Can a single AWS Client VPN Endpoint support federated and certificate-based authentication simultaneously?

DevOps AWS
1

Hi friends, is it possible to have a single AWS Client VPN Endpoint that supports both federated and certificate based authentication? https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ec2_client_vpn_endpoint

We have a aws client vpn endpoint setup with federated-authentication , this works well with saml idp. We dont modify the .opvn at all.

We added support for certificate/mutual-authentication to this same client vpn endpoint.

On the surface it seems possible but we are finding that it just ends up using federated-authentication ( but now you have to update the opvn config with the client cert/pk block otherwise it does not work).

I expected us to be able to authenticate with either our idp OR by specifying client cert/pk in the opvn on a single client vpn endpoint. is that assumption wrong?

2

I am no expert in here, but as far as I understand it requires both/combination.

3

Hi, sorry i dont understand, what do you mean?

4

You can specify federated-authenticaiton only, which is what we currently do

5

https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/client-authentication.html

6

You can use one of methods listed above alone, or a combination of mutual authentication with a user-based method such as the following:

Mutual authentication and federated authentication

7

If I understand the aws docs correctly, when using a combination of Mutual authentication and federated authentication, both of the methods must be used by client. It is not an OR but rather AND condition.

8

hmm ok, where are you reading that?

9

That’s what the word combination suggests…imo

10

https://www.reddit.com/r/aws/comments/o8lcup/both_client_vpn_auths/

11

Ok ye that sucks, thanks!

12

Sorry unfortunate :confused:

13

So now if we wanted to use mutual-authentication only we would be spinning up a seperate vpn endpoint, dedicated to mutual authentication

14

Ye no worries, im actually just looking into alternatives incase our current idp goes down and i need a backup solution

15

Was hoping i could reuse the single vpn endpoint, but guess not

16

which would be expensive

17

Ye, the cost is why it sucks, it would be too much to have it running all the time only for backup use

18

I think there was relative newer services called Verified something

19

Not sure what you are trying to achieve but https://aws.amazon.com/verified-access/?did=ap_card&trk=ap_card

20

We have some services running on an internal alb, that we would like to access, e.g some dashboard with sensitive data we dont want it to be publically accessible