Dell ObjectScale 1.3 Administration Guide

AssumeRoleWithSAML

In order to use AssumeRoleWithSAML, you must configure your SAML identity provider (IdP) like ADFS to issue the claims required by ObjectScale.

• IAM role must be created that specifies this SAML Provider in the trust policy.
• In order to use AssumeRoleWithSAML from each ObjectScale instance, you must first setup Relying Party Trust with that ObjectScale service provider metadata and get the SAML Token from that specific relying party trust.
• AssumeRoleWithSAML returns a set of temporary security credentials for users who have been authenticated through a SAML authentication response.
• This operation provides a mechanism for tying an enterprise identity store or directory to role-based access without user-specific credentials or configuration.
• Calling AssumeRoleWithSAML does not require the use of ObjectScale security credentials. The identity of the caller is validated by the claims that are provided in the SAML Assertions by the identity provider.
• Temporary credentials consist of an access key ID, a secret access key, and a security token.
• Following condition keys are supported in the AssumeRolePolicyDocument.
  • saml:aud
  • saml:iss
  • saml:sub
  • saml:sub_type
  • saml:edupersonorgdn
  • saml:namequalifier

{
   "Version":"2012-10-17",
   "Statement":[
      {
         "Effect":"Allow",
         "Principal":{
            "Federated":"urn:aws:iam::s3:saml-provider/provider1"
         },
         "Action":"sts:AssumeRoleWithSAML",
         "Condition":{
            "StringEquals":{
               "SAML:sub":"ADFS\\Bob",
               "SAML:aud":"https://10.247.179.105/saml",
               "SAML:eduPersonOrgDN":[
                  "ObjectScale"
               ],
               "SAML:iss":"http://AD.adfs.emc.com/adfs/services/trust"
            }
         }
      }
   ]
}