Iyiphi iklayenti engaqeda ukungena nge-SAML ku-AWS Client VPN
Amadeskithophu e-Linux aneklayenti le-AWS angakwazi ukuqeda ukudluliswa kwe-SAML kusiphequluli; ukungeniswa kwe-OpenVPN ejwayelekile ku-Android akukwazi. Izimo ezintathu zinquma icala lakho.
Abantu ababili bubuza umbuzo ofanayo mayelana ne-AWS Client VPN ne-SAML, futhi bathola izimpendulo eziphambene. Omunye ungena esebenzisa ikhompyutha ephathwayo ye-Ubuntu njalo ekuseni; omunye unomakhalekhikhini, iphrofayela elandwe phansi kanye neklayenti elinqaba umugqa owodwa kuyo. Umehluko akusona inhlanhla futhi akusona iswishi ecashile kudashibhodi. Konke kuncike ezimweni ezintathu: ukuthi ingabe ipulatifomu ingenye yalezo i-AWS eyisekelayo yeklayenti layo, ukuthi ingabe ithuluzi esandleni sakho lingakwazi ukwenza ukushintshana kwesiphequluli okuhlangene, nokuthi ingabe indawo yokugcina ilungiselelwe i-SAML noma cha. Uma kugeja esisodwa kwezintathu, ukungena kuzoma kwenye indawo.
Izimo ezintathu zinquma ukuthi ukungena kungaqedwa yini
Ipulatifomu iza kuqala. I-AWS ihlinzeka ngeklayenti layo le-Client VPN le-Windows, macOS ne-Ubuntu ku-AMD64, futhi ekupheleni kuka-Okthoba 2026 ikhasi lezidingo ze-Linux libala i-Ubuntu 22.04, 24.04 ne-26.04. Ukwakhiwa okuphinde kwapakishwa, iphakethe eliguquliwe noma esinye isabelo kungase kusebenze, kodwa akusona ipulatifomu esekelwayo, futhi uma kwephuka, umugqa wokusekela nguwe.
Iklayenti iza okwesibili. Ukungena okuhlangene akusona isici sephrofayela esihlukaniswa yonke iapp evumelana ne-OpenVPN. Iklayenti elinikeziwe livula umhlinzeki wakho wobunikazi kusiphequluli, lamukele impendulo yokuqinisekisa esayiniwe futhi ithumele leyo mpendulo endaweni yokugcina. Iapp efunda iphrofayela kuphela bese yakha umhubhe ayiyenzi leli sinyathelo, kungakhathaliseki ukuthi ilogi yayo yoxhumano ibukeka ihlanzekile kangakanani.
Indawo yokugcina iza okwesithathu. Indawo yokugcina esebenzisa ubufakazi be-Active Directory noma izitifiketi zomabili inokuhlelwa okuhluke ngokuphelele, futhi ukushintsha amaklayenti ngeke kukushintshe lokho. Qinisekisa imodi yokuqinisekisa nomuntu okhiphe iphrofayela ngaphambi kokuxazulula enye into.
Uma kuhlangene, izimo ezintathu zinikeza ithebula elifushane lesinqumo:
| Platform | AWS-provided client | Completes the SAML exchange | What that means |
|---|---|---|---|
| Ubuntu 22.04 / 24.04 / 26.04, AMD64 | Yes | Yes | Normal sign-in path; debug stages, not platforms |
| Windows or macOS | Yes | Yes | Same path, different installer |
| Android | No published client | No | Needs a different access design, not a different profile |
| Other Linux distributions | No | Depends on the tool | Runs at your own support risk |
Kungani ukungeniswa kwe-OpenVPN kuma ku-auth-federate
Iphrofayela ye-AWS Client VPN ethunyelwe ngaphandle ithwala umyalo otshela iklayenti ukuthi ukuqinisekisa kwenzeka ngaphandle komhubhe, ngokuhlangana. Iklayenti le-OpenVPN elijwayelekile lilahla lowo mugqa ngokushesha noma liwushaye indiva bese lingenabo ubufakazi obungabunikeza. Yilapho imizamo eminingi ye-Android iphela khona: iphrofayela iyangeniswa, iapp iyaphikisa, noma uxhumano lufa ngephutha lokuhlelwa ngaphambi kokuba ngisho iphakethe elilodwa liphume kudivayisi.
