This project has been archived!

See#104for details about the status of this project.

---

Google Apps (G Suite),Microsoft Azure AD,GitHub,OKTA,Auth0,Centrifyauthentication forCloudFrontusingLambda@Edge.The original use case forcloudfront-authwas to serve private S3 content over HTTPS without running a proxy server in EC2 to authenticate requests; butcloudfront-authcan be used authenticate requests of any Cloudfront origin configuration.

Description

Upon successful authentication, a cookie (namedTOKEN) with the value of a signed JWT is set and the user redirected back to the originally requested path. Upon each request, Lambda@Edge checks the JWT for validity (signature, expiration date, audience and matching hosted domain) and will redirect the user to configured provider's login when their session has timed out.

Usage

If your CloudFront distribution is pointed at a S3 bucket,configure origin access identityso S3 objects can be stored with private permissions. (Origin access identity requires the S3 ACL owner be the account owner. Use ours3-object-owner-monitorLambda function if writing objects across multiple accounts.)

Enable SSL/HTTPS on your CloudFront distribution; AWS Certificate Manager can be used to provision a no-cost certificate.

Session duration is defined as the number of hours that the JWT is valid for. After session expiration, cloudfront-auth will redirect the user to the configured provider to re-authenticate. RSA keys are used to sign and validate the JWT. If the filesid_rsaandid_rsa.pubdo not exist they will be automatically generated by the build. To disable all issued JWTs upload a new ZIP using the Lambda Console after deleting theid_rsaandid_rsa.pubfiles (a new key will be automatically generated).

Identity Provider Guides

Github

1. Clone or download this repo
2. Navigate to your organization'sprofile page,then choose OAuth Apps under Developer settings.
   1. SelectNew OAuth App
   2. ForAuthorization callback URLenter your Cloudfront hostname with your preferred path value for the authorization callback. Example:https://my-cloudfront-site.example /_callback
3. Execute./build.shin the downloaded directory. NPM will run to download dependencies and a RSA key will be generated.
   1. ChooseGithubas the authorization method and enter the values for Client ID, Client Secret, Redirect URI, Session Duration and Organization
      • cloudfront-auth will check that users are a member of the entered Organization.
4. Upload the resultingzipfile found in your distribution folder using the AWS Lambda console and jump to theconfiguration step

Google

1. Clone or download this repo
2. Go to theCredentialstab of yourGoogle developers console
   1. Create a new Project
   2. Create anOAuth Client IDfrom theCreate credentialsmenu
   3. SelectWeb applicationfor the Application type
   4. UnderAuthorized redirect URIs,enter your Cloudfront hostname with your preferred path value for the authorization callback. Example:https://my-cloudfront-site.example /_callback
3. Execute./build.shin the downloaded directory. NPM will run to download dependencies and a RSA key will be generated.
4. ChooseGoogleas the authorization method and enter the values for Client ID, Client Secret, Redirect URI, Hosted Domain and Session Duration
5. Select the preferred authentication method
   1. Hosted Domain (verify email's domain matches that of the given hosted domain)
   2. JSON Email Lookup
      1. Enter your JSON Email Lookup URL (example below) that consists of a single JSON array of emails to search through
   3. Google Groups Lookup
      1. Use Google Groups to authorize users
6. Upload the resultingzipfile found in your distribution folder using the AWS Lambda console and jump to theconfiguration step

Microsoft Azure

1. Clone or download this repo
2. In your Azure portal, go to Azure Active Directory and selectApp registrations
   1. Create a new application registration with an application type ofWeb app / api
   2. Once created, go to your applicationSettings -> Keysand make a new key with your desired duration. Click save and copy the value. This will be yourclient_secret
   3. Above where you selectedKeys,go toReply URLsand enter your Cloudfront hostname with your preferred path value for the authorization callback. Example:https://my-cloudfront-site.example /_callback
3. Execute./build.shin the downloaded directory. NPM will run to download dependencies and a RSA key will be generated.
4. ChooseMicrosoftas the authorization method and enter the values forTenant,Client ID (Application ID), Client Secret (previously created key), Redirect URI and Session Duration
5. Select the preferred authentication method
   1. Azure AD Membership (default)
   2. JSON Username Lookup
      1. Enter your JSON Username Lookup URL (example below) that consists of a single JSON array of usernames to search through
6. Upload the resultingzipfile found in your distribution folder using the AWS Lambda console and jump to theconfiguration step

