aws_ec2_client_vpn_endpoint: add federated auth #14171

jgeurts · 2020-07-14T17:46:21Z

This is an addendum to #13769, to add a test and documentation. Apologies if there is a better way to accomplish this - I wasn't able to commit to the fork source for #13769

Community Note

Please vote on this pull request by adding a 👍 reaction to the original pull request comment to help the community and maintainers prioritize this request
Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for pull request followers and do not help prioritize the request

Relates OR Closes #13401

Release note for CHANGELOG:

aws_ec2_client_vpn_endpoint: add SAML SSO IdP federated authentication support

Output from acceptance testing:

$ make testacc TESTARGS='-run=TestAccXXX'

...

While AWS *can* act as an SSO IdP, I don't think there's a public API for enabling it. Automated testing might be troublesome.

…n_endpoint-federated-saml-idp-authentication # Conflicts: # aws/resource_aws_ec2_client_vpn_endpoint_test.go

divyaraghavann · 2020-08-26T19:08:57Z

Any updates?

jgeurts · 2020-08-27T15:11:50Z

@divyaraghavann I don't think the PR needs any more updates, unless I'm mistaken. Last week, @bflad mentioned he would get some eyes on this PR in the next week or so: #13401 (comment), so there should be some movement soon!

DrFaust92

minor changes

aws/resource_aws_ec2_client_vpn_endpoint_test.go

…n_endpoint-federated-saml-idp-authentication

…n_endpoint-federated-saml-idp-authentication # Conflicts: # aws/resource_aws_ec2_client_vpn_endpoint_test.go

jgeurts · 2020-08-27T17:21:49Z

Thanks @DrFaust92! Those issues should be resolved! I also merged master to the branch as it was a bit behind.

divyaraghavann · 2020-08-27T20:52:20Z

Awesome, thanks y'all! 👍

bflad

The functionality looks implemented well but unfortunately the acceptance testing is currently failing. We'll need to get that fixed up before we can merge this. Please reach out if you have any questions or do not have time/ability to fix it up. 👍

bflad · 2020-08-28T17:55:54Z

aws/resource_aws_ec2_client_vpn_endpoint_test.go

+	return testAccEc2ClientVpnEndpointConfigAcmCertificateBase() + fmt.Sprintf(`
+resource "aws_iam_saml_provider" "default" {
+  name                   = "myprovider-%s"
+  saml_metadata_document = file("./test-fixtures/saml-metadata.xml")


When running this acceptance test, it looks like EC2 Client VPN is validating the actual certificate included in this SAML Metadata:

TestAccAwsEc2ClientVpn_serial/Endpoint_federated: resource_aws_ec2_client_vpn_endpoint_test.go:243: Step 1/2 error: terraform failed: exit status 1 stderr: Error: Error creating Client VPN endpoint: InvalidParameterValue: Cert with DN C=USA, ST=CA, L=San Francisco, O=Salesforce.com, OU=00D24000000pAoA, CN=SelfSignedCert_02Sep2015_182653 expired at Sat Sep 02 12:00:00 UTC 2017 status code: 400, request id: e8518c9b-d44c-4bb8-a7a3-ff6552af5931

<?xml version="1.0" encoding="UTF-8"?><md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ds="http://www.w3.org/2000/09/xmldsig#" entityID="https://terraform-dev-ed.my.salesforce.com" validUntil="2025-09-02T18:27:19.710Z"> <md:IDPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol"> <md:KeyDescriptor use="signing"> <ds:KeyInfo> <ds:X509Data> <ds:X509Certificate>MIIErDCCA5SgAwIBAgIOAU+PT8RBAAAAAHxJXEcwDQYJKoZIhvcNAQELBQAwgZAxKDAmBgNVBAMMH1NlbGZTaWduZWRDZXJ0XzAyU2VwMjAxNV8xODI2NTMxGDAWBgNVBAsMDzAwRDI0MDAwMDAwcEFvQTEXMBUGA1UECgwOU2FsZXNmb3JjZS5jb20xFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xCzAJBgNVBAgMAkNBMQwwCgYDVQQGEwNVU0EwHhcNMTUwOTAyMTgyNjUzWhcNMTcwOTAyMTIwMDAwWjCBkDEoMCYGA1UEAwwfU2VsZlNpZ25lZENlcnRfMDJTZXAyMDE1XzE4MjY1MzEYMBYGA1UECwwPMDBEMjQwMDAwMDBwQW9BMRcwFQYDVQQKDA5TYWxlc2ZvcmNlLmNvbTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzELMAkGA1UECAwCQ0ExDDAKBgNVBAYTA1VTQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJp/wTRr9n1IWJpkRTjNpep47OKJrD2E6rGbJ18TG2RxtIz+zCn2JwH2aP3TULh0r0hhcg/pecv51RRcG7O19DBBaTQ5+KuoICQyKZy07/yDXSiZontTwkEYs06ssTwTHUcRXbcwTKv16L7omt0MjIhTTGfvtLOYiPwyvKvzAHg4eNuAcli0duVM78UIBORtdmy9C9ZcMh8yRJo5aPBq85wsE3JXU58ytyZzCHTBLH+2xFQrjYnUSEW+FOEEpI7o33MVdFBvWWg1R17HkWzcve4C30lqOHqvxBzyESZ/N1mMlmSt8gPFyB+mUXY99StJDJpnytbY8DwSzMQUo/sOVB0CAwEAAaOCAQAwgf0wHQYDVR0OBBYEFByu1EQqRQS0bYQBKS9K5qwKi+6IMA8GA1UdEwEB/wQFMAMBAf8wgcoGA1UdIwSBwjCBv4AUHK7URCpFBLRthAEpL0rmrAqL7oihgZakgZMwgZAxKDAmBgNVBAMMH1NlbGZTaWduZWRDZXJ0XzAyU2VwMjAxNV8xODI2NTMxGDAWBgNVBAsMDzAwRDI0MDAwMDAwcEFvQTEXMBUGA1UECgwOU2FsZXNmb3JjZS5jb20xFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28xCzAJBgNVBAgMAkNBMQwwCgYDVQQGEwNVU0GCDgFPj0/EQQAAAAB8SVxHMA0GCSqGSIb3DQEBCwUAA4IBAQA9O5o1tC71qJnkq+ABPo4A1aFKZVT/07GcBX4/wetcbYySL4Q2nR9pMgfPYYS1j+P2E3viPsQwPIWDUBwFkNsjjX5DSGEkLAioVGKRwJshRSCSynMcsVZbQkfBUiZXqhM0wzvoa/ALvGD+aSSb1m+x7lEpDYNwQKWaUW2VYcHWv9wjujMyy7dlj8E/jqM71mw7ThNl6k4+3RQ802dMa14txm8pkF0vZgfpV3tkqhBqtjBAicVCaveqr3r3iGqjvyilBgdY+0NR8szqzm7CD/Bkb22+/IgM/mXQuL9KHD/WADlSGmYKmG3SSahmcZxznYCnzcRNN9LVuXlz5cbljmBj</ds:X509Certificate> </ds:X509Data> </ds:KeyInfo> </md:KeyDescriptor> <md:NameIDFormat>urn:oasis:names:tc:SAML:1.1:nameid-format:unspecified</md:NameIDFormat> <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Location="https://terraform-dev-ed.my.salesforce.com/idp/endpoint/HttpPost"/> <md:SingleSignOnService Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect" Location="https://terraform-dev-ed.my.salesforce.com/idp/endpoint/HttpRedirect"/> </md:IDPSSODescriptor> </md:EntityDescriptor>

Are you able to run this test, @jgeurts, and potentially fix the issue? We'll need to double check other tests that use that file as well after updates or potentially create it dynamically with templatefile().

I don't have an account that I can run the acceptance tests on at the moment. I might be able to set one up, but that would take a few days to get working. In the mean time, I updated the saml metadata X509 cert to expire in 50 years. I hope that solves things for the time being!

Thank you so much for that update -- seems to work well for all the existing tests and the new one 👍

bflad

Looks great, thank you so much @jgeurts 🚀

Output from acceptance testing:

--- PASS: TestAccAWSCognitoIdentityPool_samlProviderArns (41.61s)

--- PASS: TestAccAwsEc2ClientVpn_serial (5.60s)
    --- PASS: TestAccAwsEc2ClientVpn_serial/Endpoint_basic (18.01s)
    --- PASS: TestAccAwsEc2ClientVpn_serial/AuthorizationRule_groups (81.88s)
    --- PASS: TestAccAwsEc2ClientVpn_serial/Route_disappears (546.04s)
    --- PASS: TestAccAwsEc2ClientVpn_serial/NetworkAssociation_securityGroups (555.75s)
    --- PASS: TestAccAwsEc2ClientVpn_serial/Route_description (544.37s)
    --- PASS: TestAccAwsEc2ClientVpn_serial/AuthorizationRule_disappears (43.63s)
    --- PASS: TestAccAwsEc2ClientVpn_serial/Route_basic (573.48s)
    --- PASS: TestAccAwsEc2ClientVpn_serial/AuthorizationRule_basic (37.60s)
    --- PASS: TestAccAwsEc2ClientVpn_serial/Endpoint_splitTunnel (28.37s)
    --- PASS: TestAccAwsEc2ClientVpn_serial/Endpoint_withLogGroup (27.13s)
    --- PASS: TestAccAwsEc2ClientVpn_serial/Endpoint_federated (16.50s)
    --- PASS: TestAccAwsEc2ClientVpn_serial/AuthorizationRule_Subnets (102.24s)
    --- PASS: TestAccAwsEc2ClientVpn_serial/Endpoint_tags (39.76s)
    --- PASS: TestAccAwsEc2ClientVpn_serial/NetworkAssociation_disappears (526.89s)
    --- PASS: TestAccAwsEc2ClientVpn_serial/NetworkAssociation_basic (548.73s)
    --- PASS: TestAccAwsEc2ClientVpn_serial/Endpoint_withDNSServers (26.48s)
    --- PASS: TestAccAwsEc2ClientVpn_serial/Endpoint_disappears (14.29s)
    --- PASS: TestAccAwsEc2ClientVpn_serial/Endpoint_mutualAuthAndMsAD (1767.10s)
    --- PASS: TestAccAwsEc2ClientVpn_serial/Endpoint_msAD (1716.55s)

