Setting up a custom idp for AWS SFTP using Active Directory

Question

I've been digging into setting up custom auth for AWS SFTP and it's one hell of a black hole. There's lot's of references to being able to use a custom idp, but no concrete examples.

We're using Active Directory and currently have AWS SSO setup so federating with SAML seems possible, in theory. For my test instance, I have a Microsoft AD set up in Directory Services with SSO enabled.

Amazon's example provides a cloud formation template that is largely based on a lambda function. The lambda function is very simple and validates a password hardcoded into the lambda against Amazon Secrets. Obviously, that isn't practical.

Has anyone done this? How were you able to get it working?

I guess an alternate question would be has anyone used a lambda to authenticate against AD?

Here are some resources I've looked at. Only the one on Cognito User Pools provides a detailed walk through of any sort of alternate set up. We may be able to use Cognito Identity Pools, but user pools are not something that will work in our use case.

AWS Docs on Custom Auth for SFTP

Integrate SFTP with Cognito User Pools

detailed walkthrough of basic sftp set up

more information on custom idp

Answer 1

You can use a similar approach as the blog post with the custom identity provider, but replace AWS Cognito API calls with Active Directory bind.

Here is a related code fragment:

exports.authorize = async function(event) {
  return new Promise((resolve, reject) => {
    const username = event.pathParameters.user;
    const password = event.headers.Password;

    console.log(`Performing authentication for user ${username}`);

    client.bind(`${username}@${process.env.LDAP_DIRECTORY_NAME}`, password, err => {
      if (err) {
        reject(err);
      } else {
        const response = {
          headers: {
            "Access-Control-Allow-Origin": "*",
            "Content-Type": "application/json"
          },
          body: getSftpPolicy(username),
          statusCode: 200
        };
        resolve(response);
      }
    });
  });
};

You can find more information in this blog post. Please also feel free to use this GitHub repository with the project template.