OKTA

1. Clone or download this repo
2. Sign in to OKTA with your administrator account and navigate to theApplicationstab.
3. Add Application
   1. Select theWebapplication type
   2. Base URI: CloudFront distribution domain name (https://{cf-endpoint}.cloudfront.net)
   3. Login Redirect URI: CloudFront distribution domain name with callback path (https://{cf-endpoint}.cloudfront.net/_callback)
   4. Group Assignments: Optional
   5. Grant Type Allowed: Authorization Code
   6. Done
4. Gather the following information for Lambda configuration
   1. Client Id and Client Secret from the application created in our previous step (can be found at the bottom of the general tab)
   2. Base Url
      1. This is named the 'Org URL' and can be found in the top right of the Dashboard tab.
5. Execute./build.shin the downloaded directory. NPM will run to download dependencies and a RSA key will be generated.
6. ChooseOKTAas the authorization method and enter the values for Base URL (Org URL), Client ID, Client Secret, Redirect URI, and Session Duration
7. Upload the resultingzipfile found in your distribution folder using the AWS Lambda console and jump to theconfiguration step

Auth0

1. Clone or download this repo
2. Go to theDashboardof your Auth0 admin page
   1. ClickNew Application
   2. SelectRegular Web Appand clickCreate.
   3. Now select an application type and follow the steps for 'Quick Start' or use your own app.
   4. Go to applicationSettingsand enter required details. InAllowed Callback URLsenter your Cloudfront hostname with your preferred path value for the authorization callback. Example:https://my-cloudfront-site.example /_callback
3. Execute./build.shin the downloaded directory. NPM will run to download dependencies and a RSA key will be generated.
4. ChooseAUTH0as the authorization method and enter the values for Base URL (Auth0 Domain), Client ID, Client Secret, Redirect URI, and Session Duration
5. Upload the resultingzipfile found in your distribution folder using the AWS Lambda console and jump to theconfiguration step

Centrify

1. Clone or download this repo
2. Go to theDashboardof your Centrify admin page
   1. ClickWeb Appsfrom the LHS.
   2. ClickAdd Web Appand select theCustom Tab.
   3. Add anOpenID Connectwebapp and clickYesto confirm.
3. Fill in naming and logo information and then switch to theTrusttab.
4. Enter service provider information. InAuthorized Redirect URIsenter your Cloudfront hostname with your preferred path value for the authorization callback. Example:https://my-cloudfront-site.example /_callback
5. Execute./build.shin the downloaded directory. NPM will run to download dependencies and a RSA key will be generated.
6. ChooseCENTRIFYas the authorization method and enter the values for Base URL (Centrify Resource application URL), Client ID, Client Secret, Redirect URI, and Session Duration (which is available from theTokenstab).
7. Upload the resultingzipfile found in your distribution folder using the AWS Lambda console and jump to theconfiguration step

OKTA Native

1. Clone or download this repo
2. Sign in to OKTA with your administrator account and navigate to theApplicationstab.
3. Add Application
   1. Select theNativeapplication type
   2. Base URI: CloudFront distribution domain name (https://{cf-endpoint}.cloudfront.net)
   3. Login Redirect URI: CloudFront distribution domain name with callback path (https://{cf-endpoint}.cloudfront.net/_callback)
   4. Group Assignments: Optional
   5. Grant Type Allowed: Authorization Code
   6. Done
4. Gather the following information for Lambda configuration
   1. Client Id from the application created in our previous step (can be found at the bottom of the general tab)
   2. Base Url
      1. This is named the 'Org URL' and can be found in the top right of the Dashboard tab.
5. Execute./build.shin the downloaded directory. NPM will run to download dependencies and a RSA key will be generated.
6. ChooseOKTA Nativeas the authorization method and enter the values for Base URL (Org URL), Client ID, PKCE Code Verifier Length, Redirect URI, and Session Duration
7. Upload the resultingzipfile found in your distribution folder using the AWS Lambda console and jump to theconfiguration step

Configure Lambda and CloudFront

Manual DeploymentorAWS SAM Deployment

Authorization Method Examples

• Use Google Groups to authorize users

• JSON array of email addresses

  [ "foo@gmail", "bar@gmail" ]
  

Testing

Detailed instructions on testing your function can be foundin the Wiki.

Build Requirements

• npm^5.6.0
• node^10.0
• openssl

Contributing

All contributions are welcome. Please create an issue in order open up communication with the community.

When implementing a new flow or using an already implemented flow, be sure to follow the same style used inbuild.js.The config.json file should have an object for each request made. For example,openid.index.jsconverts config.AUTH_REQUEST and config.TOKEN_REQUEST to querystrings for simplified requests (after adding dynamic variables such as state or nonce). For implementations that are not generic (most), endpoints are hardcoded in to the config (or discovery documents).

Be considerate of ourlimitations.The zipped function can be no more than 1MB in size and execution cannot take longer than 5 seconds, so we must pay close attention to the size of our dependencies and complexity of operations.