Skip to content

Commit e8d693a

Browse files
dnitschdnitsch
committed
fix: add clear and specific commands
1 parent 0aa9e89 commit e8d693a

File tree

12 files changed

+227
-70
lines changed

12 files changed

+227
-70
lines changed

‎Makefile‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
NAME := aws-cli-auth
2-
VERSION := v0.2.0
2+
VERSION := v0.3.0
33
REVISION := $(shell git rev-parse --short HEAD)
44

55
LDFLAGS := -ldflags="-s -w -X \"github.com/dnitsch/aws-cli-auth/version.Version=$(VERSION)\" -X \"github.com/dnitsch/aws-cli-auth/version.Revision=$(REVISION)\" -extldflags -static"
@@ -35,9 +35,7 @@ clean:
3535
cross-build:
3636
for os in darwin linux windows; do \
3737
[ $$os = "windows" ] && EXT=".exe"; \
38-
for arch in amd64 arm64; do \
39-
GOOS=$$os GOARCH=$$arch CGO_ENABLED=0 go build -o dist/$(NAME)-$$os-$$arch$$EXT .; \
40-
done; \
38+
GOOS=$$os CGO_ENABLED=0 go build -a -tags netgo -installsuffix netgo $(LDFLAGS) -o dist/$(NAME)-$$os$$EXT .; \
4139
done
4240

4341
.PHONY: deps

‎README.md‎

Lines changed: 15 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@ By default the tool creates the session name - which can be audited including th
1616

1717
- Even though a datadir is created to store the chromium session data it is advised to still open settings and save the username/password manually the first time you are presented with the login screen.
1818

19+
- Some login forms if not done correctly according to chrome specs and do not specify `type` on the HTML tag with `username` Chromium will not pick it up
20+
1921
## Install
2022

2123
Download from [Releases page](https://github.com/dnitsch/aws-cli-auth/releases).
@@ -30,22 +32,24 @@ sudo mv aws-cli-auth /usr/local/bin
3032

3133
## Usage
3234

33-
```bash
34-
CLI tool for retrieving AWS temporary credentials using SAML providers.
35+
```
36+
CLI tool for retrieving AWS temporary credentials using SAML providers, or specified method of retrieval - i.e. force AWS_WEB_IDENTITY.
37+
Useful in situations like CI jobs or containers where multiple env vars might be present.
3538
Stores them under the $HOME/.aws/credentials file under a specified path or returns the crednetial_process payload for use in config
3639
3740
Usage:
3841
aws-cli-auth [command]
3942
4043
Available Commands:
41-
completion Generate the autocompletion script for the specified shell
42-
help Help about any command
43-
saml Get AWS credentials and out to stdout
44+
aws-cli-auth Clears any stored credentials in the OS secret store
45+
completion Generate the autocompletion script for the specified shell
46+
help Help about any command
47+
saml Get AWS credentials and out to stdout
48+
specific Initiates a specific crednetial provider [WEB_ID]
4449
4550
Flags:
4651
--cfg-section string config section name in the yaml config file
4752
-h, --help help for aws-cli-auth
48-
-k, --kill-rod If aws-cli-auth exited improprely in a previous run there is a chance that there could be hanging processes left over - this will clean them up forcefully
4953
-r, --role string Set the role you want to assume when SAML or OIDC process completes
5054
-s, --store-profile By default the credentials are returned to stdout to be used by the credential_process. Set this flag to instead store the credentials under a named profile section
5155
@@ -54,9 +58,7 @@ Use "aws-cli-auth [command] --help" for more information about a command.
5458

5559
### SAML
5660

57-
58-
59-
```bash
61+
```
6062
Get AWS credentials and out to stdout through your SAML provider authentication.
6163
6264
Usage:
@@ -119,9 +121,12 @@ credential_process=aws-cli-auth saml -p https://your-idp.com/idp/foo?PARTNER=urn
119121

120122
Notice the missing `-s` | `--store-profile` flag
121123

124+
### Use in CI
125+
126+
122127
## Licence
123128
WFTPL
124129

125-
## Acknowldgements
130+
## Acknowledgements
126131
- [Hiroyuki Wada](https://github.com/wadahiro) [package](https://github.com/openstandia/aws-cli-oidc)
127132
- [Mark Wolfe](https://github.com/wolfeidau) [package](https://github.com/Versent/saml2aws)

