Lab – Setup AWS Connector¶

This lab will teach you how to create a SAML AWS connector. Estimated completion time: 30 minutes

Task - Download AWS metadata¶

1. From the jumpbox machine (Win7) , open new window browser tab to https://signin.aws.amazon.com/static/saml-metadata.xml and download de xml file to the Desktop. This file will be used to create and AWS external SP Connector on the BIG-IP.

Task - Create an external SP connector to AWS¶

1. Logon onto BIG-IP, then go to Access -> Federation: SAML Identity Provider -> External SP Connectors -> Create -> From Metadata

2. Enter the following values (leave others default) then click OK

Select File: saml-metadata.xml

Service Provider Name: AWS_EXT_SP

Task - Create a local IDP Service to AWS¶

1. Logon onto BIG-IP, then go to Access -> Federation: SAML Identity Provider -> Local Idp Services -> Create
Enter the following values (leave others default) on the General Settings Idp Service Name: `AWS_IDP_DEMO` IdP Entity ID: `https://webtop.vlab.f5demo.com/idp/f5/`
3. Enter the following values (leave others default) on the Assertion Settings. Assertion Subject Type: `Unspecified` Assertion Subject Value: `%{session.ad.last.attr.sAMAccountName}` Authentication Context Class Reference: `urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport`
On the Saml Attributes click Add.
5. Create the RoleSessionName Attribute with the following values (leave others default), click Update, then click OK Name: `https://aws.amazon.com/SAML/Attributes/RoleSessionName` Value: `%{session.logon.last.logonname}`
6. Create the Role Attribute with the following values (leave others default), click Update, then click OK Name: `https://aws.amazon.com/SAML/Attributes/Role` Value: `arn:aws:iam::AccountId:role/SamlAdmin,arn:aws:iam::AccountId:saml-provider/f5demo` Take the `Account Id` from AWS IAM Console `https://console.aws.amazon.com/iam`, click your User Name on the upper right, and then select My Account. A new window opens. Copy the `Account Id` and use it as part of the `Value`
Enter the following values (leave others default) on the Security Settings Signing Key: `/Common/IDP_CERT_F5DEMO.key` Signing Certificate: `/Common/IDP_CERT_F5DEMO.crt`

Task - Download IdP metadata from BIG-IP for AWS¶

1. Go to Access -> Federation: SAML Identity Provider -> Local IdP Services, select the AWS_IDP_DEMO object, then click Export Metadata. Leave the Sign Metadata to No, and then click Download.

Task - Bind IdP and SP Connector to AWS¶

1. Go to Access -> Federation: SAML Identity Provider -> Local IdP Services, select the AWS_IDP_DEMO object, then click Bind/Unbind SP Connector. Then select /Common/AWS_EXT_SP as SP connector and click OK.

image56_2

Task - Create an IdP provider in AWS¶

1. Sign in to the AWS Management Console and open the IAM console at `https://console.aws.amazon.com/iam/` then click Identity Provider
Click Create Provider
3. Enter the following values (leave others default) on the Configure Provider tab, then click Next Step Provider Type: `SAML` Provider Name: `f5demo` Metadata Document: `PATH\\AWS_IDP_DEMO_metadata.xml` For the `metadata` document choose the file that you already downloaded.
4. `Verify the information` you have provided, and then click Create.

Task - Create a new Role in AWS¶

In the left navigation pane, click Roles.
Click Create Role
3. Enter the following values (leave others default) on the Select type of trusted entity tab, then click Next: Permisions Type of trusted entity: `SAML 2.0` SAML provider: `f5demo` Select: `Allow programmatic and AWS Management Console` Attribute: `SAML:aud` Value: `https://signing.aws.amazon.com/saml`
4. Enter the following values (leave others default) on the Attach permissions policies tab, then click Next: Review Select the Policy Name: `AdministratorAccess`
5. Enter the following values (leave others default) on the Review tab, then click Create Role Role Name: `SamlAdmin`

Task - Create a AWS SAML resource in BIG-IP¶

1. Go to Access -> Federation: SAML Resources -> Create.

2. Enter the following values (leave others default) on the New SAML Resource tab, then click Finished.

Name: AWS_SAML_DEMO

SSO Configuration: AWS_IDP_DEMO

Caption: AWS (SAML)

Task - Assign the AWS SAML resource¶

1. Go to Access -> Profiles/Policies -> Access Profiles, then click Edit for webtop_demo, a new browser tab will open
2. Click the `+` between AD Auth and Advanced Resource Assign, select AD Query from the Authentication tab, click Add Item
3. Enter the following values (leave others default) then click Save Server: `/Common/webtop_demo_aaa_srvr`
4. Click on the AD Query object, a new window will open. Click on the Branch Rules tab
5. Click on change link, and then delete the expression using `X`. After that select AD Auth from Agent Sel parameter then click Add Expression. Click Finished and change the name to Passed Query then Save.
6. Click on the Advanced Resource Assign object, a new window will open. Click Add/Delete, then choose `/Common/AWS_SAML_DEMO` from the SAML tab and click Update, then Save.
7. Click Apply Access Policy in the top left and then close the browser tab
Go to `https://webtop.vlab.f5demo.com` from the jump host, You can login with any user: sales_user sales_manager partner_user You should see an AWS (SAML) object that you just created.
9. Click on the AWS link. You should be able to access AWS GUI because of `SSO` (SAML Federation).

Previous Next