Field Notes: Integrating Active Directory Federation Service with AWS Single Sign-On
AWS Architecture BlogField Notes: Integrating Active Directory Federation Service with AWS Single Sign-Onby Shirin Bano | on15 SEP 2021| inArchitecture,AWS IAM Identity Center,Technical How-to|Permalink|ShareEnterprises use Active Directory Federation Services (AD FS) with single sign-on, to solve operational and security challenges by allowing the usage of a single set of credentials for multiple applications. This improves the user experience and helps manage access to the applications in a centralized way.AWS offers a native cloud-based single sign-on solution calledAWS Single Sign-On (AWS SSO). This service helps centrally manage SSO access and user permissions to all the AWS accounts and cloud applications. AWS SSO supports identity federation with SAML 2.0, allowing integration with AD FS solutions. This helps enterprises migrate to AWS, who have a hybrid environment with on-premises AD FS and need access to AWS accounts and cloud applications. Users can sign in to the AWS SSO portal with their corporate credentials thus reducing the admin overhead of maintaining separate credentials on AWS SSO.Note: you can skip AD FS and connect your Active Directory to AWS SSO directly, instead. This gives you a simpler integration and with AD FS, enables you to use WebAuthn and TOTP MFA, and gives you a free and easy SAML IdP for apps. However, if you have specific constraints that require using AD FS, this blog will help you configure that.This section explains the authentication flow with AD FS and AWS SSO integration. You can use Identity Provider (AD FS) initiated or Service Provider (AWS SSO) initiated authentication methods.Following are the steps involved for both Identity Provider (IdP) and Service Provider (SP) initiated authentication methods:1. IdP Initiated Authentication FlowAuthentication Flow:You access the SSO user-portal URL. The authentication flow depends on how you initiate the login request. There are 2 methods in which you can access the SSO user-portal.IdP (AD FS) Initiated Authentication Method1.a. This method is followed when users access the AD FS SSO user-portal URL. Some organizations prefer this method when they have a federation system built into their on-premises network and they start using AWS Services. The AWS SSO and AD FS integration allows them to continue using the AD FS user-portal URL, and to login even after they move to AWS.The following diagram outlines the architecture for the IdP (AD FS) Initiated Authentication Method.2. SP Initiated Authentication FlowThe following diagram outlines the architecture for an SP Initiated Authentication flow.SP (AWS SSO) Initiated Authentication MethodThis method is followed when users access the AWS SSO user-portal URL, for example, https://d-12345c789.awsapps.com/start.Once the request arrives at the AWS SSO endpoint, it is redirected to the AD FS user-portal URL.The user then goes to the AD FS user-portal URL, for example, https://acmecorp.com/adfs/ls after which the traffic flow is similar to the IdP Initiated Authentication method.You are asked to enter the username and password after which it is authenticated against the Active Directory.You receive a SAML assertion, as an authentication response, from AD FS. The assertion identifies you and includes attributes about you as the user.You are redirected to the AWS SSO endpoint and it posts the SAML Assertion.AWS SSO endpoint calls the AssumeRoleWithSAML API to the STS service for temporary security credentials on your behalf. This creates a console sign-in URL that uses those credentials.AWS sends the sign-in URL back to you as a redirect. You are then re-directed to the AWS SSO Application page, where you can choose the account to log into or the cloud/custom application to use.Process to Integrate AD FS with AWS SSOIn this section, we show the configurations needed to establish a trust between AD FS and AWS SSO. This allows you to log into AWS accounts using the credentials configured in AD FS.Step 1: Build SAML Trust Relationship between AD FS and AWS SSOGet AWS SSO SAML metadata information.Log into the AWS account where you have configured AWS SSO. On theAWS SSO console, selectDashboardand thenChoose your identity source.On the settings page, selectChange, next to the Identity source.Change the identity source and selectExternal identity provider.Under Service provider metadata, selectshow individual metadata information.Make a note ofAWS SSO Sign-in URL,AWS SSO ACS URL, andAWS SSO issuer URL, as these will be used to configure