Skip to content

Commit 18a4d1e

Browse files
dkocherdkocher
committed
Add tutorial for Google as IdP.
1 parent 660a806 commit 18a4d1e

File tree

2 files changed

+124
-0
lines changed

2 files changed

+124
-0
lines changed

‎tutorials/index.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ Tutorials
77
hidden_properties
88
custom_oauth_client_id
99
s3_microsoft_entra_oidc
10+
s3_google_oidc
1011
iam
1112
vault_localdisk
1213
sftp_publickeyauth
@@ -27,6 +28,9 @@ Configure hidden preferences.
2728
## [Authenticate with Microsoft Entra ID to connect to S3](s3_microsoft_entra_oidc.md)
2829
Use Microsoft Entra ID to authenticate with S3 by configuring as an OpenID Connect (OIDC) Identity Provider in AWS IAM.
2930

31+
## [Authenticate with Google to connect to S3](s3_google_oidc.md)
32+
Use Google to authenticate with S3 by configuring as an OpenID Connect (OIDC) Identity Provider in AWS IAM.
33+
3034
## [AWS Identity & Access Management (IAM)](iam.md)
3135
IAM allows you to create credentials for third parties accessing your S3 account with permission constraints.
3236

‎tutorials/s3_google_oidc.md‎

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
Connect to S3 authenticating with Google
2+
====
3+
4+
> Use Google to authenticate with S3 by configuring as an OpenID Connect (OIDC) Identity Provider in AWS IAM.
5+
6+
7+
:::{tip}
8+
Refer to [Custom connection profile using OpenID Connect provider and AssumeRoleWithWebIdentity STS API](../protocols/profiles/aws_oidc.md) for custom configuration of connection profiles using OIDC web identity federation to connect to AWS S3.
9+
:::
10+
11+
:::{important}
12+
* Cyberduck [9.3.0](https://cyberduck.io/changelog/) or later required
13+
* Mountain Duck [5.1.0](https://mountainduck.io/changelog/) or later required
14+
:::
15+
16+
## Configuration in Google Cloud Console
17+
18+
Create an OAuth application in the [Google Cloud Console](https://console.cloud.google.com/) and configure it as an OIDC Identity Provider.
19+
20+
:::{admonition} Setup a Custom OAuth Client ID Tutorial
21+
:class: tip
22+
23+
Follow the [step-by-step instructions](custom_oauth_client_id.md) to Setup a Custom OAuth Client ID for Google.
24+
:::
25+
26+
27+
1. Navigate to _APIs & Services → Credentials_ in the [Google Cloud Console](https://console.cloud.google.com/apis/credentials) and choose _Create Credentials → OAuth client ID_.
28+
2. Select _Web application_ as the application type.
29+
3. Enter `io.cyberduck` for the _Bundle ID_
30+
4. Copy the OAuth Client ID from the credentials screen.
31+
32+
33+
## Configuration in AWS IAM
34+
35+
### Create an OIDC identity provider
36+
37+
:::{tip}
38+
Google is already built-in to AWS as a trusted OIDC identity provider. Instead of using a ARN you can reference the built-in Google IdP in a role with `accounts.google.com`.
39+
:::
40+
41+
### Create a role
42+
43+
Assign a role to the identity provider created in the previous step with permissions to access S3.
44+
45+
1. In AWS [IAM console](https://console.aws.amazon.com/iam/), choose _Create Role_ in _Roles_.
46+
2. Select _Web identity_ as the trusted entity type.
47+
3. Select _Google_ as the _Identity Provider_.
48+
4. Enter the OAuth Client ID from the application registration in Google Cloud Console for _Audience_.
49+
5. The resulting trust policy will look similar to the following:
50+
51+
```json
52+
{
53+
"Version": "2012-10-17",
54+
"Statement": [
55+
{
56+
"Effect": "Allow",
57+
"Principal": {
58+
"Federated": "accounts.google.com"
59+
},
60+
"Action": "sts:AssumeRoleWithWebIdentity",
61+
"Condition": {
62+
"StringEquals": {
63+
"accounts.google.com:aud": "<OAuth Client ID>.apps.googleusercontent.com"
64+
}
65+
}
66+
}
67+
]
68+
}
69+
```
70+
71+
6. In the next step attach a permission policy to the role such as the managed policy `AmazonS3FullAccess`.
72+
7. Copy the Role ARN from the _Summary_ tab.
73+
74+
75+
### Create a bookmark in Cyberduck or Mountain Duck
76+
77+
1. Open _Preferences… → Profiles_ in Cyberduck or Mountain Duck.
78+
2. Enable the *AWS S3 (Google OpenID Connect)* connection profile.
79+
3. Add a new [Bookmark](../cyberduck/bookmarks.md) in Cyberduck or Mountain Duck and choose *AWS S3 (Google)* in the protocol dropdown.
80+
4. Enter the OAuth Client ID from the application registration in Google Cloud Console for _OAuth Client ID_ when prompted. It will be saved in the bookmark as a [custom property](hidden_properties.md#in-duck-bookmark-files).
81+
82+
:::{image} _images/S3_Client_Id_Prompt.png
83+
:alt: OAuth Client ID Prompt
84+
:width: 400px
85+
:::
86+
87+
:::{tip}
88+
The _OAuth Client ID_ is the same as the _OAuth Client ID_ from the application registration in Google Cloud Console with the `.apps.googleusercontent.com` suffix.
89+
:::
90+
91+
:::{note}
92+
Alternatively set `OAuth Client ID` in a [custom connection profile](../protocols/profiles/aws_oidc.md).
93+
:::
94+
95+
5. Enter the Role ARN from the previous step when prompted. It will be saved in the bookmark as a [custom property](hidden_properties.md#in-duck-bookmark-files).
96+
97+
:::{note}
98+
Alternatively set `role_arn` as a custom property in a [custom connection profile](../protocols/profiles/aws_oidc.md).
99+
:::
100+
101+
:::{image} _images/S3_Role_ARN_Prompt.png
102+
:alt: MFA Prompt
103+
:width: 400px
104+
:::
105+
106+
:::{admonition} Troubleshooting
107+
:class: attention
108+
### `Not authorized to perform sts:AssumeRoleWithWebIdentity`
109+
Validate the _Trusted entities_ in _Trust relationships_ in the IAM console.
110+
111+
### `Request ARN is invalid`
112+
The role ARN entered is not valid.
113+
114+
### `The security token included in the request is invalid`
115+
Invalid client token ID. Check the OAuth Client ID in the connection profile.
116+
:::
117+
118+
## References
119+
- [AWS Identity and Access Management → OIDC federation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_oidc.html)
120+
- [Google Identity Platform → OpenID Connect](https://developers.google.com/identity/openid-connect/openid-connect)

0 commit comments

Comments
 (0)