Questions[okta](server)

We have AWS accounts for dev, staging, and prod. We use AWS SSO via Okta, and define groups like "Developers" and "Support" in Okta.

Developer group should have broad access to our AWS dev account, but limited access in staging and prod. Support group should have AWS access as well, but also different permissions by account.

How can I allow group members to log in, then have suitable permissions depending on which account they access?

Details:

AWS SSO Permission Sets are linked to the AWS Start Page. This lists accounts a user has any access to, and displays one or more permission sets they can use. Permission Sets seem to be oriented around granting users the ability to log into several accounts with the same access -- admins might all have AWSAdministratorAccess and others might have ReadOnlyAccess, for example.

My use-case is different, though: I want to create different accesses depending on which account a given user logs into.

I think it's possible to do this with permission sets - e.g. developer-dev, developer-staging, developer-prod. But it seems messy to me. Also in reality we'll have a number of groups (developers team A, B, C) all of whom need different access, so there's kind of an explosion of permission sets and accounts.

I would like a developer to log in as "Developer" and depending on which account they log into gain the right permissions. I can do most of this using standard IAM Roles. The "developer" role in production might be ReadOnlyAccess, where in Staging it might have some additional permissions, and in dev might have PowerUserAccess. We manage these sorts of things using Terraform already.

I like the SSO multi-account login page. I also like the being able to switch roles (and accounts) from the AWS Console. Is there a simple approach I am misunderstanding that will let me do both?

I am trying to enable auth mellon for on-prem weblogic app.

I have apache httpd and auth mellon installed on RHEL 6.8. I followed instructions as per https://github.com/Uninett/mod_auth_mellon/wiki/GenericSetup

My IDP is Okta.

Mellon.conf looks like this

    NameVirtualHost *:7799
    <VirtualHost *:7799>
    ServerName webapp.mycompany.com
    ProxyPass /mellon/ !
    <Location />
    MellonEnable info
    Require all granted
    MellonEndpointPath /mellon
    MellonSPMetadataFile /etc/httpd/mellon/mellon_metadata.xml
    MellonSPPrivateKeyFile /etc/httpd/mellon/mellon_metadata.key
    MellonSPCertFile /etc/httpd/mellon/mellon_metadata.cert
    MellonIdPMetadataFile /etc/httpd/mellon/idp_metadata.xml 
    </Location>

    <Location /wlsapp>
    AuthType Mellon
    MellonEnable auth
    Require valid-user
    ProxyPass http://12.13.14.15:7001/wlsapp/
    ProxyPassReverse http://12.13.14.15:7001/wlsapp/
    </Location>
    </VirtualHost>

When I try to access webapp.mycompany.com/wlsapp I get "404 Not Found" The requested URL /mellon/login was not found on this server. URL on browser is https://webapp.mycompany.com/mellon/login?ReturnTo=http%3A%2F%webapp%2D.mycompany.com%2Fwlsapp&IdP=http%3A%2F%2Fwww.okta.com%2Fexkyqo99f4cxyzUp2h7

Any suggestions? I dont understand why I am getting 404.

I'm trying to set up AAD with Okta, and find that when users visit the App Embed link and it posts their SAML response to https://login.microsoftonline.com/login.srf, they get an unhelpful error:

AADSTS50107: Requested federation realm object 'http://okta.com/..............' does not exist

I already set up an external identity provider. How do I get it to recognize my domain?