AWS identity provider integration

cnsmith

Can I point AWS identity provider to fusionauth? Curious if there are any docs on this if its possible. I assume it will be SAML? Looks like OpenID is an option as well?

Thanks,

Cory

cnsmith

I was able to get the integration to work by setting Authorized redirect URLs to localhost:35001 per the aws vpn client documentation.

dan

@cnsmith I haven't done this integration myself, but if AWS supports SAML or OIDC, it should work. You might give it a go and share more details of any issues you are running into. Please let us know what you find!

cnsmith

I was able to setup fusionauth as an AWS IdP. When AWS Client VPN tries to connect it redirects to fusionauth login, but throws this error. Any suggestions?

{
"code" : "Requester",
"message" : "The AuthnRequest contained an invalid issuer [urn:amazon:webservices:clientvpn] that does not map to an Application in FusionAuth"
}

I would expect fusionauth to issue a login page where the user would login which would then grant access to the VPN.

dan

@cnsmith Have you turned on debug logging? If you do that and check the Event Log (System -> Event Log) that might provide additional details.

cnsmith

@dan I do have debugging on but Im not seeing anything in the logs.

cnsmith

@dan I was able to fix that error by making the entity ID urn:amazon:webservices:clientvpn. Seems obvious now.

cnsmith

@dan

Fusionauth prompts the client for their username and password. Upon logging in it redirects me back to the base URL https://auth.<company>.com which throws a 405 status code. Error pasted below. I updated my cors to allow post methods and a bunch of headers as well as that url. Any suggestions?

This page isn’t workingIf the problem continues, contact the site owner.
HTTP ERROR 405

cnsmith

Proxy logs shows the 405 and &userState=AuthenticatedRegistrationNotVerified

cnsmith

I was able to get the integration to work by setting Authorized redirect URLs to localhost:35001 per the aws vpn client documentation.

dan

@cnsmith Did you get everything working or are there still issues?

titustabitha84

Since the original post is from two years ago, it's important to consider that the technology landscape and integration options may have evolved since then.