Write a script to automate the authentication and get the security token from AWS.

  • The following template is an example script written in .java, exported as a runnable .jar file, and executed in a terminal window.
    Note:

    You can write your automation script in any language.

    package com.pingidentity.sts;
                    import com.amazonaws.auth.AnonymousAWSCredentials;
                    import com.amazonaws.services.securitytoken.AWSSecurityTokenServiceClient;
                    import com.amazonaws.services.securitytoken.model.AssumeRoleWithSAMLRequest;
                    import com.amazonaws.services.securitytoken.model.AssumeRoleWithSAMLResult;
                    import com.pingidentity.sts.clientapi.STSClient;
                    import com.pingidentity.sts.clientapi.STSClientConfiguration;
                    import com.pingidentity.sts.clientapi.model.RequestSecurityTokenData;
                    import com.pingidentity.sts.clientapi.model.STSResponse;
                    import com.pingidentity.sts.clientapi.tokens.wsse.UsernameToken;
                    import java.util.Scanner;
                    public class AssumeRoleWithSAMLSample {
                    private static final String PING_STS = "
                    ";
                    https://<pingfedserver>:9031/idp/sts.wst
                    private static final String PRINCIPAL_ARN = "arn:aws:iam::736827903656:saml-provider/PingFed";
                    private static final String ROLE_ARN = "arn:aws:iam::736827903656:role/Administrators";
                    public static void main(String[] args) throws Exception {
                    AssumeRoleWithSAMLSample sample = new AssumeRoleWithSAMLSample();
                    sample.getTemporaryCredential(sample.getSAMLAssertion());
                    }
                    protected String getTemporaryCredential (String assertion) {
                    AWSSecurityTokenServiceClient client = new AWSSecurityTokenServiceClient(new AnonymousAWSCredentials());
                    AssumeRoleWithSAMLRequest assumeRoleRequest = new AssumeRoleWithSAMLRequest();
                    assumeRoleRequest.setPrincipalArn(PRINCIPAL_ARN);
                    assumeRoleRequest.setRoleArn(ROLE_ARN);
                    assumeRoleRequest.setSAMLAssertion(assertion);
                    AssumeRoleWithSAMLResult result = client.assumeRoleWithSAML(assumeRoleRequest);
                    System.out.println(result.toString());
                    return result.toString();
                    }
                    protected String getSAMLAssertion () throws Exception {
                    Scanner user_input = new Scanner( System.in );
                    String username;
                    String password;
                    System.out.print("Enter your AD UserID: ");
                    username = user_input.next();
                    System.out.print("Enter your AD Password: ");
                    password = user_input.next();
                    System.out.println("Getting assertion from PingFederate . . .");
                    STSClientConfiguration stsClientConfiguration = new STSClientConfiguration();
                    stsClientConfiguration.setStsEndpoint(PING_STS);
                    stsClientConfiguration.setIgnoreSSLTrustErrors(true);
                    STSClient client = new STSClient(stsClientConfiguration);
                    RequestSecurityTokenData requestData = new RequestSecurityTokenData();
                    requestData.setRequestType("
                    ");
                    http://docs.oasis-open.org/ws-sx/ws-trust/200512/Issue
                    requestData.setTokenType("urn:oasis:names:tc:SAML:2.0:profiles:SSO:browser");
                    requestData.setAppliesTo("
                    ");
                    https://signin.aws.amazon.com/saml
                    org.w3c.dom.Element token = null;
                    UsernameToken usernameToken = new UsernameToken();
                    usernameToken.setUsername(username);
                    usernameToken.setPassword(password);
                    token = usernameToken.getRoot();
                    STSResponse respData;
                    respData = client.makeRequest(requestData, token, null, null);
                    String result = respData.getRstr().getToken().getFirstChild().getTextContent();
                    System.out.println("Returninig " + result);
                    return result;
                    }
                    }