--- PASS: TestAccAWSIAMSamlProvider_basic (41.36s)
--- PASS: TestAccAWSIAMSamlProvider_disappears (15.38s)

--- PASS: TestAccAWSWorkLinkFleet_IdentityProvider (83.09s)

ghost · 2020-09-03T19:29:41Z

This has been released in version 3.5.0 of the Terraform AWS provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template for triage. Thanks!

ghost · 2020-10-01T17:11:11Z

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you feel this issue should be reopened, we encourage creating a new issue linking back to this one for added context. Thanks!

Joe Rayhawk and others added 3 commits June 15, 2020 18:06

aws_ec2_client_vpn_endpoint: add federated auth

e4d74de

While AWS *can* act as an SSO IdP, I don't think there's a public API for enabling it. Automated testing might be troublesome.

Add documentation and test for federated-authentication

56bce56

Merge remote-tracking branch 'origin/master' into f-aws_ec2_client_vp…

2c64d86

…n_endpoint-federated-saml-idp-authentication # Conflicts: # aws/resource_aws_ec2_client_vpn_endpoint_test.go

jgeurts requested a review from a team July 14, 2020 17:46

jgeurts added 4 commits July 14, 2020 14:33

Add missing variable declaration

435ed0d

Fix spacing

9115921

Fix function name

98efe45

Add missing argument to string fn

9367798

jgeurts closed this Jul 15, 2020

jgeurts reopened this Jul 15, 2020

jgeurts mentioned this pull request Jul 17, 2020

aws_ec2_client_vpn_endpoint: add federated auth #13769

Closed

anGie44 force-pushed the master branch from 54db70d to 48ba2f7 Compare July 21, 2020 18:26

jgeurts mentioned this pull request Aug 19, 2020

Client VPN Endpoint - Add Federated Authentication #13401

Closed

DrFaust92 suggested changes Aug 27, 2020

View reviewed changes

aws/resource_aws_ec2_client_vpn_endpoint_test.go Outdated Show resolved Hide resolved

aws/resource_aws_ec2_client_vpn_endpoint_test.go Outdated Show resolved Hide resolved

jgeurts added 3 commits August 27, 2020 10:40

Merge remote-tracking branch 'origin/master' into f-aws_ec2_client_vp…

d244ed6

…n_endpoint-federated-saml-idp-authentication

Update legacy expression syntax

bc210ad

Merge remote-tracking branch 'origin/master' into f-aws_ec2_client_vp…

166a55b

…n_endpoint-federated-saml-idp-authentication # Conflicts: # aws/resource_aws_ec2_client_vpn_endpoint_test.go

DrFaust92 added enhancement Requests to existing resources that expand the functionality or scope. and removed needs-triage Waiting for first response or review from a maintainer. labels Aug 27, 2020

bflad self-assigned this Aug 28, 2020

bflad added this to the v3.5.0 milestone Aug 28, 2020

bflad suggested changes Aug 28, 2020

View reviewed changes

Update 509 certificate to expire in 50 years

b07667c

bflad approved these changes Sep 1, 2020

View reviewed changes

bflad merged commit 387d016 into hashicorp:master Sep 1, 2020

bflad added a commit that referenced this pull request Sep 1, 2020

Update CHANGELOG for #14171

ef22307

ghost locked as resolved and limited conversation to collaborators Oct 1, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

aws_ec2_client_vpn_endpoint: add federated auth #14171

aws_ec2_client_vpn_endpoint: add federated auth #14171

jgeurts commented Jul 14, 2020

divyaraghavann commented Aug 26, 2020

jgeurts commented Aug 27, 2020 •

edited

Loading

DrFaust92 left a comment

jgeurts commented Aug 27, 2020

divyaraghavann commented Aug 27, 2020

bflad left a comment

bflad Aug 28, 2020

jgeurts Aug 29, 2020

bflad Sep 1, 2020

bflad left a comment

ghost commented Sep 3, 2020

ghost commented Oct 1, 2020

aws_ec2_client_vpn_endpoint: add federated auth #14171

aws_ec2_client_vpn_endpoint: add federated auth #14171

Conversation

jgeurts commented Jul 14, 2020

Community Note

divyaraghavann commented Aug 26, 2020

jgeurts commented Aug 27, 2020 • edited Loading

DrFaust92 left a comment

Choose a reason for hiding this comment

jgeurts commented Aug 27, 2020

divyaraghavann commented Aug 27, 2020

bflad left a comment

Choose a reason for hiding this comment

bflad Aug 28, 2020

Choose a reason for hiding this comment

jgeurts Aug 29, 2020

Choose a reason for hiding this comment

bflad Sep 1, 2020

Choose a reason for hiding this comment

bflad left a comment

Choose a reason for hiding this comment

ghost commented Sep 3, 2020

ghost commented Oct 1, 2020

jgeurts commented Aug 27, 2020 •

edited

Loading