continue to the next step.Setuphybrid network connectivity, and firewall rulesallowing trust trafficDNS, conditional forwarding allows to resolve the trusting forests. We need an Outbound Endpoint withForwarding Rules to the different forestsso the VPCresolves the names and an inbound endpointso the forests can resolve the AWS Managed Microsoft AD names.Check the name resolution is working for the hybrid environment.Establish aForest trust relationshipand validate the trust.The following snapshot shows how your trust relationship will be displayed on the console.Note 1:You cannot use the transitive trust relationship of a child domain in a forest or cross forest relationship. In that case, you have to create an explicit trust or a domain trust to the AWS Managed Microsoft AD domain for AWS SSO. This enables you to see the user and groups required to provision the permission sets and Accounts.Note 2:AWS Managed Microsoft Active Directory in this example does not require you to host any users or groups, as this domain is only being used for the domain trust relationships. In short, this can be an empty forest.ConfigureAWS SSOto use yourAWS Managed Microsoft Active DirectoryforActive Directoryoption.The following snapshot shows how to assign a group to an account in preparation for AWS SSO enablement.The following snapshot shows how to assign a group to an account in preparation for AWS Singles Sign-On enablement and selecting a group.The following is a conceptual diagram of Acme corporation, after successful integration.Figure 3 – Option 1 – Conceptual DiagramOption 2a. Federating with Azure Active Directory Single TenantIf you have multiple-forests and would like to use a single tenant, here are the steps:Setup asingle Azure AD Connectin any forest, to consolidate users from different forests to a single Azure Tenant.Review the requirements under section “Multiple Forests, Single Azure Active Directory Tenant.ConfigureAWS SSOto use yourSingle Azure Active Directory TenantforExternal Identity Provider option.The following is a conceptual diagram of Acme corporation, after successful integration.Figure 5 – Option 2A – Conceptual DiagramOption 2b. Federating with Azure Active Directory Multiple TenantsIf option 2a is not feasible and you are usingmultiple Azure AD Connect sync servers and multiple Azure Active Directory tenants(as per the following diagram) then, you can nominate one of the Azure Active Directory tenants to connect with AWS SSO. Through B2B invitation, selectively invite users from other tenants into the nominated tenant.Note:This is not a scalable solution, as it requires administrative overhead. This should be ideal for a small set of users requiring access to AWS API or console for administrative work.Follow theMicrosoft B2B model.Tutorial:Bulk invite Azure Active Directory B2B collaboration usersThe following is a conceptual diagram of Acme corporation, after successful integration.Figure 6 – Option 2b – Conceptual DiagramConclusionIn this post, we discussed the options for connecting AWS SSO to your preferred Identity Provider, with a multi-forest infrastructure. Customers running multi-forest environments or multiple Azure tenant subscriptions now have a guide to offer their users a continued way of centralizing management and enforcing least privilege access on cloud resources. To learn more, review ourAWS Single Sign-On service content.Additional Content:AWS re:Invent 2019: Managing user permissions at scale with AWS SSO (SEC308)AWS Single Sign-On FAQsAWS re:Invent 2019: Deep dive on DNS in the hybrid cloud (NET410)Field Notes provides hands-on technical guidance from AWS Solutions Architects, consultants, and technical account managers, based on their experiences in the field solving real-world business problems for customers.TAGS:Architecture,AWS Single Sign-On,Field NotesSudhir AminSudhir Amin is a Sr. Solutions Architect at Amazon Web Services. In his role based out of New York, he provides architectural guidance and technical assistance to enterprise customers across different industry verticals, accelerating their cloud adoption. He is a big fan of snooker, combat sports such as boxing and UFC, and loves traveling to countries with rich wildlife reserves where he gets to see world's most majestic animals up close.Donny VasquezDonny Vasquez is a Sr. Solution Architect and Microsoft Specialist a AWS. He enjoys helping customers adopt the cloud through expert guidance in enterprise infrastructure applications, such as Active Directory and DNS. He enjoys gaming, biking, and watching movies with his son, Justin. Outside of family time, he is a gear-head working on his late model sports car.
During re:Invent 2019, AWS announced a new way to integrate external identity sources such as Azure Active Directory with auto provisioning of identities and groups in AWS Single Sign-On (AWS SSO). In March 2020, AWS SSO afforded customers the possibility to connect their Okta Identity Cloud to AWS Single Sign-On (SSO) in order to manage […]
Sudhir Amin
Architecture AWS IAM Identity Center Technical How-to