Why does AWS VPN client SAML uses HTTP for ACS

Posted by enigmaunbound@reddit | sysadmin | View on Reddit | 5 comments

I'm working on setting up an AWS client vpn to use EntraID as the SAML IDP. There is an odd set of steps in both the AWS and Microsoft implementation guides. They require configuring the Assertion Consumer Service (ACS) to use HTTP for the local host. I'm trying to work this out and any security ramifications. Typically you do not want the ACS communication clear text because that can let somone else interrupt or intercept the authentication materials inlucding the access token. With the ACS being set to a local host value I am very confused. The ACS is typically hosted at the SP service. Can anyone explain why the ACS is setup the way it is? What are the practical security issue with this config? My best guess is that the AWS VPN client gets the SAML response from the IDP then proxies the ACS through the tunnel. But I'm guessing at that. Resources; [https://aws.amazon.com/blogs/apn/how-to-integrate-aws-client-vpn-with-azure-active-directory/](https://aws.amazon.com/blogs/apn/how-to-integrate-aws-client-vpn-with-azure-active-directory/) [https://learn.microsoft.com/en-us/entra/identity/saas-apps/aws-clientvpn-tutorial](https://learn.microsoft.com/en-us/entra/identity/saas-apps/aws-clientvpn-tutorial) 

Reply to Post

5 Comments

[-]

enigmaunbound@reddit (OP)

So I think I'm working out my issue. According to the AWS client vpn federated identity the SAML request is embedded in the URL making the ACS not relevant. [https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/federated-authentication.html](https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/federated-authentication.html) \- AWS Client VPN sends an AuthN request to the IdP via an HTTP Redirect binding. Therefore, the IdP should support HTTP Redirect binding and it should be present in the IdP's metadata document. This discussion seems to line up to the situation. [https://stackoverflow.com/questions/30388926/http-redirect-binding-saml-request](https://stackoverflow.com/questions/30388926/http-redirect-binding-saml-request) Does this make sense to anyone with more SAML chops than me?

[-]

wezelboy@reddit

Without delving into the docs, they could be encrypting the saml assertion itself. You can see if this is the case with SAML Tracer.

[-]

enigmaunbound@reddit (OP)

Not sure the tracer will work. The Amazon VPN client is performing the auth. I will see if a wire capture can prove out the assertion is encrypted. It's still quite odd.

[-]

wezelboy@reddit

Ahh. Yeah, you might be able to get that through a pcap, but I think they are encoded so it won't be obvious.

[-]

enigmaunbound@reddit (OP)

Something else that may be relevant to this issue. AWS VPN is a rebranded OpenVPN client.