title: Desktop application accessing AWS with Azure AD federation SSO
body: <p>I have a desktop application that has the ability to access AWS S3 buckets. Our enterprise uses Azure AD for user management. What we would like to accomplish is to Authenticate users in our enterprise via Azure AD and let them access the S3 resource through our DESKTOP application (programmatically in python).</p>
  
  <p><strong>What I have been able to accomplish:</strong></p>
  
  <ol>
  <li>Set up federation between AWS - Azure such that a user with Azure account and one who is assigned an appropriate role can access the S3 resource - Via SAML </li>
  <li>Programmatically in python obtain temporary credentials from AWS STS when the user signs in with Azure AD credentials (username/password). This involves some web scraping/capturing SAMLResponse etc..</li>
  <li>Use the temporary credentials to access the S3 bucket using boto in python.</li>
  </ol>
  
  <p><strong>What I am missing and need help with is the SSO for Azure AD:</strong> 
  How can I emulate something like outlook/teams application behavior such that if the user is already signed in with Azure AD I can use the "session" (Whatever that would be, token etc..) to then request temporary credentials (Steps 1-3 above) from AWS STS rather than make user enter the Azure AD username/password? Additionally, if it so happens that the user is not signed in then a webpage pops-up asking for credentials and then authentication proceeds.</p>
  
  <p>I would appreciate any help with this issue. The problem is that I have a desktop application and not a web application which would have been simpler.</p>