AWS Client VPN SAML ne-Google Workspace: igebe lokubuyisela ucingo

Ikhasi le-app_not_configured_for_user livela ku-Google Workspace futhi libonakala ngaphambi kokuba kuxoxwe ngisho iphakethe elilodwa lomhubhe. Lolo hlelo lulo lonke ukuxilongwa. Ukufaka kabusha iklayenti, ukuhlela iphrofayela noma ukuhlola imizila akukwazi ukususa ikhasi umkhondo we-VPN ongakaboni. Isinyathelo esihlulekayo ukudluliswa esipheqululini phakathi komhlinzeki wobunikazi nesilaleli emshinini womsebenzisi uqobo, futhi kulokho kudluliswa kunezinto ezintathu ngqo okufanele zihlolwe.

Funda ikhasi njengesitatimende somhlinzeki wobunikazi

I-Google ibuyisela lokhu lapho uhlelo lokusebenza lwe-SAML lungavuliwe kwi-akhawunti engene ngemvume. Uhlelo lokusebenza lungase lucishiwe, umsebenzisi angase abe ngaphandle kweyunithi yenhlangano noma iqembu elabelwe, noma izilungiselelo zomhlinzeki wesevisi zingase zingahambisani nalokho okwakudingwa isicelo.

Akukho kulokhu okuyinkinga yesitifiketi, umzila noma umhubhe, nakuba umsebenzisi wakubona kuklayenti le-VPN.

Amanani amabili iklayenti elizowamukela

I-AWS Client VPN yenza ukushintshana kwe-SAML okuqalwa umhlinzeki wesevisi, ngakho iklayenti livula isiphequluli, umsebenzisi uziqinisekisa, futhi umhlinzeki uthumela isimemezelo esisayiniwe emuva ku-URL ye-Assertion Consumer Service. Iklayenti ledeskithophu elinikezwa i-AWS lalowo URL iyisilaleli ku-loopback, ngokuvamile iphothi engu-35001, futhi izilaleli ezilindelekile umhlahlandlela webhizinisi lohlelo lokusebenza lwe-SAML lwe-Client VPN, hhayi ibhizinisi lokungena kwekhostholi ye-AWS.

Womabili amanani kufanele ahambisane nalokho iklayenti elikulindele: lapho isimemezelo sithunyelwa khona nokuthi sibhekiswe kubani. Ukulungiselelwa okukopishwe kuhlelo lokusebenza lwe-SSO kwekhostholi kungase kubonakale kukholakala ngokuphelele futhi kusaqondise ipheya elingalungile.

Thatha womabili amanani ezimfunekweni ze-Client VPN SAML, hhayi emhlahlandleleni ojwayelekile wokungena kanye kwe-AWS. Ibhizinisi le-SSO lekhostholi libonakala lifana ngokwanele ukuba lihehe. Kunguhlelo lokusebenza oluhlukile olunezilaleli ezihlukile, futhi iklayenti liyenqaba isimemezelo ngaphandle kokuzichaza. Kopisha ipheya kanye, bese uligcina eduze kwephrofayela.

I-Google ngeke ikwamukele ukubuyisela ucingo lwe-HTTP oluvamile

Ikhostholi yomlawuli idinga i-URL ye-ACS ye-HTTPS, kanti ukubuyisela ucingo kweklayenti i-HTTP evamile ku-loopback. Lelo nani alikwazi ukuthayipha ekulungiseleleni kohlelo lokusebenza lwe-Workspace, yingakho amanye amaqembu ezama iphroksi ephambene eqeda i-TLS bese idlulisela kusilaleli sendawo. Lokho akulungisi ukungafani: isiphequluli sibona umsuka owodwa, iklayenti limemezela omunye, futhi impendulo ebuyisiwe ingase ifike endaweni okungeyona.

Isakhiwo esisebenza umhlinzeki wobunikazi ongumlamuli. Uhlelo lokusebenza lwe-SAML kumlamuli luthola ukubuyisela ucingo kwe-loopback kanye nezilaleli ze-AWS, futhi umlamuli uhlanganisa i-akhawunti ye-Workspace phezulu. Umthetho we-HTTPS we-Google uhlala ugcwalisiwe, futhi isimemezelo esifika kuklayenti sisabiza ikheli nezilaleli elikulindele.

Lowo mlamuli uyincike yokuphatha okufanele umuntu abe nayo, ayiqaphe futhi ayifake ekuhoxisweni komsebenzi. Futhi iyindawo yesibili lapho ukuphazamiseka kuphenduka ukwehluleka kokungena. Yilinganisele ngaphambi kokuthembisa umklamo. Uma kungekho ozoba nayo, impendulo eqotho ukuthi iklayenti le-AWS alikwazi ukusebenzisa i-Workspace njengomhlinzeki walo wobunikazi oyedwa.

Ukwabiwa nokuqinisekisa kwezinyathelo ezimbili

Ngaphambi kokuklama kabusha noma yini, qinisekisa ukuthi uhlelo lokusebenza luvuliwe kuyunithi yenhlangano noma iqembu elifanele, nokuthi izinhlelo zokusebenza ze-SAML zezinhlangano zangaphandle zinezilawuli zazo zokwaba ezihlukile ohlwini lwezinhlelo zokusebenza ohlangothini lwe-Google.

Hlola futhi ukuthi i-akhawunti inokuqinisekisa kwezinyathelo ezimbili okuvuliwe yini. I-Google ingase ikudinge ngaphambi kokuba uhlelo lokusebenza lwe-SAML lusebenziseke kumsebenzisi, futhi impendulo eyodwa ochungechungeni lwasekuqaleni yaxazululwa ngale ndlela ngqo. Lena into eshibhe kakhulu ukuyikhipha futhi ekhathaza kakhulu ukuyithola ekugcineni.

Qinisekisa ngesikhathi esihlanzekile

Ngemuva kwanoma yiluphi ushintsho, hlola ngephrofayela entsha yesiphequluli nokulungiselelwa okuhlanzekile kweklayenti. Izimemezelo ezigciniwe nezikhathi ezisetshenziswe kabusha zifihla ukuthi ukulungisa kufikile yini.

Bese uqhathanisa amarekhodi amabili eceleni: umcimbi wokucwaninga womhlinzeki wobunikazi kanye nelogi yeklayenti. Ukungena okuphumelelayo ngaphandle komhubhe kukhombisa emuva ekubuyiseleni ucingo noma ezilalelini. Umhubhe oxhunyiwe kodwa insiza engafinyeleleki inkinga yomzila noma yegunya futhi ingeyendawo ehluke ngokuphelele.

Okungafane kushintshwe

Ungasusi i-auth-federate kuphrofayela futhi ungacishi izihlolo zesitifiketi ukuze udlule ikhasi. Zombili zishintsha umklamo wokuqinisekisa kunokuba zilungise ukubuyisela ucingo okwehlulekile, futhi zombili zivame ukwephuka ekubuyekezweni kweklayenti okulandelayo.

Esikhundleni salokho lungisa ukudluliswa, futhi ushiye inothi elibiza umlamuli, izilaleli kanye nephothi ye-loopback. Umuntu olandelayo ozobona ikhasi uzodinga kukho kokuthathu.