0

BACKGROUND: I am trying to setup single sign on between an on prem AD and AWS via ADFS. I do not have access to our ADFS instance and I really dont know much at all about ADFS so I am left trying to guess at solutions to this. Fortunately, I think I am close and just have one claims rule translation to resolve before I believe everything will work as it should.

ISSUE: The issue I am having is that I need to translate an AD group into an AWS role using Claims Rule Language (which I also dont have much experience with) but the the rule I have come up with isn't working properly.

What I've Tried: I've gotten the AD groups to fill the temp/variable type and get passed to the next step in the pipeline where the tokens are issued. The format for the AD group I need to parse is: AWS#AWS_AccountName#AWS_RoleName#AWS_AccountNumber (i.e. AWS#Sandbox#SecurityAuditor#1234567890).

I need to use the AWS_RoleName and AWS_AccountNumber in this group name to generate the arn that is to be passed to AWS. I tried to use RegExReplace to do this with this rule: c:[Type=="http://temp/variable", Value=~"(?i)(^AWS)#([-_a-z0-9]+)#([-_a-z0-9]+)#([-_a-z0-9]+)"] => issue(Type="https://aws.amazon.com/SAML/Attributes/Role", Value=RegExReplace(c.Value, "(?i)(^AWS)#([-_a-z0-9]+)#([-_a-z0-9]+)#([-a-z0-9]+)", "arn:aws:iam:$4:saml-provider/ADFS,arn:aws:iam:$4:role/AWSReservedSSO$3))

The idea being that I would use $ to fill out the AWS rolename that is needed to gain access. However I dont thing this is working because I just read that the RegExReplace replaces ALL RegEx matches in the source string with the string generated by the 3rd parameter.

Can anybody point out the flaws in this claim rule or a better rule to write to get the desired result?

Thank you in advance

0

Okay, so for some reason my $index construction wasnt working. When I replaced those with named variables in my regex, it started working properly. So my updated claims rule looks like:

c:[Type=="http://temp/variable", 
Value=~"(?i)(^AWS)#([-_a-z0-9]+)#([-_a-z0-9]+)#([-_a-z0-9]+)"] => 
issue(Type="https://aws.amazon.com/SAML/Attributes/Role", 
Value=RegExReplace(c.Value, 
                   "(?i)(^AWS)#(?<accountname>[-_a-z0-9]+)#(?<role>[-_a-z0-9]+)#(?<accountnumber>[-a-z0-9]+)", 
                   "arn:aws:iam:${accountnumber}:saml-provider/ADFS,arn:aws:iam:${accountnumber}:role/${role}))

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.