Ukususa auth-federate yisinyathelo esilandelayo esikhangayo, futhi kuguqula ukwehluleka okucacile kube ukudideka. Ukususa umyalo akuguquli indawo yokugcina ye-SAML ibe ukuqinisekisa ngegama lomsebenzisi nephasiwedi. Indawo yokugcina isalindele impendulo ye-SAML esayiniwe futhi inqaba lokho iklayenti elikuthumayo esikhundleni sayo. Iphasiwedi yakho ye-akhawunti, iphrofayela elandwe phansi kanye nesimemezelo esikopishiwe akusona ubufakazi obushintshisanayo.
Ukungena kumhlinzeki wobunikazi ku-Chrome kumakhalekhikhini kufakazela kuphela ukuthi umhlinzeki wobunikazi wamukele umsebenzisi. Akusho lutho mayelana nokuthi impendulo ifinyelela iklayenti elingayibuyisela endaweni yokugcina yini. izidingo zokuqinisekisa okuhlangene zenza iklayenti elinikeziwe libe yingxenye yokugeleza ngenxa yaleso sizathu: isinyathelo sesiphequluli siyadingeka futhi asanele.
Indlela esekelwayo yedeskithophu ye-Linux ibukeka kanjani
Faka iphakethe elishicilelwa yi-AWS le-Ubuntu AMD64 ngumphathi wamaphakethe wesistimu yakho, bese uvula uxhumano kulelo klayenti esikhundleni sokungenisa iphrofayela ku-app ye-VPN ejwayelekile. Sebenzisa iphrofayela umlawuli wakho ayithumele ngaphandle yale ndawo yokugcina; ungashintshi i-URL yokubuyisa noma isihlonzi seklayenti esivela kumhlahlandlela wakudala, ngisho noma iklayenti likwamukela.
Qala uxhumano, qeda ukungena nanoma yisiphi isicelo se-MFA kusiphequluli esivulayo, futhi uvumele ukugeleza kokubuya kusuka kusiphequluli kuya eklayentini kuphele. Bese ucela kabusha ikheli langasese olidinga ngempela. Ikhasi elimemezela ukungena okuphumelelayo alisobufakazi bokuthi umhubhe unyukile.
Iklayenti le-Linux libekela eceleni amachweba e-TCP endawo 8096 kuya ku-8115 eziphendulo ze-SAML. Uma ukudluliswa kumile ngemva kokuba umhlinzeki wobunikazi ekwamukele, bheka ukuthi yini esivele ilalela kulelo banga:
ss -ltnp | grep -E ":809[6-9]|:81(0[0-9]|1[0-5])"
Ichweba elisetshenzisiwe, noma isofthiwe yezokuphepha yendawo yokugcina evimbela isilaleli se-loopback, kukhiqiza ukungena okubonakala kuphelile bese kungaxhumani neze. Gcina lelo banga lisenkabeni. Kuyindlela yokubuya ohlangothini lweklayenti, akusiyo into evulwa kuqembu lezokuphepha le-EC2 noma emthethweni wothango lomlilo wesango, futhi ukuyivula ku-inthanethi kunezela ukuchayeka ngaphandle kokulungisa lutho.
Funda isigaba esihlulekayo ngaphambi kokushintsha noma yini
Ukusola iklayenti kuwukusabela okuvamile, kodwa iphuzu ngalinye lokuhluleka lingelomunye umnikazi. Qala ngokuthola ukuthi ngempela ukuphi.