AWS SSO as the relying party in the AD FS settings.Figure 1 – Service Provider metadataAdd AWS SSO as a Relying Party in AD FSGo toAD FS Managementfrom the Tools menu in the Server Manager.SelectAdd Relying Party Trust.ForAdd Relying Party Trust Wizard, chooseClaims awareand selectStart.ForSelect Data Source, selectEnter data about the relying party manually.ForSpecify Display Nameadd a user-friendly name for example – AWS SSO.ForConfigure URL, select the optionEnable support for the SAML 2.0 WebSSO protocol.Enter the value forAWS SSO ACS URLthat you got in the previous step (Figure-1).Figure 2 – Add AWS SSO as a Relying Party in AD FS8. For Configure Identifiers, add theAWS SSO Issuer URL(Figure-1), in the Relying party trust identifiers box and selectAdd.9. Leave the rest of the configuration as default and clickNextuntil the relying party trust is successfully added.Figure 3 – Configure IdentifiersAdd Claim Issuance PolicySelect the Relying Party Trust you created in the previous step and go toEdit Claim Issuance Policy.In theEdit Claim Issuance Policy for AWS SSO dialog box, selectAdd rule.In theAdd Transform Claim Rule Wizardfrom the drop-down menu forClaim rule template, selectTransform an incoming claim.Enter a name for the claim rule, for this example –Rule for SSO.SelectUPNforIncoming claim type,Name IDforOutgoing claim typeandEmail for Outgoing name ID format.Figure 4 – Transform Claim RuleNote: The rule language for the above rule is:c:[Type == "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn"]=> issue(Type = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier", Issuer = c.Issuer, OriginalIssuer = c.OriginalIssuer, Value = c.Value, ValueType = c.ValueType, Properties["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/format"] = "urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress");Get AD FS metadata from the Windows machine1.      Enter this meta-data document endpoint URL,  https://acmecorp.com/federationmetadata/2007-06/federationmetadata.xml, in your web browser, replacing acmecorp.com with your domain used for AD DS.2.     Download thefederationmetadata.xmlfile on your local machine as it will be needed for the AWS SSO configuration.Upload AD FS metadata to AWS SSOFrom the AWS SSO console, selectDashboardand go toChoose your identity source.On the settings page, selectChangenext to the Identity source.Change the identity source and selectExternal identity provider.UnderIdentity provider metadata, Browse and upload theAD FS metadata.Figure 5 – Upload AD FS metadata to AWS SSOStep 2: Provision Users in AWS SSOYou must provision users in AWS SSO, to make it aware of the users in your IdP. There are 2 ways of provisioning the users in AWS SSO:Automatic ProvisioningWith SAML, we do not have a way to query the IdP to learn about the users and groups. However, AWS SSO support System for Cross-domain Identity Management (SCIM) v2.0 standard. With SCIM you can keep the identities in AWS SSO in sync with the identities from your IdP which support SCIM (like Azure AD). Refer to the guide onAutomatic Provisioningfor more information.Manual ProvisioningSome IdPs do not support SCIM. In that case, you will need to manually provision the users in AWS SSO. The username in AWS SSO should be identical to the username configured in your IdP. In this setup, we are using the email address as the username. Adding users manually can be tedious and is prone to errors. You can implementthis solutionto programmatically create users and groups into AWS SSO from a CSV file with user and group information.For this demonstration, we show how to manually provision the user in AWS SSO. You can also go with Automatic Provisioning, if your IdP supports it.Manually Provision user in AWS SSOAdd User from the Users section in AWS SSO consoleFor Username, enter the email address of the user that was created in Windows ADNote:Since the Outgoing NameId format is set as email address (Figure 3), the username should match the email address of the user configured in Windows AD. Make sure that the values entered for Username and Email address exactly match the values in AD DS, as the credentials are verified against the values in AD DS.Figure 6 – Edit user detailsNext, we show how to create a new Permission Set and how a user is assigned to an AWS account. If you already have the permission set configured and users assigned to accounts, skip toStep-4to verify your settings.Step 3: Manage Access Permissions for the UserThis step defines the permission boundaries for the user provisioned in AWS SSO that allows them to access AWS Accounts.AWS