Skip to content

Commit 01d76cb

Browse files
committed
Update README
1 parent 1470923 commit 01d76cb

File tree

1 file changed

+8
-4
lines changed

1 file changed

+8
-4
lines changed

README.md

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -17,19 +17,23 @@ Before using this tool, you or the system administrator need to setup the follow
1717

1818
Also depending on the federation method between AWS and the OIDC provider, requirements for the OIDC providers will change.
1919

20-
## For SAML2
20+
### Federation method: SAML2
2121
- Of course, the OIDC provider must support not only OIDC but also SAML2 for federation between itself and AWS.
2222
- The OIDC provider must support [OAuth 2.0 Token Exchange](https://tools.ietf.org/html/draft-ietf-oauth-token-exchange-15) for exchanging OAuth/OIDC token and SAML2 assertion. `aws-cli-oidc` gets access token/ID token from the OIDC provider first, then it needs to get SAML2 assertion from the provider which is required for getting AWS temporary credentials using AWS STS API.
2323

24-
## For OIDC
24+
### Federation method: OIDC
2525
- The OIDC provider only needs to support OIDC. SAML2 and OAuth 2.0 Token Exchange are not necessary. Very simple.
2626
- However, the JWKS endpoint of the OIDC provider needs to export it to the Internet because AWS try to access the endpoint to obtain the public key and to verify the ID token which is issued by the provider.
2727

2828

2929
## Tested OIDC Provider
3030

31-
Currently I tested this tool using [Keycloak](https://keycloak.org) as the OIDC provider.
32-
Note: You can't use SAML2 without extension which supports exchanging from access token to SAML2 assertion because Keycloak supports [OAuth 2.0 Token Exchange](https://tools.ietf.org/html/draft-ietf-oauth-token-exchange-15) partially and doesn't support SAML2 assertion yet.
31+
| OIDC Provider | OIDC | SAML2 |
32+
| ---- | ---- | ---- |
33+
| [Google account](https://accounts.google.com/.well-known/openid-configuration) | OK | - |
34+
| [Keycloak](https://www.keycloak.org) | OK | OK (Note 1) |
35+
36+
* Note 1: You can't use SAML2 without extension which supports exchanging from access token to SAML2 assertion because Keycloak supports [OAuth 2.0 Token Exchange](https://tools.ietf.org/html/draft-ietf-oauth-token-exchange-15) partially and doesn't support SAML2 assertion yet.
3337

3438

3539
## Usage

0 commit comments

Comments
 (0)