- Awekho amawindi esiphequluli avulayo. Hlola imodi yokuqinisekisa yephrofayela, uxhumano olukhethile kanye nokuhlangana nesiphequluli esizenzakalelayo sedeskithophu.
- Umhlinzeki wobunikazi wenqaba i-akhawunti. Ukwabiwa kwe-akhawunti, ukubhaliswa kwe-MFA noma ukuhlelwa kwe-app ye-SAML, konke kuyindawo yomlawuli.
- Isiphequluli siyaphela kodwa iklayenti alixhumani neze. Impendulo yokuqinisekisa ephelelwe yisikhathi noma engasebenziseki, ichweba lokubuya elivimbiwe, noma ukudluliswa okuhlulekile.
- Umhubhe unyukile kodwa iapp ayifinyeleleki. Imizila yendawo yokugcina, imithetho yokugunyaza, amaqembu ezokuphepha, i-DNS. Ukuphinda ukungena kusiphequluli akukwazi ukwengeza imvume yenethiwekhi engekho.
Gcina umbhalo wephutha leklayenti nesikhathi somzamo uma ukhuphula izinga. Isimemezelo sokuthi i-SAML iphukile nesimemezelo sokuthi iklayenti alikaze lathola impendulo yokuqinisekisa evumelekile kuthumela abantu ezindaweni ezihluke ngokuphelele.
Uma isidingo siseyi-Android noma kunjalo
I-Android akuyona ipulatifomu i-AWS eshicilela iklayenti layo kuyo, ngakho impendulo eqotho iwukuthi awekho iklayenti leselula elisekelwayo ongalifaka. Lokhu kuwumkhawulo wokuklama, akusona iphazili okufanele lixazululwe emakhalekhikhini ngokuhlela iphrofayela kuze kuxhumane okuthile.
Okungashintshwa ukuklanywa kokufinyelela okungemuva, futhi leso sinqumo singesomlawuli: indlela yokufinyelela ye-app egunyaziwe eya ensizakalweni eyodwa yangaphakathi edingwa umakhalekhikhini, umkhiqizo we-VPN osekelayo iselula osekwahamba ngowesikhathi iyinhlangano, noma ideskithophu esekelwayo yendawo yokugcina esebenzisa i-SAML kuphela. Inketho ngayinye iletha ukuhlelwa kwayo kwendawo yokugcina, ukubhaliswa kobunikazi kanye nemithetho yokugunyaza, futhi akukho kulokhu umsebenzisi angakwakha kuphela kwiphrofayela elandwe phansi.
Amathuluzi ezinkampani zangaphandle athi avala leli gebe adinga ukubuyekezwa okucacile kokusekela nokuphepha okuhlanganisa i-MFA, ukuphathwa kwezimpendulo, inqubomgomo yedivayisi kanye nesivinini sokubuyekeza. Ukuba khona kwawo akukwenzi kube iklayenti le-Android elinikezwa yi-AWS, futhi akufanele uthuthele impahla yokuqinisekisa esebenzisekayo kabusha kumakhalekhikhini ukuze elinye lawo lisebenze.
Nikeza umlawuli amaqiniso amathathu esikhundleni sengxoxo ende ngemiyalo: imodi yokuqinisekisa yendawo yokugcina, insiza yangasese okufanele umakhalekhikhini ayifinyelele, kanye nomnqamulajuqu. Lokho kwanele ukukhetha phakathi kwedeskithophu, indlela yokufinyelela ye-app nomkhiqizo omusha we-VPN.
Hlola izimo ngokulandelana ngaphambi kokuvula elinye ithikithi: ipulatifomu ohlwini lwamaklayenti anikeziwe, ithuluzi elingaqeda ukushintshana kwesiphequluli, indawo yokugcina elungiselelwe ngempela ukuhlangana futhi, ku-Linux, ibanga lamachweba e-loopback. Into yokuqala ehlulekayo yiyo okufanele ilungiswe. Konke ngemva kwayo kuwukuqagela.