Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Reference EP repo rather than original #47

Open
wants to merge 8 commits into
base: master
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 35 additions & 8 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,27 +1,54 @@
# SAML to AWS STS Keys Conversion
Google Chrome Extension which converts a SAML 2.0 assertion to AWS STS Keys (temporary credentials). Just log in to the AWS Web Management Console using your SAML IDP and the Chrome Extension will fetch the SAML Assertion from the HTTP request. The SAML Assertion is then used to call the assumeRoleWithSAML API to create the temporary credentials. (AccessKeyId, SecretAccessKey and SessionToken).

The Chrome Extension can be downloaded here:
[Google Chrome Web Store](https://chrome.google.com/webstore/detail/ekniobabpcnfjgfbphhcolcinmnbehde/)

# Table of Contents
* [Why this Chrome Extension?](#why)
* [Getting Started](#gettingstarted)
* [Create a symlink to your .aws directory (for Windows users)](#symlink)
* [Frequently Asked Question](#faq)

## <a name="why"></a>Why this Chrome Extension?
If you don't have any user administration setup within AWS Identity & Access Management (IAM) but instead rely on your corporate user directory, i.e. Microsoft Active Directory. Your company uses a SAML 2.0 Identity Provider (IDP) to log in to the AWS Web Management Console (Single Sign On). Then this Chrome Estension if for you!
If you don't have any user administration setup within AWS Identity & Access Management (IAM) but instead rely on your corporate user directory, i.e. Microsoft Active Directory. Your company uses a SAML 2.0 Identity Provider (IDP) to log in to the AWS Web Management Console (Single Sign On). Then this Chrome Extension if for you!

You run into trouble as soon as you would like to execute some fancy scripts from your computer which calls the AWS API's. When sending a request to the AWS API's you need credentials, meaning an AccessKey and SecretKey. You can easily generate these keys for each user in AWS IAM. However, since you don't have any users in AWS IAM and don't want to create users just for the sake of having an AccessKey and SecretKey you are screwed. But there is a way to get temporary credentials specifically for your corporate identity.

The Security Token Service (STS) from AWS provides an API action assumeRoleWithSAML. Using the SAML Assertion given by your IDP the Chrome Extension will call this API action to fetch temporary credentials. (AccessKeyId, SecretAccessKey and SessionToken). This way there is no need to create some sort of anonymous user in AWS IAM used for executing scripts. This would be a real security nightmare, since it won't be possible to audit who did what. This Chrome Extension however will make it super easy for you to just use your corporate identity for executing scripts calling AWS API's.

## <a name="gettingstarted"></a>Getting Started
TODO

## <a name="symlink"></a>Create a symlink to your .aws directory (for Windows users)
TODO
Once you install the app, it will download a credentials file into your downloads folder each time you assume an AWS role.

You will need to load it into Chrome as an "unpacked extension" from the Chrome Extensions menu.
1. Pull the repo down locally
2. In Chrome, go to More Tools > Extensions
3. Make sure Developer mode is enabled. It is a toggle button at top right corner. Then click on Load Unpacked.
3. Select the samltoawsstskeys folder (ie this repo)

Additionally, you may need to manually pin the extension in your Chrome address bar's extension section - this will allow you to enable/ disable the extension if required

## <a name="symlink"></a>Create a symlink to your .aws directory
We use our own version of a Chrome Extension which will automatically download a set of credentials for you when you assume the AWS role via GSuite - this will add temporary credentials into your downloads folder, which you can reference with a symlink from your .aws folder.

### Windows
In a command prompt run:
```powershell
C:\Users\user_name\.aws> mklink credentials C:\Users\user_name\Downloads\credentials
```

### Mac & Linux
Run the following command in a terminal:
```sh
ln -s ~/Downloads/credentials ~/.aws/credentials
```

If you are using multiple AWS profiles and already set AWS_PROFILE environment variable, then run the following command to set it back to default:
```sh
export AWS_PROFILE=default
```

To ensure your settings are fine, you can try the following command and should be able to see your credentials:
```sh
aws sts get-caller-identity
```

## <a name="faq"></a>FAQ: Frequently Asked Question
1. Why can I not save file somewhere else?
Expand Down
6 changes: 3 additions & 3 deletions manifest.json
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
{
"manifest_version": 2,
"author": "G.T.C. Laan (prolane.org)",
"homepage_url": "https://github.com/prolane/samltoawsstskeys",
"name": "SAML to AWS STS Keys Conversion",
"author": "EP, originally from G.T.C. Laan (prolane.org)",
"homepage_url": "https://github.com/EducationPerfect/samltoawsstskeys",
"name": "Education Perfect SAML to AWS STS Keys Conversion",
"description": "Generates file with AWS STS Keys after logging in to AWS webconsole using SSO (SAML 2.0). It leverages 'assumeRoleWithSAML' API.",
"version": "2.7",
"icons": { "16": "icons/icon_16.png",
Expand Down
2 changes: 1 addition & 1 deletion options/options.html
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@

<div id="divInfo">
<p>Developed by prolane.org (Gerard Laan)</p>
<p>For help, please see README at the <a href="https://github.com/prolane/samltoawsstskeys/blob/master/README.md" target="_blank">project page on Github.com</a></p>
<p>For help, please see README at the <a href="https://github.com/EducationPerfect/samltoawsstskeys/blob/main/README.md" target="_blank">project page on Github.com</a></p>
</div>

<div id="divSettings">
Expand Down