--- title: "Simple Guide to Setup AWS Directory Service" description: "Amazon introduced today a new feature called AWS Directory Service. In a nutshell, it allows: Connect existing Active Directory to the cloud or to create" authors: - name: "Jose Romaniello" url: "https://auth0.com/blog/authors/jose-romaniello/" date: "Oct 22, 2014" category: "Developers,Tutorial,Integration" tags: ["aws", "ad", "ldap", "directory"] url: "https://auth0.com/blog/simple-guide-to-setup-aws-directory-service/" --- # Simple Guide to Setup AWS Directory Service Amazon introduced today a new feature called [AWS Directory Service](http://aws.amazon.com/es/directoryservice/). In a nutshell, it allows: - Connect existing Active Directory to the cloud or to create complete new Directories from scratch. - Seamless administration of AWS Resources. - Seamless access to AWS applications for end-users. - Simplify Deployment of Windows Workloads on AWS. - Pay as you go (0.05 $/hr for small installations and $0.15 for large) More information at In this short tutorial we will deploy a new **AWS Simple AD**, connect it to an Active Directory MMC and configure it to work with Auth0. ### Configuring the Simple AD Open up the [Directory Service console](https://console.aws.amazon.com/directoryservice/home) and create a new Simple AD: ![ss-2014-10-22T13-38-02.png](https://images.ctfassets.net/23aumh6u8s0i/4hdt63yIvImwL4v5WBcsgz/e251033c22462efb33fa807fa0616884/ss-2014-10-22T13-38-02) This operation can take a while to complete. > Notice that Simple AD doesn't have a way to manage its user and roles, so the next thing we are going to do is to deploy a Windows EC2 instance on the same VPC. ### Deploy Management Interface In this step we will deploy a new Windows 2012 VM instance and join it to the windows domain. - Launch a new Windows 2012 on EC2. - Connect via Remote Desktop - Open **Network Connections** or run `%SystemRoot%\system32\control.exe ncpa.cpl`. - Right-click any enabled network connection and select **Properties**. - In the connection properties dialog box, double-click **Internet Protocol Version 4**. - Select **Use the following DNS server addresses**, change the **Preferred DNS server** and **Alternate DNS server** addresses to the IP addresses of the **Simple AD** and click **OK**: ![ss-2014-10-22T13-44-18.png](https://images.ctfassets.net/23aumh6u8s0i/6aqa4UUFNyEMgBbxfp7mQ2/e27e77ddcf86f8a9ac4b1981a5e39258/ss-2014-10-22T13-44-18) - Open **System Properties** or run `%SystemRoot%\system32\control.exe sysdm.cpl`, select the **Computer Name** tab, and click **Change**: ![ss-2014-10-22T13-51-24.png](https://images.ctfassets.net/23aumh6u8s0i/5CtCNLhQtKsbLh5X5Ukv34/bf75d2599483d284fff63bfd87baf144/ss-2014-10-22T13-51-24) - You will have to enter a username and password, use **Administrator** and the password you selected when creating the **Simple AD**. - You will need to restart the machine. - Connect again via **Remote Desktop** but this time use a domain account with the qualifier, for our example `corp.contoso.com\Administrator`. - Open **Program and features** or run `%SystemRoot%\system32\control.exe appwiz.cpl` - Click on **Turn Windows features on or off** - Go to the **Features** step , expand **Remote Administration Tools**, then **Role Administration Tools** and then select **AD DS and AD LDS Tools**: ![ss-2014-10-22T14-00-26.png](https://images.ctfassets.net/23aumh6u8s0i/6c6s8c9KMAkJ6bWeb1YavG/5239719de23f4ab766b71ec990c064e3/ss-2014-10-22T14-00-26) Now you will be able to create Users and Groups on your __AWS Simple AD__ using the **Active Directory Users and Groups**: ![ss-2014-10-22T14-04-06.png](https://images.ctfassets.net/23aumh6u8s0i/2787df6OIkmYNb2DdRpkwY/d97054141e5609e1b3c1289cb59e55da/ss-2014-10-22T14-04-06) ### Connect your new directory to Auth0 ####1. Create a new **AD LDAP** Enterprise connection in Auth0 ![ss-2014-10-22T14-33-10.png](https://images.ctfassets.net/23aumh6u8s0i/bvjWrmle4x5cGlGlaRNpk/c445b6bb43f21f9c124d235ede770046/ss-2014-10-22T14-33-10) Optionally, you can enable __Kerberos__ to use __Windows Integrated Authentication__ on machines joined to the same domain. Copy the _TICKET URL_ provided by auth0 and paste in a browser inside the Windows Machine provisioned in the previous step. ####2. Download and install the agent: ![ss-2014-10-22T11-49-40.png](https://images.ctfassets.net/23aumh6u8s0i/4GajblgEWfrRSD0x2ieyUk/7febdcd80d851881c42a5c573bfb4160/ss-2014-10-22T11-49-40) After the installation a new page in the browser will came up, paste your TICKET URL: ![ss-2014-10-22T14-34-15.png](https://images.ctfassets.net/23aumh6u8s0i/6MNTKPlvP70uqFV6hgecJ6/17c73ddb18db9cabdc9e026b7485af33/ss-2014-10-22T14-34-15) Complete the LDAP config settings ![ss-2014-10-22T11-58-22.png](https://images.ctfassets.net/23aumh6u8s0i/31033mo44TcfUY2Wv2ssnQ/91ef566c8d1c60e8143d315d15221822/ss-2014-10-22T11-58-22) ### Testing your new connection If you go back to your Auth0 Dashboard you should see now a green icon: ![ss-2014-10-22T13-14-43.png](https://images.ctfassets.net/23aumh6u8s0i/1x8bxMDIkK6gRCiOSHLa1l/2519f144a18418f067fda3536b6c5fef/ss-2014-10-22T13-14-43) Click the __Try__ button and enter the user credentials: ![ss-2014-10-22T13-15-55.png](https://images.ctfassets.net/23aumh6u8s0i/bfh4uv8mSEEWxGxLyLK1Q/a1039ab856f3df677f0323b7ff8ee26f/ss-2014-10-22T13-15-55) If you see this screen, then everything is working as expected: ![ss-2014-10-22T14-37-20.png](https://images.ctfassets.net/23aumh6u8s0i/5wAZM4G8c6As3m0vHvBGLK/a9056a9c7b03b1ef6a0eacb27fba8311/ss-2014-10-22T14-37-20) ## So, what can I do now with Auth0? When you plug Auth0 to your Active Directory you can: * Have your custom **web, single page apps and mobile apps** authenticate with the **AWS AD** in minutes * Connect the **AWS AD** with **Salesforce**, **Zendesk**, **NewRelic** and other SAML-based application. * Connect the **AWS AD** with Open Source platforms like **WordPress**, **Drupal** and **Discourse** * Configure **Single Sign On** between all these applications * Add **Multi-factor** authentication to these applications * **Extend the user profile** with application-related metadata ![](https://images.ctfassets.net/23aumh6u8s0i/2PuR0YVJhXnup2gw1TD7xA/1ebcf42398155c2652d65e37666f9a93/pub_w_1219_h_558) More information about Auth0: