Skip to content

New Parameter DurationSeconds #11

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
thomasmkt wants to merge 2 commits into
base: master
Choose a base branch
from
Open

New Parameter DurationSeconds #11

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a4f25f8
added ability to set durationSeconds as parameter
thomasmkt May 28, 2019
aff07ec
added ability to set durationSeconds as parameter
thomasmkt May 29, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 5 additions & 4 deletions cmd/assumeRole.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,12 +7,13 @@ import (
"github.com/pkg/errors"
)

func assumeRole(sess *session.Session, arn *Arn, assertion string) error {
func assumeRole(sess *session.Session, arn *Arn, assertion string, durationSeconds int64) error {
svc := sts.New(sess)
params := &sts.AssumeRoleWithSAMLInput{
PrincipalArn: aws.String(arn.principal),
RoleArn: aws.String(arn.role),
SAMLAssertion: aws.String(assertion),
PrincipalArn: aws.String(arn.principal),
RoleArn: aws.String(arn.role),
SAMLAssertion: aws.String(assertion),
DurationSeconds: aws.Int64(durationSeconds),
}
resp, err := svc.AssumeRoleWithSAML(params)
if err != nil {
Expand Down
10 changes: 5 additions & 5 deletions cmd/awsToken.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@ type (
)

//ExtractRoles from the saml single sign on response
func ExtractRoles(saml *Saml, cache *AccountAliasCache) (arns []Arn, err error) {
func ExtractRoles(saml *Saml, cache *AccountAliasCache, durationSeconds int64) (arns []Arn, err error) {
var xml []byte
xml, err = saml.AsXML()
if err != nil {
Expand All @@ -43,7 +43,7 @@ func ExtractRoles(saml *Saml, cache *AccountAliasCache) (arns []Arn, err error)
if err != nil {
return arns, err
}
lookupAccountAliases(arns, saml.AsAssertion(), cache)
lookupAccountAliases(arns, saml.AsAssertion(), cache, durationSeconds)
return arns, err
}

Expand Down Expand Up @@ -89,7 +89,7 @@ func (a AttributeValue) arns() []Arn {
return result
}

func lookupAccountAliases(arns []Arn, assertion string, cache *AccountAliasCache) {
func lookupAccountAliases(arns []Arn, assertion string, cache *AccountAliasCache, durationSeconds int64) {
// fix: arn changes do no leave this func
for i, arn := range arns {
alias, found := cache.findAlias(arn.role)
Expand All @@ -100,7 +100,7 @@ func lookupAccountAliases(arns []Arn, assertion string, cache *AccountAliasCache
clearCredentials()

sess := session.New()
err := assumeRole(sess, &arn, assertion)
err := assumeRole(sess, &arn, assertion, durationSeconds)

setCredentials(arn.accessKeyID, arn.secretAccessKey, arn.sessionToken)

Expand All @@ -118,7 +118,7 @@ func lookupAccountAliases(arns []Arn, assertion string, cache *AccountAliasCache
} else {
// Print the error, cast err to awserr.Error to get the Code and
// Message from an error.
journal("Unable to resolve account alias", err.Error())
Copy link
Owner

@NearlyUnique NearlyUnique Jun 4, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why don't you keep the error?

Copy link
Author

@thomasmkt thomasmkt Jul 11, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It was my first try to use go and my IDE said that there are to much Parameters used in method journal, so I deleted it ;-)

journal("Unable to resolve account alias")
}
// return
continue
Expand Down
8 changes: 6 additions & 2 deletions cmd/logon.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,11 +31,13 @@ func init() {
logonCmd.Flags().StringP("role", "r", "", "Role to auto select, if one one role available it is auto selected")

logonCmd.Flags().Bool("token", false, "If set the token is displayed (useful for tools that don't use aws credentials file)")
logonCmd.Flags().Int64("durationSeconds", 3600, "Use to define the duration of session validity in seconds")

bindFlags(RootCmd, "logon")
}

func execLogon(cmd *cobra.Command, args []string) {

uri := viper.GetString("url")

if len(uri) == 0 {
Expand All @@ -58,13 +60,15 @@ func execLogon(cmd *cobra.Command, args []string) {
cache, close := loadCache()
defer close()

arns, err := ExtractRoles(saml, cache)
durationSeconds := viper.GetInt64("durationSeconds")

arns, err := ExtractRoles(saml, cache, durationSeconds)
fatalExit(err, "Extracting roles")
arn, err := SelectRole(viper.GetString("role"), arns)
fatalExit(err, "Role selection")

if !arn.hasCredentials() {
assumeRole(session.New(), arn, saml.AsAssertion())
assumeRole(session.New(), arn, saml.AsAssertion(), durationSeconds)
}
if viper.GetBool("token") {
fmt.Printf("AWS_SESSION_TOKEN=%s\n", arn.sessionToken)
Expand Down
3 changes: 1 addition & 2 deletions cmd/single_signon_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,10 @@
package cmd_test

import (
"github.com/NearlyUnique/awsSts/cmd"
"net/http"
"net/http/httptest"
"testing"

"github.com/NearlyUnique/awsSts/cmd"
Copy link
Owner

@NearlyUnique NearlyUnique Jun 4, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I thought it was more common to use std pks at the top then others?

Copy link
Author

@thomasmkt thomasmkt Jul 11, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It was my first try to use go ;-)

)

const (
Expand Down
2 changes: 1 addition & 1 deletion cmd/utils.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -103,7 +103,7 @@ func fileMustExist(filePath string) {
if err == nil {
f.Close()
} else {
fatalExitf(err, "Failed to create required file", filePath)
Copy link
Owner

@NearlyUnique NearlyUnique Jun 4, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why ignore the extra filePath info?

Copy link
Author

@thomasmkt thomasmkt Jul 11, 2019

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It was my first try to use go and my IDE said that there are to much Parameters used in method fatalExitf, so I deleted it ;-)

fatalExitf(err, "Failed to create required file")
}
}

Expand Down
2 changes: 1 addition & 1 deletion cmd/ver.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
package cmd

const _VERSION = "v0.8"
const _VERSION = "v0.9"
3 changes: 2 additions & 1 deletion readme.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,9 +27,10 @@ Common scenario;
- My other scripts are going to use the `default` AWS profile
- Automatically select the role `arn:aws:iam::123456789:role/my-role`
- Leave running in a state where I can `auto`matically refresh my token with one key press when it expires in an hour
- Set the validity of the session (depending on thresholds of your aws user role) in Seconds, default 3600

```
awsSts logon --url https://sts.domain.company.org/adfs/ls/IdpInitiatedSignOn.aspx?loginToRp=urn:amazon:webservices --profile default --role arn:aws:iam::123456789:role/my-role
awsSts logon --url https://sts.domain.company.org/adfs/ls/IdpInitiatedSignOn.aspx?loginToRp=urn:amazon:webservices --profile default --role arn:aws:iam::123456789:role/my-role --durationSeconds 3600
```

`--help` for full details, including details of all parameters that can be read from environment.
Expand Down