Source
r/aws•
FetchKFF

Third party SSO providers similar to AWS SSO?

technical question

Does anyone know of any third party (paid is fine) SSO providers that can act similarly to AWS SSO? Specifically, that can automatically import all accounts in an Organization and allow user groups to be given access to them?

I'm not having much luck. Okta says they have a product like this, maybe (and if anyone can link me to it that'd be great).

AWS SSO itself is fine but the limited backends is a huge pain for non-Windows shops.

Posted Dec 4, 2019, 4:22 AM UTC

07
cryonine•

https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_saml_3rd-party.html

That’s a whole list of providers that support federated access in AWS.

3
FetchKFFOP•

Yes, thank you, but those providers do not handle providing a web interface that lists all of the AWS accounts in an Organization that a user has access to. That aspect requires scanning AWS Organizations for account lists, adding IAM Identity Providers to accounts, presenting a web interface, etc.

1
jbtechwood•

Okta SSO will handle AWS console access. Not sure what you mean by automate the provisioning from an org level, I don't think okta can do that. I've run okta for the better part of 10 years and don't think I've ever seen automated account provisioning like what you're describing. They do have a template for AWS console access which only requires a very limited amount of info per account and they have an API as well, so you might be able to script the standup.

1
FetchKFFOP•

If you run AWS SSO when you have a large-ish AWS Organization, it will:

- Scan for accounts

- Add itself as an IAM Identity Provider (I think. This might be handled by Landing Zone)

- Present a web interface for users to log in with their centralized creds

- Display a list of AWS accounts, provide a console link, as well as temporary credentials that can be used for command line API access

I *think* AWS acquired the code for AWS SSO (just from digging around in its "API" and some similarities to other products) but I'm by no means certain.

1
blockcollab•

Maybe Keycloak? It has user federation where you can import users from LDAP. You can also create a realm for an organization by importing a JSON file. In this file you can also define users.

https://www.keycloak.org/

1
vinod_4b9•

Hi Everyone,

we are planning to deploy Landing zone solution in mumbai region , once the Landing zone is deployed successfully , Is there any third party active directory where I can use to integrate with my company Active Directory.

We can't use AWS SSO as it is not in Mumbai region. Any other third party AD integrator which i can leverage here for my organisation Microsoft Active Directory

1
pmd83•

Auth0?

0