SSO is integrated withAWS Organizationsand users have the capability to use their IdP credentials to log into the accounts in the Organization. You can access the primary (master) account as well as the member accounts. Permission sets define the level of access for the users and groups for the AWS accounts. Refer to thisPermission Sets documentfor more details.In this example, we create a custom permission set forRead Only accesstoCloudWatch Logsfor the log archive account in the organization.We have not covered how to manage access to your custom application with AWS SSO. For more details on this, review our documentation onManage SSO to your applications.Create a Custom Permission SetOn theAWS SSO Console, choose AWS Accounts and then select Permission Sets. Select Create permission Set.Select Create a custom permission seton the Create new permission set page and selectNext.EnterNameanddescriptionfor the Permission Set and selectAttach AWS managed policies.ChooseCloudWatchLogsReadOnlyAccess, from the list of AWS managed policiesAssign a User to AWS AccountsThis step is used to define which AWS Accounts a user can access. It also defines the Permission Set that the user can use while accessing an AWS Account.On the AWS SSO console, selectAWS Accountsand choose theAWS Organizationstab. You will see the list of accounts in the organization.Select theaccount(s)for which the user should have access. You can select multiple accounts.ChooseAssign usersand select the user from the list of users. You have the option of selecting multiple users or groups.In the next step, select thepermission setwe created in the previous step.Figure 7 – Assign a User to AWS Accounts5.     SelectFinish.Step 4: Verify your settingsThe AD FS and AWS SSO configurations are now complete. It is now time to verify the configurations.1.      If you follow the SP initiated authentication method and entered theAWS SSO user-portal URL, it will re-direct you to the IdP URL and you will land on the same page.You should see the following login page:Figure 8 – AD FS Login pageIf you follow the SP initiated authentication method and entered theAWS SSO user-portal URL, it will re-direct you to the IdP URL and you will land on the same page.2.      After you enter the user credentials, i.e the email address and password for the user. You will be re-directed to the AWS SSO page. All the accounts and applications for which the user is provisioned for are shown on the following page. You can see the permission set(s) for the user after selecting the accountFigure 9 – AWS SSO Sign On Page3.      Select Management console to access the console of the account.4.      Go to theCloudWatch Consoleand then to logs to verify your access.ConclusionIn this walk-through, we showed how you can use your corporate credentials in AD FS, to log in to your AWS account and cloud applications. This eliminated the need to maintain separate credentials on AWS, thereby giving a better user experience. We did this by establishing a trust between  AD FS and AWS SSO. We described the steps on how to manually add users in AWS SSO. We also demonstrated how to create a permission set and assign a user to an account using that permission set. In addition, we provided illustrations of what you should see when accessing AWS SSO user-portal URL (SP Initiated) or the AD FS user-portal URL (IdP Initiated).We hope this post helps you to understand how the AWS SSO integrates with Windows AD FS.If you have any questions or feedback, please leave a comment below.Field Notes provides hands-on technical guidance from AWS Solutions Architects, consultants, and technical account managers, based on their experiences in the field solving real-world business problems for customers.TAGS:Field NotesShirin BanoShirin Bano is a Cloud Infrastructure Architect with AWS Professional Services, with 5 years of experience working on AWS services. Over the past years, she has worked with many enterprise customers to migrate them to AWS, design solutions following best practices, and optimize their AWS infrastructure. She holds a Masters in Telecommunication from the University of Colorado at Boulder.
Enterprises use Active Directory Federation Services (AD FS) with single sign-on, to solve operational and security challenges by allowing the usage of a single set of credentials for multiple applications. This improves the user experience and helps manage access to the applications in a centralized way. AWS offers a native cloud-based single sign-on solution called […]
Shirin Bano
Architecture AWS IAM Identity Center Technical How-to