AWS Two-Factor Authentication with SecSign ID SAML
Protect your AWS Account with secure authentication
Use SecSign ID AWS two factor authentication for your AWS account to securely protect all your data in the cloud. Works for iOS or Android mobile devices as well as for desktop.
Find out why our Two-Factor Authentication is the best, some key-facts for developers and why you should upgrade to SecSign for your business.
Learn more about the options of on-premise use and your own customized ID App in your corporate design.
Download the plugin as cloud version for a free and convenient protection.
Table of contents
Amazon Web Services offers easy and inexpensive Cloud Computing Services on the individual Scale of your company. Applications range from storage to management and developer tools as well as customer engagement. The cloud factor allows for scalable utilization and short setup times.
By adding SecSign ID Two-Factor Authentication the login is protected from hacker attacks while offering a convenient login experience for the user.
Questions? Feel free to get in touch with us if you need help setting up your SecSign ID plugin or to request a plugin for a not yet supported environment.
1. Pre-requirements
To integrate the SecSign ID Two-Factor Authentication with AWS you first need to setup an account with AWS and have administrative access rights. More information about setting up an account and managing user rights are available on the AWS website.
You also need access to the SecSign ID administrative panel. If you need assistance managing your administrative account please contact us.
2. Edit SecSign ID Settings
Navigate to your SecSign ID Administration page and login. Select “SAML response attributes from the menu and create a new SAML response attribute.
Specify the following values:
Name in SAML response: https://aws.amazon.com/SAML/Attributes/Role
leave NameID Format, NameID Attribute-Store and
Source-Attribut blank
Fixed attribute value:
Save the settings.
Then choose SAML Service Provider from the menu and select “New SAML
service provider”. Specifiy the following parameter.
Name for example: AWS billing
NameID Attribute store: SecSign ID Server
NameID source attribute: SecSign ID
Format: urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified
Service Provider Issuer: urn:amazon:webservices
SAML response URL: https://signin.aws.amazon.com/saml
RelayState remains blank.
Audience Restriction: urn:amazon:webservices
Auth Context remains blank.
User group to sign: The user group to which you have assigned a technical user owning the private key to sign SAML responses. Example user group name: “SAML response signers.”
Hash algorithm: Server selects.
PSS padding: Server selects.
SAML attribute: Please select:
https://aws.amazon.com/SAML/Attributes/RoleSessionName and the attribute
https://aws.amazon.com/SAML/Attributes/Role created in the first step.
Save the settings.
Select “User groups” and select the user groups whose members shall be allowed to log-in at Amazon Web Services having the permissions there which we will assign in a following step, in this example to view the bills.
Double click the newly created SAML Service Provider in the list and then click on the link beside “Import the IdP SAML meta data from this URL”. Save the downloaded SAML meta data to a file.
3. Edit Amazon Web Services Settings
Open the AWS Management Console at https://aws.amazon.com/ and go the service IAM (identity and access management).
Select “Identity providers” from the left menu and “Create Provider”.
Choose “SAML” as Provider Type and enter a Provider Name, for example “SecSign-ID-Prod”.
At “Metadata Document” load the SAML meta data file which you have saved from the SecSign ID Server in step 2.
Click “Create”.
Select the newly created provider in the list and display its properties.
Copy the “Provider ARN” into a text file. We will need it later.
4. Create Role
Select “Roles” from the left menu and click at “Create Role”.
Select SAML as type of trusted entity.
Select the SecSign ID Provider as SAML Provider.
Click at “Next: Permissions”
Click at “Create Policy” and select the permissions that the SecSign ID users, that are allowed to use this SAML log-in, shall get. For example “Billing”.
Click at “Next: Review”.
Provide a name and a description to the role, for example “Bill viewers” and “users who can view the bills”.
Select “Create role”.
Copy the “Role ARN” into a text file. We will need it later.
Go back to the admin page of the SecSign ID Server, select “SAML
response attributes” from the left menu.
Select the attribute with the name
“https://aws.amazon.com/SAML/Attributes/Role” and click “Details” and
then “Update”.
Enter the “Role ARN” as a fixed attribute value from your temporary text
file, a comma and the “Provider ARN” from your temporary text file.
5. Available APIS
We provide an ever growing list of APIs and plugins to easily integrate the SecSign ID Two-Factor Authentication in any project. An overview is available at Plugin and APIs.
We do not only offer APIs in different programming languages but also plugins for CMS, Server and VPN environments, oAuth2 and many more. These plugins use our APIs and offer additional functionalities, for example user management, easy and native installation, logging or integration in firewalls or Active Directory.
The JIRA plugin for example uses the JAVA-API. The PHP-Api and JS-API is used by WordPress, Joomla, Drupal, Typo3 and many more. The ASP.net/C#-API is used for the Windows and Cisco VPN and the C-API is used for protecting Unix SSH services. The Objective-C API is used by our AppleTV and iPhone/iPad apps.
6. See for yourself
You can experience the SecSign ID two-factor authentication and the two-factor login by simply integrating the plugin into your website or test environment. Or you can try out the login process on our website without having to register first. You already have a SecSign ID or you want one? Login now and use the portal or use our hassle free registration.
See for yourself how fast and convenient the login process using challenge-response authentication with 2048-bit key pairs is. There is no need for passwords, and no passwords or other confidential information are ever transmitted. It is easy to integrate and simple to use.
For more information about the patented SafeKey procedure and it's unique security can be found here.
If you are missing an API for the programming language you are working with, feel free to contact us and we’ll find a solution with you. If you need help with the integration into an existing system or you can’t find the plugin for your content management system you are working with, don’t hesitate to contact our support team.
Your own ID-Server
On premise installations of SecSign ID offer the flexibility to connect with your preferred servers, services, and devices. And you can customize the SecSign ID with your own organization’s branding.
Why upgrade to SecSign?
On-premise or in the cloud
Choose between our SecSign ID Cloud or operate your own on-premise Two-Factor Authentication server.
Easy customization
Operate your own YourBrand ID app - Two-Factor Authentication customized to your needs.
Ready-to-use SDK
Integrate SecSign ID Two-Factor Authentication in existing apps with our ready-to-use SDK.
Easy user management
Use the Two-Factor Authentication Server to secure your company Active Directory/LDAP. Your own Identity and Access Management System, for example for mandatory updates and additional security features.
Cover all logins
Integration in any login environment: web, local, VPN, remote desktop, mobile logins and many more.
Plugins for all your needs
No need for complex integration: we have plugins for almost all environments.
