Authenticate with ADFS

An AWS handler can authenticate through Active Directory Federation Services (ADFS) instead of an access key and secret key

  2 minute read  

Use this where your organization already federates AWS access through ADFS and does not want to issue a key pair for Cloud Management Platform (CMP) to hold. CMP logs in to your ADFS server with the provided credentials, receives a SAML assertion, and exchanges it for temporary AWS credentials by assuming a SAML role.

Prerequisites

  • A SAML IAM role in AWS, and its role ARN. The role must appear in the ADFS assertion issued for the account you log in with.
  • An ADFS server with the AWS relying party trust configured and IdP-initiated sign-on enabled, since that is the page CMP posts the credentials to.
  • An Active Directory account with permission to log in there.

Create the handler

  1. Go to Admin > Resource Handlers and select Add.

  2. Select the Amazon Web Services tile.

  3. Set Credentials Type to ADFS Credentials.

  4. Complete the fields that appear:

    Field Description
    Username The Active Directory username or email address, such as admin@example.com.
    Password That account’s password.
    ADFS Domain Name The ADFS server’s domain, such as adserver.example.com.
    SAML IAM Role ARN The role CMP assumes, such as arn:aws:iam::111111111111:role/YourADFSRole.
    ADFS Server SSL Verification Leave enabled unless the ADFS server presents a certificate CMP cannot verify. Disabling it stops CMP from checking the certificate at login.

  5. Select Continue, then complete the handler’s settings and select at least one region, as described under Add an AWS resource handler.

Screenshot of the Create a Resource Handler for Amazon Web Services with ADFS Credentials selected.

CMP creates the handler and starts a job to import the regions and sync the account’s instances. Use Verify Connection on the handler to confirm the login works.

The handler’s Overview tab shows the username, ADFS domain name, and SAML IAM Role ARN in place of an access key.

  • AWS: the other credentials types, and what an AWS handler needs permission to do.