AWS Workspaces Pools userspecific seamless login

Hi Samuel,

Let's dive into your issue.

Clarifying the Issue

Samuel, you’re looking to achieve a seamless login flow for AWS WorkSpaces where users access apps like Box Drive or OneDrive with Entra ID or Okta—all without relying on Active Directory (AD). The challenge stems from app licensing and authentication dependencies that traditionally require AD.

Your desired flow involves:

1. Logging in with Entra ID or Okta.
2. Launching a WorkSpace bundle with Box Drive pre-installed.
3. Seamlessly logging into Box Drive with user-specific credentials.

Unfortunately, achieving this flow without AD introduces limitations. Let’s break it down and propose solutions.

---

Key Terms

• Entra ID (Azure AD): Microsoft’s cloud-based identity service for managing user authentication.
• Okta: A third-party Identity Provider (IdP) enabling Single Sign-On (SSO) for apps and systems.
• OneDrive: Microsoft’s cloud storage platform requiring AD or Entra ID for seamless access.
• Box Drive: A cloud-based file collaboration service that relies on AD for seamless login.
• AWS IAM Identity Center: AWS’s SSO service, connecting external IdPs like Entra ID/Okta to AWS WorkSpaces.
• Active Directory (AD): Microsoft’s directory service managing user access, licensing, and group policies.

---

Our Solution (The Recipe)

Here’s the recipe to work around the AD requirement while addressing your need for user-specific app login.

1. Use AWS IAM Identity Center as the SSO Bridge

• Configure AWS IAM Identity Center to authenticate users via Entra ID or Okta.
• Users log into AWS WorkSpaces through their IdP credentials.
• Limitation: While IAM Identity Center handles WorkSpaces access, apps like Box Drive still require a manual login step.

2. Build a Pre-Configured WorkSpaces Bundle

• Create a WorkSpaces image with Box Drive or OneDrive pre-installed.
• Allow users to sign in manually within Box Drive or OneDrive using their Entra ID or Okta credentials.
• This approach minimizes setup time and provides a consistent environment.

3. Implement a Lightweight AD Setup for Licensing

• Use AWS Directory Service for Simple AD or AWS Managed AD as a lightweight AD solution.
• This satisfies the app licensing and integration requirements without the expense of a full enterprise AD.
• Authentication flow:
  • Users log into WorkSpaces via Entra ID or Okta.
  • Apps like Box Drive auto-authenticate through AD.

4. Automate App Login with Scripts

• Deploy startup scripts (PowerShell or AWS Systems Manager) to automate app login within WorkSpaces.
• Example: Pre-fill Box Drive credentials or initiate the login process on startup.
• This creates a near-seamless experience while avoiding AD dependency.

---

Closing Thoughts

While AWS IAM Identity Center simplifies user authentication, the seamless login you’re seeking for Box Drive or OneDrive still requires AD due to licensing and app dependencies. By combining IAM Identity Center, a pre-configured WorkSpaces bundle, and a lightweight AD setup, you can minimize costs and achieve a functional solution.

If you’d like more details on configuring any of these steps, I’d be happy to dive deeper!

Cheers, Aaron 😊 🚀