-
Notifications
You must be signed in to change notification settings - Fork 137
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
AWS-Terraform implementation documentation unclear #17
Comments
Hi @murty0, thank you for your question. we deploy op-scim bridge using Mac and terraform and our example is not limiting you to running terraform on a Linux instance. Linux is used to execute op-scim bridge binary/service in a form of an AWS instance and terraform helps to manage the deployment. You can install and run terraform code on a variety of platforms including Mac OSX. Once you have terraform installed on your Mac system you can execute terraform code from our AWS-Terraform example and that will help you in deploying op-scim bridge in AWS environment. Could you please let us know which part of our example confused you and we will try to improve it? Please let me know if you have any questions. Thank you very much and happy terraforming.
|
Hi Andrey My issue wasnt with Terraform. We already use Terraform here. My issue was with this part of the documentation (https://github.com/1Password/scim-examples/tree/master/aws-terraform), which is to execute the op-scim bridge binary/service : |
That is correct, we distribute our op-scim bridge as a Debian like package. What system/OS you want to deploy op-scim bridge on? |
I am using a Mac, and will be deploying this in AWS. How can I add this repository manually on a Mac? The above mentioned terminal commands are Linux specific. Is there a way to avoid the manual process altogether? |
you use/run those commands in your AWS instances (Linux) not on your local Mac System. |
those steps are already included in user-data cloud init code in the example: https://github.com/1Password/scim-examples/blob/81f66e808941a9215af3fb27b3f4351c9c8b17ff/aws-terraform/terraform/module_scim_app/data/user_data/02-environment.yml |
Hi Andrey Thanks for clarifying. The documentation isnt clear, and seems to be all over the place. There is no clear step by step guide for setting this up. Is there an update due soon? One of the reps told me its coming soon, possibly next week which would make this entire process simpler? |
@murty0 we are working on improving it. Thank you very much for bringing that topic. We will simplify it.
|
Hi @ag-andrey05 When I run this command on the EC2 instance to get the repo:
I keep getting this error:
I have already added the GPG key for the repo to |
Hi @murty0, That command requires privileged access. We will update documentation to indicate that. |
Hi @ag-andrey05 Thanks for that. I ran the above command, and it worked. But when I wanted to proceed to the next steps, the server can't recognise the 'op-cim' command
|
providing redis cache address and port, and path to the session file. |
@ag-andrey05
|
@murty0 , you need to create op-scim session file first: you can generate the session file and bearer token by running the 1Password SCIM Bridge binary in init mode:
Note: When prompted for user credentials by the init command, use the 1Password credentials for the provision manager user and not an Owner or Administrator user. Init mode will guide the administrator through an interactive process which generates the encrypted session file and bearer token. Although strong encryption is used to secure the session file, prevent unauthorized access to it. Never store the session file in the same place as the bearer token. The bearer token will be required to configure the identity provider (Azure, Okta, etc) to authenticate your connection. |
@ag-andrey05 I already have a scimsession file from before, using the
|
Then you need to specify your redis server/instance address and port. |
ok so this worked:
BUT before running the above, I had to manually do:
|
@murty0, thank you very much for the feedback we'll use it to improve our documentation. |
@ag-andrey05 Hi Andrey I am still facing issues with this. I was able to run the terraform commands successfully, and was presented with a URL. In Okta, when I am putting in this URL + the bearer token for the provisioning account, it keeps saying that the credentials are invalid. So that is my first question, that why is it saying that the credentials are invalid. Another question, why do we need Redis? At what point is Redis (local or in AWS ElasticCache) being used? Do we need Redis even though I am using AWS ALB and was presented with a URL? Lastly, at what point is the SCIM bridge pointing to my 1Password instance ie sandbox-XYZ.1password.com? I have not added this anywhere, as wasn't prompted to do this at any stage, nor in the Terraform variables.tf. Some of the answers might be obvious, but I am having real difficulties getting this to work. |
Hi @murty0, in order to answer your questions i need to clarify few things first.
