Configuring user provisioning for Amazon Web Services (Amazon Specific)

Transcription

1 Chapter 2 Configuring user provisioning for Amazon Web Services (Amazon Specific) Note If you re trying to configure provisioning for the Amazon Web Services: Amazon Specific + Provisioning app, you re the right place. If you re trying to configure provisioning for the Amazon Web Services: SAML + Provisioning app, see Configuring user provisioning for Amazon Web Services (SAML) This section includes the following topics: "Creating the Amazon Web Services IAM user and generating the key values" on page 2-96 "Configuring Amazon Web Services in Admin Portal for automatic provisioning" on page 2-97 "Provisioning users for Amazon Web Services based on roles" on page 2-98 Creating the Amazon Web Services IAM user and generating the key values In the Amazon Web Services Management Console, you generate the authentication keys that you ll enter in Admin Portal to configure provisioning. For more details, see the Amazon Web Services documentation. To generate the key values on the Amazon Web Services console: 1 Log in to the AWS Management console at using an account that has Administrator access. Note In the AWS Management console, you assign permissions to groups by way of policies. You can assign policy templates, generate a policy, or create a custom policy. Consult the Amazon Web Services documentation for more information ( docs.aws.amazon.com/iam/latest/userguide/controllingaccess.html). 2 Navigate to 3 Click Continue to Security Credentials. 4 Click Access Keys (Access Key ID and Secret Access Key). 5 Click Create New Access Key. 96

2 Configuring Amazon Web Services in Admin Portal for automatic provisioning Note If you already have two Access Key IDs, you will need to delete an existing Access Key ID before you can create a new one. 6 Click Download Key File to download the Access Key ID and Secret Access Key. A.csv file downloads containing the access keys for the users you created. This is the only time you can download the access keys, and you will need this file to copy the access keys into the Admin Portal soon when you configure provisioning. 7 Click Close. You re ready to add the application in Admin Portal and configure it for provisioning. For details, see Configuring Amazon Web Services in Admin Portal for automatic provisioning. Configuring Amazon Web Services in Admin Portal for automatic provisioning You can deploy SSO access to Amazon Web Services using either Amazon Web Services proprietary authentication method or with SAML. Initially, Amazon Web Services only supported their own, custom authentication method. Now they also support SAML. You can choose to use either method for your deployment. To configure Amazon Web Services in Admin Portal for automatic provisioning: 1 In Admin Portal, add, configure, and deploy the Amazon Web Services (AWS) Amazon Specific + Provisioning For details, see Configuring Amazon Web Services (Amazon Specific). Tip Configure the rest of the application before enabling provisioning to simplify any necessary troubleshooting. Although SSO configuration isn t required for provisioning to work, you do need to configure SSO so that provisioned users can access the 2 On the application s Provisioning tab, select Enable provisioning for this 3 Select either Preview Mode or Live Mode. Preview Mode: Use Preview Mode when you re initially testing the application provisioning or making configuration changes. The cloud service does a test run to show you what changes it would make but the changes aren t saved. Live Mode: Use Live mode when you want to use application provisioning in your production system. The cloud service does the provisioning run and saves the changes to both the cloud service and the application s account information. Chapter 2 Configuring user provisioning for Amazon Web Services (Amazon Specific) 97

3 Provisioning users for Amazon Web Services based on roles Note Enter the following information for the provisioning details: Field Access Key Secret Key Description Paste in the Access Key from the IAM user that you created in Amazon Web Services. Paste in the Secret Key from the IAM user that you created in Amazon Web Services. Note If you re using the Amazon Web Services application in Admin Portal that uses Amazon Web Services proprietary authentication configuration (the Web-Amazon version), you can re-use the keys that you entered on the Application Settings page here. 4 If needed, use the horizontal and vertical scroll bars to bring the Verify button into view. 5 Click Verify to have the cloud service verify and save the connection and save the provisioning details. Provisioning users for Amazon Web Services based on roles Here you specify a Admin Portal role and specify that users in that role will be matched to existing or new accounts in Amazon Web Services with the roles that you specify. When you change any role mappings, the cloud service synchronizes any user account or role mapping changes immediately. Notes How the cloud service determines duplicate user accounts: If the user accounts in the cloud service and the target application match for the fields that make an Amazon Web Services user unique, then the cloud service handles the user account updates according to your instructions. In many applications, the user s address or Active Directory userprincipalname is the primary field used to identify a user and in many cases, the userprincipalname is the address. You can look at the application s provisioning script to see the fields that the cloud service uses to match user accounts. To automatically provision users with Amazon Web Services accounts: 1 First, make sure that you ve entered and verified the provisioning credentials. 2 You specify which users have access to the application with the roles you add in the application s User Access tab. You specify what kind of access users have in the target application by assigning roles in the Provisioning > Role Mappings area. 3 In the Provisioning page, scroll down to the Role Mappings section. Cloud Manager user s guide 98

4 Provisioning users for Amazon Web Services based on roles 4 Select either Overwrite or Keep to specify how the cloud service handles situations when the cloud service determines that the user already has an account in the target Overwrite: Select Overwrite to update and overwrite the target application user account information with the cloud user account information. Note If the target user account has a value for a user attribute that doesn t exist in the cloud user account, then the cloud service leaves that target user account attribute value intact. Keep: Select Keep to keep the target user account as it is; the cloud service skips and doesn t update the duplicate user account in the Retain: If you select Keep, you can also select Retain to keep the existing target application user account active when changes in roles or role mappings result in the user no longer being assigned and provisioned to the To deprovision users when the user is no longer assigned and provisioned to the application, do not select this option. 5 Click Add to add role mappings and specify which users get provisioned to this The Role Mapping dialog box opens. 6 Select a Role and click Add. 7 Select a Destination Group. 8 Click Done to save the role mapping and return to the Provisioning page. 9 Continue adding role mappings, as desired. To change a mapping, select the role mapping and click Modify. To remove a mapping, select the role mapping and click Delete. Note The provisioning script is intended for advanced users who are familiar with editing server-side JavaScript code. 10 When you ve finished making changes, click Save to save the provisioning details. Any time that you make changes to the provisioning role mapping, the cloud service runs a synchronization automatically. You can also run a preview synchronization or a real synchronization, if desired. Chapter 2 Configuring user provisioning for Amazon Web Services (Amazon Specific) 99

5 Provisioning users for Amazon Web Services based on roles Cloud Manager user s guide 100