‎cmd/clear.go‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
package cmd
2+
3+
import (
4+
"github.com/dnitsch/aws-cli-auth/internal/util"
5+
"github.com/dnitsch/aws-cli-auth/internal/web"
6+
"github.com/spf13/cobra"
7+
)
8+
9+
var (
10+
force bool
11+
clearCmd = &cobra.Command{
12+
Use: "aws-cli-auth clear-cache",
13+
Short: "Clears any stored credentials in the OS secret store",
14+
Run: clear,
15+
}
16+
)
17+
18+
func init() {
19+
cobra.OnInitialize(initConfig)
20+
clearCmd.PersistentFlags().BoolVarP(&force, "force", "f", false, "If aws-cli-auth exited improprely in a previous run there is a chance that there could be hanging processes left over - this will clean them up forcefully")
21+
rootCmd.AddCommand(clearCmd)
22+
}
23+
24+
func clear(cmd *cobra.Command, args []string) {
25+
if force {
26+
if err := web.ClearCache(); err != nil {
27+
util.Exit(err)
28+
}
29+
util.Writeln("Chromium Cache cleared")
30+
}
31+
util.Clear()
32+
33+
}

‎cmd/root.go‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,8 +16,9 @@ var (
1616
killHangingProcess bool
1717
rootCmd = &cobra.Command{
1818
Use: "aws-cli-auth",
19-
Short: "CLI tool for retrieving AWS temporary credentials using SAML providers",
20-
Long: `CLI tool for retrieving AWS temporary credentials using SAML providers.
19+
Short: "CLI tool for retrieving AWS temporary credentials",
20+
Long: `CLI tool for retrieving AWS temporary credentials using SAML providers, or specified method of retrieval - i.e. force AWS_WEB_IDENTITY.
21+
Useful in situations like CI jobs or containers where multiple env vars might be present.
2122
Stores them under the $HOME/.aws/credentials file under a specified path or returns the crednetial_process payload for use in config`,
2223
}
2324
)
@@ -33,7 +34,7 @@ func init() {
3334
rootCmd.PersistentFlags().StringVarP(&role, "role", "r", "", "Set the role you want to assume when SAML or OIDC process completes")
3435
rootCmd.PersistentFlags().StringVarP(&cfgSectionName, "cfg-section", "", "", "config section name in the yaml config file")
3536
rootCmd.PersistentFlags().BoolVarP(&storeInProfile, "store-profile", "s", false, "By default the credentials are returned to stdout to be used by the credential_process. Set this flag to instead store the credentials under a named profile section")
36-
rootCmd.PersistentFlags().BoolVarP(&killHangingProcess, "kill-rod", "k", false, "If aws-cli-auth exited improprely in a previous run there is a chance that there could be hanging processes left over - this will clean them up forcefully")
37+
// rootCmd.PersistentFlags().BoolVarP(&killHangingProcess, "kill-rod", "k", false, "If aws-cli-auth exited improprely in a previous run there is a chance that there could be hanging processes left over - this will clean them up forcefully")
3738
}
3839

3940
func initConfig() {

‎cmd/saml.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
package cmd
22

33
import (
4+
"github.com/dnitsch/aws-cli-auth/internal/auth"
45
"github.com/dnitsch/aws-cli-auth/internal/config"
5-
"github.com/dnitsch/aws-cli-auth/internal/saml"
66
"github.com/spf13/cobra"
77
)
88

@@ -38,6 +38,6 @@ func getSaml(cmd *cobra.Command, args []string) {
3838
BaseConfig: config.BaseConfig{StoreInProfile: storeInProfile, Role: role, CfgSectionName: cfgSectionName, DoKillHangingProcess: killHangingProcess},
3939
}
4040

41-
saml.GetSamlCreds(conf)
41+
auth.GetSamlCreds(conf)
4242

4343
}

‎cmd/specific.go‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
package cmd
2+
3+
import (
4+
"fmt"
5+
"os"
6+
7+
"github.com/dnitsch/aws-cli-auth/internal/auth"
8+
"github.com/dnitsch/aws-cli-auth/internal/config"
9+
"github.com/dnitsch/aws-cli-auth/internal/util"
10+
"github.com/spf13/cobra"
11+
)
12+
13+
var (
14+
method string
15+
specificCmd = &cobra.Command{
16+
Use: "specific <flags>",
17+
Short: "Initiates a specific crednetial provider [WEB_ID]",
18+
Run: specific,
19+
}
20+
)
21+
22+
// var strategy map[string]func
23+
24+
func init() {
25+
specificCmd.PersistentFlags().StringVarP(&method, "method", "m", "", "If aws-cli-auth exited improprely in a previous run there is a chance that there could be hanging processes left over - this will clean them up forcefully")
26+
rootCmd.AddCommand(specificCmd)
27+
}
28+
29+
func specific(cmd *cobra.Command, args []string) {
30+
var awsCreds *util.AWSCredentials
31+
var err error
32+
if method != "" {
33+
switch method {
34+
case "WEB_ID":
35+
36+
awsCreds, err = auth.LoginAwsWebToken(os.Getenv("USER"))
37+
if err != nil {
38+
util.Exit(err)
39+
}
40+
default:
41+
util.Exit(fmt.Errorf("Unsupported Method: %s", method))
42+
}
43+
}
44+
config := config.SamlConfig{BaseConfig: config.BaseConfig{StoreInProfile: storeInProfile}}
45+
46+
util.SetCredentials(awsCreds, config)
47+
}