Redis is used by op-scim application for caching during operation and you need redis either local running on the instance or AWS redis. Redis is unrelated to AWS ALB, they provide different type of functionality. AWS ALB is required to provide SSL termination (transport security) and load balancing, while redis is used for caching. When you initialize/create your scimsession file you provide details of your 1Password account that includes your Let me know if you have questions. Andrey. |
Hi @ag-andrey05
Thanks for the explanation about the endpoint. I have a call in half an hr with one of the engineers from your side. I will walk through the entire set up with them, to be able to hopefully resolve this issue. |
So the issue was that I had created the secret via the UI. This was resolved when I used this CLI command: aws secretsmanager create-secret --name op-scim/scimsession --secret-binary file:///path/to/scimsession --region <aws_region> |
@ag-andrey05 Thanks! |
Hi @murty0, Terraform code deploys the following AWS and op-scim resources:
|
@ag-andrey05 This has been immensely and uncomparably helpful, thank you so much! |
Hi We were going to deploy the SCIM bridge in to production today, but at the last minute we have run in to issues again! The 1Password documentation and/or the scimsession file is incorrect ie step 3 in this link: https://support.1password.com/scim/ After cloning the repo, when I run the script, I get these prompts: - Enter your sign-in address (example.1password.com)
- Enter the Secret Key for yyy@zzz.com on xxxx - Enter the Password for yyy@zzz.com on xxxx
And here is where the issue is. It then says that the provisioning account doesnt have the appropriate permissions. There are two problems here. Firstly, your documentation (linked above) says that: This setup process will: Ask you to sign in to your administrator account This is obviously incorrect, as you can see the prompts I am getting after running the script are for the provisioning account, and not for the admin. Secondly, and this is linked to the first issue above, I remember around the 10th of October when I was starting this setup, this script was working as expected, and I had setup the sandbox scim bridge only after I had the scimsession file from the script. And as part of the script, I as an admin had to explicitly give the new provisioning account the appropriate permissions for provisioning and deprovisioning. This time the script isnt doing that. So something has changed in the last 3 weeks which is breaking the script. This is really unfortunate, as since the last time we spoke I had been busy getting everything working on the AWS side, and today I faced this issue just before we had to deploy. Can you please help me get to a resolution for this ASAP! |
@murty0 Sorry for the issues. The problem you're encountering is because we released v0.7 of the SCIM bridge recently, which includes a new automated setup script that replaces the manual process you went through last time. The If you run Sorry for the trouble, I'm going to change the script to point at the specific image version so that this won't happen in the future. |
Here's a PR that fixes it: #19 |
@agilecohix thanks for getting back to me. It works now! |
Hi @agilecohix and @ag-andrey05 So we have ran in to another problem during our attempt to deploy this. Firstly, its important for you to know that we are using our internal terraform modules to create this infrastructure. We have used the ubuntu AMI as specified in your implementation, but overall here at Intercom we use Amazon Linux AMIs. So the problem is this: the instance is not passing the ELB heath check for some reason. to find out what is wrong we need to SSH to the instance. we can: We are in favour of b), as that way we would use a standard intercom AMI as we do not use Ubuntu for anything else. a) is a hack just to get it up and running. Can you provide us with an rpm package? |
@agilecohix After consulting my team, we have decided we will be changing our approach in this. We will now deploy the SCIM bridge using the docker swarm implementation (https://github.com/1Password/scim-examples/tree/master/docker-swarm), but this will be done within an instance which is using our own AWS Linux AMI (centOS), so that it is pre-baked with all the required settings/certs/configs etc which we require for instances to have when deployed in to production. Once we are certain that the docker swarm SCIM bridge is working, we will then create a new AMI with the SCIM bridge baked into it, and then deploy it in AWS along with an ELB, ASG, Security Groups etc. Can I please arrange a call with who ever is best suited for the docker swarm implementation, so we can go through the entire setup in our test environment. The documentation for this is quite minimal to say the least, and we need to get up and running with this ASAP. |
@agilecohix I tried to push through the docker swarm implementation, but still getting "Incorrect credentials, please verify and try again." in Okta. I am not sure if my implementation is correct, as in the docker-compose.yml file, I changed this line of code: I removed the "--letsencrypt-domain={YOUR-DOMAIN-HERE}" part, as we dont use letsencrypt, and instead use AWS KMS. I added my Route53/ACM TLS certified domain name there instead. Also, I had to take a couple of more steps to even get this far. -the version in the docker-compose.yml file had to be changed from '3.3' to '3.1', otherwise I kept getting 'unsupported Compose file version: 3.3'. I am writing down all the steps incase someone else happens to end up here. The documentation should be verbose, and nothing should be left to the imagination, and zero prior knowledge should be assumed for the endusers, because to figure out each unclear step takes so much time! |
@murty0 Sorry for the trouble you're encountering. If you're using your own certificate, then you should remove the As for your other feedback:
|
Hi
I do have a call arranged with you for the end of the week, but till then
maybe you can clear something else.
I am not using the letsencrypt flag, I mentioned that before. But instead
in the endpoint in the .yml file, how do I pass in my TLS Route53/ACM
(Amazon Certificate Manager) domain name ie XYZ.1password.XYZ.com?
Because if not here, then where do I need to pass in that endpoint? So that
the swarm is pointing to it?
The stack, once up, didnt give out any IPs.
Something is completely amiss here.
Can you please go through the docker swarm readme and fill in the blanks
for me, without leaving anything to assumption. Its very difficult and
close to impossible for me to guess parts of it.
…--
Murtaza Usman
IT Systems Engineer
Intercom
On Wed 7 Nov 2018, 21:10 Connor Hicks, ***@***.***> wrote:
@murty0 <https://github.com/Murty0> Sorry for the trouble you're
encountering.
If you're using your own certificate, then you should remove the
--letsencrypt-domain flag altogether; if TLS is already being terminated,
then you do not want letsencrypt trying to fetch another certificate, it
will not work. Try removing that flag and let me know if that helps.
As for your other feedback:
- The incompatible docker-compose version is likely because the latest
version of Docker compose in the rpm is likely not the latest. Changing it
to 3.1 is just fine as we are not using anything 3.3 specific.
- The documentation does assume that you have a swarm cluster already
set up. I will add a blurb that says this, and links to the documentation.
- Your issue with the logs is not something I've encountered before.
I'll check this out myself.
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
<#17 (comment)>,
or mute the thread
<https://github.com/notifications/unsubscribe-auth/Acevma5JzUYtdytTM3IAES80UDbRElOdks5us0w0gaJpZM4XXsCT>
.
|
@ag-andrey05 @agilecohix thanks for all your help! Closing this off now, with some final notes. The implementation is up and running now. The infrastructure was deployed using Terraform, and the SCIM app was deployed using Docker swarm (docker version 1.13.0) within an AWS Linux (CentOS 6) EC2 instance. Here is the cloud_init user_data template for the autoscaling group to bake the SCIM app in to the server, for anyone who treads here:
|
I want to create and deploy a SCIM bridge between 1Password and Okta.
I would like to use AWS and Terraform for this purpose, but your scim-example for this is Linux specific.
Can you please provide an example of this which would be suitable for creating and deploying a SCIM bridge using Mac.
The text was updated successfully, but these errors were encountered: