cnuss

It's not publicly accessible, per-se..., there's a reverse proxy I've written

1. There's a Function URL that then creates a Lambda HTTP Event

2. There's a reverse proxy in the container that converts the Lambda HTTP Event back into a HTTP Request

3. Then the HTTP Respose is transformed back into a Lambda HTTP Event Response

@billconan if you'd like, join my Discord and I'd be happy dive into details and/or provide more docs: https://scaffoldly.dev/community

Yup! Change the `handler` and `start` command:

``` handler = "localhost:5000" ... start = "poetry run flask --app flask_poetry run -p 12345" ```

thanks don! here's the GH discussion on this topic: https://github.com/scaffoldly/scaffoldly/discussions/17

thanks for the question!

this completely eliminates the need to juggle ~/.aws/* files, or downloading or generation of one or more web identity token files, or complicated trust to a single root account

using a single GitHub token identifying the user, the saml.to backend exchanges that token for the desired account and credentials simply based on providing the desired role name as input

zero knowledge on how to authenticate the aws cli is necessary, which I've found as a high friction point for administrators and developers to get right

let me know if you have any more questions or feedback!

The GitHub token that is used is a short-lived token that is generated new every time a GitHub action is run.

Ref: https://docs.github.com/en/actions/security-guides/automatic...

And the SAML.to backend first checks to make sure the token is valid by invoking:

Ref: https://docs.github.com/en/rest/reference/apps#list-reposito...

I haven't checked, but I assume GitHub invalidates the token when the GitHub Action finishes

hey hatware!

is that a question/comment for me?

Thanks mdaniel for your observations!

I updated package.json!

On the note of the API endpoint. Yes that's correct, I've fashioned a backend API which handles converting of GitHub Repo Tokens to SAML Assertions: https://sso.saml.to/github/swagger.html#/IDP/AssumeRoleForRe...

And providing a static endpoint for SAML Metadata: https://saml.to/metadata

That being said, you're making my brain click a little bit and this could be converted into a "self contained" toy, with some additional work! The biggest piece of the puzzle is a consistent private key and certificate.

If that is of interest to you, could you create a GitHub Issue as a feature request?

Thanks!

Thanks for the feedback SahAssar, sorry if the title caused any latent anxiety!

I'll heed your advice for the next time I post something on HN, thank you!

They're both Identity Protocols, SAML is older and more widely adopted, OIDC is newer. Kinda the XML vs JSON battle at a Protocol level haha!

I've found a lot of SaaS providers only support SAML today, so you're stuck if you want to use GitHub identity outside of OIDC.

This is awesome! thank you!

Hey zomglings!

I'll echo what I just responded to nodesocket with, but I'd also love your feedback on my comment:

https://news.ycombinator.com/item?id=29986209

Totally agree re: complexity. My goal is that a few config steps in a GitHub repository and AWS makes a GitHub action able to do a wide variety of things (such as accessing multiple accounts) with very little upstart work.

Storing Secrets in GitHub isn't technically insecure, and it's awesome it's provided as a free feature, but it's tedious and fragile. Someone (or something has to do various clicks and copy/pastes or API calls) to upload an access key into GitHub Secrets. It gets even worse if you have multiple accounts and then your Action Workflow file gets really gnarly if you simply pull credentials from ${{ secrets.* }}.

Also, if you need to rotate your AWS access tokens, you open up a whole new can of worms, so why not remove credentials all together!

Thanks for the question nodesocket, let me know if you have more questions or comments!

Hey orf!

You are correct this GitHub action is at its core is very similar! Even though the initial instructions don't prescribe it, the biggest differentiator is that SAML.to supports a centralized permissions configuration across all repositories for a user, project or organization:

https://github.com/saml-to/assume-aws-role-action/blob/main/...

Also, this action is the tip of the iceberg of what SAML.to aims to provide (check out https://saml.to), for example:

- Store Role Assumption and Privileges as Code (the saml-to.yml config file) - A command line interface to login and assume roles - Free (or affordable) for small teams or individuals - Additional Automations, Webhooks, SCIM, etc

Let me know if you have any comments on this and thanks for the question!

Hey brianr! thanks for the question

Let's actually use Rollbar as a use case since your HN profile says you're the co-founder, and Rollbar supports SAML !

Use case:

There's a set of developers on a project in GitHub, that also need to log into Rollbar. Rollbar would be added as a provider in the SAML.to Configuration File (hosted in GitHub). Developers that need to access Rollbar would also be listed in the configuration file with who should be allowed to Login to Rollbar.

Here's a sample of the config file: https://gist.github.com/cnuss/4966f227afdd6a134e74ad579c9c7c...

When "cnuss" or "brianr" needs to access Rollbar, they would run the command in their console

`npx saml-to login rollbar`

This command would obtain their GitHub identity, and open a browser window directly into Rollbar. "tonystark" would not be able to do this, since he's not listed.

Additionaly, in this config, AWS access is configured for role assumption, So brianr, cnuss, and tonystark can all log AWS using the command

`npx saml-to assume role/admin`

This command would open up a browser window in the AWS console with the role of "arn:aws:iam::01234567890:role/admin"!

Using two commands, developers were able to log into both AWS and Rollbar in seconds.

Also, with SAML.to Premium, listing individual users is unnecessary, and assigning them to teams and specifying the teams in the config eliminates the repetition of a list of users in the config file.

Let me know if you have any questions or comments!

great question yodon!

generally speaking, no, there should be no security concerns checking this into a repo but some best practices would be recommended to follow: - make the repo private - protect the main branch - require PRs and # approvals and/or add CODEOWNERS - only allow individuals that need to edit with write/admin privileges - having anybody with read-only access to the repo is unnecessary since SAML.to does the reading on behalf of the users

if provisioning is needed, there would be a encrypted token for SCIM in the text of the file, but that token is encrypted by SAML.to AWS KMS, so checking an encrypted string into a file shouldn't be a huge concern for most

also, SAML.to Premium allows users to maintain their own PKI and allows administrators to encrypt and sign according to their organizations requirements!

on a final note, I'd entertain a feature request for "include" statements in the config file so CODEOWNERS could be leveraged nicely

that's all I can think of for now. I'll get these best practices into the docs and I'd entertain any and all suggestions or thoughts!

Greetings Hackers!!

I've bridged GitHub OAuth and SAML 2.0 together, and made it easy to use with a CLI (`npx saml-to --help`). It's called SAML.to (https://saml.to).

I've built this to be a no/low-cost alternative to using Okta, OneLogin, or JumpCloud for SAML Logins.

Using SAML.to, a configuration file is placed in a GitHub repository that defines one or many Service Providers and Permissions to GitHub users, then logging in is as simple as running a command in your console:

npx saml-to login

Or for role assumption (like IAM roles):

npx saml-to assume

I'd love this community's feedback on this, please let me know what you think!

Cheers, cnuss

CLI: https://github.com/saml-to/cli Forums: https://github.com/saml-to/cli/discussions Documentation: https://docs.saml.to

Thanks yodon, great feedback! I've aggregated a list here for easier discovery: https://docs.scaffold.ly/contributing/open-source-components

Hey Everyone!

We've built Scaffoldly as an Open Source option to quickly start new projects in AWS, and cost effectively.

Scaffoldly Start (https://start.scaffold.ly) is the next iteration of our product, designed to quickly set up a new project on AWS using our Open Souce Tooling with Serverless APIs, GitHub Actions, Terraform, and Authentication.

I've built a toolset and am putting the final touches on potentially exactly what you need, I'm looking for a few early adopters and some feedback

every API is serverless, typescript, openapi, has GitHub CI/CD, and runs locally and on AWS lambda

shoot me a message and I'd love to show you around: christian (at) scaffold.ly

True, I'll put "bootstrap" in the extreme maybe area, especially since CSS frameworks are so easy to wire in.

My previous work with React found an huge need for other things, such as redux and redux-saga, and found myself wasting a lot of time wiring that up just to get some text to change in the HTML based on a remote API call, but, personally, as I'm comparatively a n00b with React, I'd really like be prescribed a foundational structure for a new project.

I'm down

I personally would set it up in Google Search Console for each subdomain and experiment to see how deep Google matches subdomains on subdomains.

And do 302 redirects (https://first.steps.for.planning.wedding ==> https://planning.wedding/first-steps)

Although I'm not sure what I'd do on https://for.planning.wedding, but probably a 302 to https://planning.wedding

The nerd in me would then automate any slug that ends in "planning wedding", set up the domain in Search Console and ensure its verified properly.

For the record, I really like this branding idea.

hey Vmception! I've been working on a brand new framework that provides exactly what you need, and I'm looking for a few early adopters. hit me up! christian [at] scaffold.ly

Let me know when you have a new release and I'll try it out some more!

Scaffoldly+Knotend:

- Compare with Netlify/GH Pages: Big bonus is that you get Nonlive and Live out-of-the-box (e.g. app-dev.knotend.com and app.knotend.com for examples) and CI+CD+Releases in GH Actions to run it all. I have a "Generic CDN" template (not yet documented) that will push a public_html/ directory to S3+CloudFront too, here's an example repo: https://github.com/scaffoldly-demo/demo-web-cdn, in your case, you'd update the GitHub action to compile whatever into the public_html directory

- Feedback w/o altering AWS/GH: Everything is contained to A) a new GH organization and B) an AWS sub-organization. If you want to "edit-undo" any changes Scaffoldly did, it should be as simple as (1) delete the github org and (2) terminate the AWS sub-org account.

- I presume you're eventually going to need a backend, which is where Scaffoldly will help, wires up APIs + Swagger Docs for you, and takes care of all that CORS stuff too.

Let me know what you think!

Yea I've used those too, great way to get a quick lil server up and running...

Quick question, I've on a AWS bootstrapping/code deployment framework to AWS currently, would you be willing to kick the tires on it a bit?

Put briefly, it configures an AWS org and domain, a GitHub Org, provides template repos, and connects all the wires...

https://docs.scaffold.ly/tutorials

It's not the Docker/Kube Kool-aide, but it is the Lambda+Serverless Kool-aide, so AWS charges for idle infra are near-zero.

I don't have much context on what you're building for your solo projects, but I'd like to learn more, so feel free to message me directly too, hackernews [at] cnuss dotcom

Yea it sucks to be forced in any direction, I feel your pain with the complicated-ness of AWS. Alternative to AWS, what sort of alternatives you see emerging? In my research I've found a handful of PaaS/Self-Hosted options (Bubbles, Budibase, Mendix, DronaHQ, etc), why not use them? Then people also ask, why not just use Heroku or DigitalOcean?

Loaded question, but, asking anyways, what's wrong with AWS?

I'm personally attempting to make AWS "easier" and less of a labyrinth with my projects. I'd love to pick your brain if you have a few moments to spare, solo devs like you and me is who I'm trying to cater to.

I'm a tad confused on the question... - what's your recipe actually set up on the VPS? - is the fear that your clients will want Docker/Kube from the get-go and not your single-server solution?

Thanks @escot! Great feedback it was really helpful, you're one of the first outside my circle to digest it. If you find the time to actually go through project onboarding I'd love that too (video 1-3 (one time setup ---> web portal), but also, I could give you some 1-1 time to see if you could host knotend on it, as your project is also exactly what i'm trying to help incubate. I'll work on the pitch and background so its more clear and you made some great suggestions.

Back to Knotend (FYI i keep wanting to type Knoted):

(I tried on desktop now and have more feedback [sorry if it's duplicate of what you already received, I didn't review other's feedback])

First, here's a screen recording of my desktop experience, i annotated my thoughts in the cells so hopefully its clear what i was thinking when something happened, but let me know if you need any clarifications of what i pressed/did...

Also I got a big fat Unexpected End of Input Error at the end.

https://drive.google.com/file/d/1QExurVaWTdDpi-BCFxgC17hbKsx...

Here's some responses to your responses/questions on knotend: - Empty cells: Perhaps try a (+) icon in the empty cell where stuff can be added, so its clear where stuff can be added. - I'd love to be able to drag/drop cells - I'd love to be able to click on one of the lines and change a relationship - Saving Text on Mobile: Screen recording: https://drive.google.com/file/d/1ylJzOm0_O6cVyc9dWcuBsL47iu0...

Cheers mate, keep in touch, would love to continue to evaluate each others tech!

this is very cool! I friggin love note taking things especially how you built workflows into it

I really see where you're going here, so I have some initial feedback:

PSA: I only tried on mobile chrome Android but I'll respond with my desktop experience tomorrow, so my comments here are limited to mobile

- rendered nicely on mobile, switched to desktop mode and then I saw the help icon top left, so layout may need to be adjusted

- the spreadsheet layout is cool but I kept thinking if a trello sorta layout would work, empty cells were slightly confusing at first

- I wasn't able to save text on mobile but double tapping did bring up the keyboard

- typing then pressing soft enter didn't save (mobile)

- back on Android triggered an undo?

- the nav bar buttons at the top didn't seem to do anything, but the embedded left/right arrows on top of the cells were amazing to make new connections, well done

- (once again, mobile) I wish I had a context menu (right click) when in a cell, or disable buttons in the nav bar to show what I'm allowed to do

that's all the feedback I have for now, but I'll check desktop tomorrow

in the meantime, I'd love your feedback on my project I'm getting started, hit me up with your feedback hackernews <at> cnuss dot com

https://docs.scaffold.ly/tutorials

build it back again!