Migrating Fine-grained Per-account RBAC from AWS Directory Service about aws-iam-identity-center-extensions HOT 4 CLOSED

Thanks Leela; in collaboration with my company and customer, we have produced a custom proprietary solution to this problem. We found a workaround to the Directory Service API limitation, and our solution leverages both the SSO SCIM API and SSO Extensions' S3 bucket interface for permission sets and links data.

from aws-iam-identity-center-extensions.

I still haven't found any way to programmatically access the role/user mappings in Delegate console access other than web-based screen scraping (which sadly may end up being the route we take, because our timeline for SSO rollout is very aggressive). It seems like a glaring oversight in the AWS Directory Service API that no API exists to at least read this list.

Since there is no API to do this, and screen scraping would not be a suitable solution for a robust tool like SSO Extensions, I'm guessing this will have to go into blocked state until, someday, AWS introduces an API for Delegate console access.

Unfortunately, manually turning the crank is not an option for me, so I will be writing an in-house Microsoft Playwright script for this task.

from aws-iam-identity-center-extensions.

@allquixotic as discussed 2 months ago (yep, sorry about the delayed update) - we are providing automated provisioning for identity sources that do not have SCIM support through #42 . In favour of that issue, I'm closing the current one, as the team cannot do anything from a directory service API limiation point of view. Please do let us know if you would like us to tackle anything else regarding the current issue, and we will raise a new issue for that.

Thank you.

from aws-iam-identity-center-extensions.

That's some crafty workaround @allquixotic , glad you have it working now. Just to call this out again, we intend to provide both a generic SCIM converter i.e. middleware that would convert end point specific calls to SSO's SCIM API calls as well as prebuilt connectors as part of #42 . For the first iteration, we intend to provide the middleware and managed AD connector, with Google cloud as the second connector in our pipeline. While this would not be helping you with discovering stuff you have in directory service currently i.e. the limitation, it would however help you manage sync the changes from managed directory to SSO through SCIM. Given your indepth expertise on this topic, we would appreciate any feedback you could provide us on #42 when this feature is released.

Thank you once again,
Leela

from aws-iam-identity-center-extensions.