‎internal/auth/awssts.go‎

Lines changed: 87 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
package auth
2+
3+
import (
4+
"fmt"
5+
"os"
6+
7+
"github.com/aws/aws-sdk-go/aws"
8+
"github.com/aws/aws-sdk-go/aws/session"
9+
"github.com/aws/aws-sdk-go/service/sts"
10+
"github.com/dnitsch/aws-cli-auth/internal/config"
11+
"github.com/dnitsch/aws-cli-auth/internal/util"
12+
"github.com/pkg/errors"
13+
)
14+
15+
// AWSRole aws role attributes
16+
type AWSRole struct {
17+
RoleARN string
18+
PrincipalARN string
19+
Name string
20+
}
21+
22+
// LoginStsSaml exchanges saml response for STS creds
23+
func LoginStsSaml(samlResponse string, role *util.AWSRole) (*util.AWSCredentials, error) {
24+
sess, err := session.NewSession()
25+
if err != nil {
26+
return nil, errors.Wrap(err, "Failed to create session")
27+
}
28+
29+
svc := sts.New(sess)
30+
31+
params := &sts.AssumeRoleWithSAMLInput{
32+
PrincipalArn: aws.String(role.PrincipalARN), // Required
33+
RoleArn: aws.String(role.RoleARN), // Required
34+
SAMLAssertion: aws.String(samlResponse), // Required
35+
DurationSeconds: aws.Int64(3600),
36+
}
37+
38+
resp, err := svc.AssumeRoleWithSAML(params)
39+
if err != nil {
40+
return nil, errors.Wrap(err, "Failed to retrieve STS credentials using SAML")
41+
}
42+
43+
return &util.AWSCredentials{
44+
AWSAccessKey: aws.StringValue(resp.Credentials.AccessKeyId),
45+
AWSSecretKey: aws.StringValue(resp.Credentials.SecretAccessKey),
46+
AWSSessionToken: aws.StringValue(resp.Credentials.SessionToken),
47+
PrincipalARN: aws.StringValue(resp.AssumedRoleUser.Arn),
48+
Expires: resp.Credentials.Expiration.Local(),
49+
}, nil
50+
}
51+
52+
func LoginAwsWebToken(username string) (*util.AWSCredentials, error) {
53+
// var role string
54+
sess, err := session.NewSession()
55+
if err != nil {
56+
return nil, errors.Wrap(err, "Failed to create session")
57+
}
58+
59+
svc := sts.New(sess)
60+
r, exists := os.LookupEnv(config.AWS_ROLE_ARN)
61+
if !exists {
62+
util.Exit(fmt.Errorf("Role Var Not Found"))
63+
}
64+
token, err := util.GetWebIdTokenFileContents()
65+
if err != nil {
66+
util.Exit(err)
67+
}
68+
sessionName := util.SessionName(username, config.SELF_NAME)
69+
input := &sts.AssumeRoleWithWebIdentityInput{
70+
RoleArn: &r,
71+
RoleSessionName: &sessionName,
72+
WebIdentityToken: &token,
73+
}
74+
75+
resp, err := svc.AssumeRoleWithWebIdentity(input)
76+
if err != nil {
77+
return nil, errors.Wrap(err, "Failed to retrieve STS credentials using SAML")
78+
}
79+
80+
return &util.AWSCredentials{
81+
AWSAccessKey: aws.StringValue(resp.Credentials.AccessKeyId),
82+
AWSSecretKey: aws.StringValue(resp.Credentials.SecretAccessKey),
83+
AWSSessionToken: aws.StringValue(resp.Credentials.SessionToken),
84+
PrincipalARN: aws.StringValue(resp.AssumedRoleUser.Arn),
85+
Expires: resp.Credentials.Expiration.Local(),
86+
}, nil
87+
}

internal/saml/saml.go renamed to internal/auth/saml.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
package saml
1+
package auth
22

33
import (
44
"fmt"

‎internal/config/config.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
package config
22

33
const SELF_NAME = "aws-cli-auth"
4+
const WEB_ID_TOKEN_VAR = "AWS_WEB_IDENTITY_TOKEN_FILE"
5+
const AWS_ROLE_ARN = "AWS_ROLE_ARN"
46

57
type BaseConfig struct {
68
Role string

‎internal/saml/awssts.go‎

Lines changed: 0 additions & 45 deletions
This file was deleted.

0 commit comments

Comments
 (0)