feat(aws-infra): Authentik as external IdP for org IAM Identity Center (SAML + SCIM) - #41
Open
coolguy1771 wants to merge 21 commits into
Open
feat(aws-infra): Authentik as external IdP for org IAM Identity Center (SAML + SCIM)#41coolguy1771 wants to merge 21 commits into
coolguy1771 wants to merge 21 commits into
Conversation
Wire an authentik.Application (SAML SSO + backchannel SCIM provisioning) to AWS IAM Identity Center, plus aws-admins/aws-viewers permission sets. Account assignments stay gated behind an explicit assignmentsEnabled flag so preview/apply don't fail before the SCIM sync creates matching groups.
Drop the unused resolveAssignmentsPending import, mark the SCIM token secret even if the caller forgot, and guard the SAML/SCIM provider id -> number conversions so a malformed id fails loudly instead of sending NaN to the Authentik API.
Align with bao-sync JWT auth and fail fast instead of exporting null tokens.
- identityCenterAuthentik: SCIM provider is only attached when icScimUrl is set, so the first (SAML-only) apply can run before automatic provisioning is enabled in the IC console. Adds icScimAttached stack output. - index.ts: IC gate no longer requires icScimUrl; the SCIM token is only resolved when icScimUrl is present. - Pulumi.prod.yaml: real values for org o-2j4dlyoocl -- management account 977656673179, workload 417568418531, instance ssoins-722325f246f3860b, authentikUrl. ACS / audience / SCIM URL still come from the console bootstrap. Claude-Session: https://claude.ai/code/session_01EZ2pLGAZfBApkjFhAvjthW
Rewrite the README Identity Center bootstrap checklist for org o-2j4dlyoocl with real account ids, the SAML-first apply order (SCIM is now optional), and an explicit warning that accepting the external IdP wipes the Identity Center directory and all assignments until SCIM re-provisions. Claude-Session: https://claude.ai/code/session_01EZ2pLGAZfBApkjFhAvjthW
From the us-east-1 IAM Identity Center SP metadata for identity store d-9067963c52. SCIM URL still pending the console "enable automatic provisioning" step. Claude-Session: https://claude.ai/code/session_01EZ2pLGAZfBApkjFhAvjthW
The first SCIM sync tried to push every Authentik user: service accounts (ak-outpost-*) have no email so userName came out empty (AWS 400), and unrelated users collided with pre-existing Identity Store entries (AWS 409). Set groupFilters to the aws-admins / aws-viewers group ids and excludeUsersServiceAccount so only those two groups and their members sync. Claude-Session: https://claude.ai/code/session_01EZ2pLGAZfBApkjFhAvjthW
Replace the single workloadAccountId assignment target with assignmentAccountIds (config key icAssignmentAccountIds). prod assigns aws-admins / aws-viewers in both the workload (417568418531) and management (977656673179) accounts, matching the pre-cutover Admins group reach, and enables assignments (icAssignmentsEnabled) now that SCIM has synced the groups into the Identity Store. Claude-Session: https://claude.ai/code/session_01EZ2pLGAZfBApkjFhAvjthW
AWS IAM Identity Center's ACS only advertises the HTTP-POST binding. Authentik's ProviderSaml defaults spBinding to redirect, so the signed response was deflated into a GET query string that AWS silently dropped (no Federate event, generic "we couldn't complete your request" page). Pin spBinding to post. Claude-Session: https://claude.ai/code/session_01EZ2pLGAZfBApkjFhAvjthW
Captures what the first live cutover of org o-2j4dlyoocl needed beyond the original plan: - keeper-ic-pulumi also needs SAML-provider + aws-reserved/sso role IAM actions for first-time permission-set provisioning; full policy checked in as infra/aws/keeper-ic-pulumi.policy.json. - SAML provider default_name_id_policy must be emailAddress (AWS 400s on unspecified); not expressible in the terraform provider yet -> manual step. - SCIM must be scoped (groupFilters + excludeUsersServiceAccount) and colliding pre-cutover Identity Store users deleted first. - Hand-made AccountAssignments need `pulumi import`, not create. - CLI profiles move to sso_role_name = aws-admins. Claude-Session: https://claude.ai/code/session_01EZ2pLGAZfBApkjFhAvjthW
No behaviour change (pulumi preview: 23 unchanged, all resource names kept).
- Drop the unused `authentikUrl` module arg (provider auth is env-only).
- Fold `icScimUrl` + `scimToken` into one optional `scim: {url, token}`; validate
once in index.ts instead of a redundant check in createScimProvider.
- Resolve the group names once and thread concrete strings, instead of
`?? "aws-admins"` in four places.
- Rename createAccountAssignment -> createAccountAssignments (it loops accounts);
drive both groups from one array in the caller.
- Guard: assignmentsEnabled with an empty account list now throws.
- Remove the dead resolveAssignmentsPending helper + its test.
- Update the Pulumi.yaml project description.
Claude-Session: https://claude.ai/code/session_01EZ2pLGAZfBApkjFhAvjthW
|
Too many files changed for review (149 files, 100 file limit). Bypass the limit by tagging |
Match the repo rename swept in chore/rename-cloud-security-cluster. Claude-Session: https://claude.ai/code/session_01EZ2pLGAZfBApkjFhAvjthW
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Authentik as external IdP for the org IAM Identity Center (SAML + SCIM)
Manages, in the existing
infra/aws/prodPulumi stack:aws-admins/aws-viewers, a SAML provider + application (aws-iam-identity-center), and a SCIM provider scoped (viagroupFilters+excludeUsersServiceAccount) to just those two groups.aws-admins→AdministratorAccessandaws-viewers→ReadOnlyAccess.icAssignmentAccountIds), gated behindicAssignmentsEnabledfor the two-phase rollout.ic-managementprovider intoarn:aws:iam::977656673179:role/keeper-ic-pulumifor the SSO Admin / Identity Store APIs..github/workflows/aws-infra.ymlfetchesAUTHENTIK_TOKEN/AUTHENTIK_SCIM_TOKENfrom OpenBao (secret/data/pulumi/authentik) via a newgithub-actions-aws-infraJWT role, gated on repo varAUTHENTIK_IC_ENABLED.Not in code (one-time console / manual)
Changing the IC identity source and enabling SCIM have no API — see the rewritten Identity Center bootstrap checklist in
README.md. Also manual: the SAML provider'sdefault_name_id_policymust beemailAddress(AWS 400s onunspecified; the goauthentik terraform provider 1.2.1 can't express it), andinfra/aws/keeper-ic-pulumi.policy.jsonmust be attached to the management role out-of-band.Gotchas captured in the runbook
spBinding: "post"); a redirect-binding response is silently dropped with no CloudTrailFederateevent.userName(AWS 400); pre-cutover Identity Store users whose email collides with anaws-*member must be deleted first (AWS 409).AccountAssignments needpulumi import— the AWS provider errorsalready existsrather than adopting.Follow-ups (tracked, not blocking)
AUTHENTIK_IC_ENABLED=true.~/.aws/configatsso_role_name = aws-admins.Adminsgroup + permission set (or keep as break-glass alongside management root).Test
cd infra/aws && npm test && npx tsc --noEmit— green.pulumi preview -s prod— no drift.https://claude.ai/code/session_01EZ2pLGAZfBApkjFhAvjthW