Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow writing to default credential file for credential process mode #1377

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Allow writing to default credential file for credential process mode #1377

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 5 additions & 4 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -833,22 +833,23 @@ DUMP_CONTENT=true saml2aws login --verbose
[Credential Process](https://github.com/awslabs/awsprocesscreds) is a convenient way of interfacing credential providers with the AWS Cli.

You can use `saml2aws` as a credential provider by simply configuring it and then adding a profile to the AWS configuration. `saml2aws` has a flag `--credential-process` generating an output with the right JSON format, as well as a flag `--quiet` that will block the logging from being displayed.
The AWS credential file (typically ~/.aws/credentials) has precedence over the credential_process provider. That means that if credentials are present in the file, the credential process will not trigger. To counter that you can override the aws credential location of `saml2aws` to another file using `--credential-file` or specifying it during `configure`.

The AWS credential file (typically ~/.aws/credentials) has precedence over the credential_process provider. That means that if credentials are present in the file, the credential process will not trigger.
When using credential_process, avoid using the same profile name for both AWS config and saml2aws credentials with
the default --credential-file. This can cause refresh issues as the AWS credential file (typically ~/.
aws/credentials) has precedence over the credential_process provider. Ensure either a different profile name via `--profile` is used or override the aws credential location of `saml2aws` to another file using `--credential-file` or specifying it during `configure`.

An example of the aws configuration (`~/.aws/config`):

```
[profile mybucket]
region = us-west-1
credential_process = saml2aws login --credential-process --role <ROLE> --profile mybucket
credential_process = saml2aws login --credential-process --role <ROLE> --profile mybucket-credentials
```

You can add this manually or via the awscli, i.e.

```
aws configure set credential_process "saml2aws login --credential-process --role <ROLE> --profile mybucket"
aws configure set credential_process "saml2aws login --credential-process --role <ROLE> --profile mybucket-credetials"
```

When using the aws cli with the `mybucket` profile, the authentication process will be run and the aws will then be executed based on the returned credentials.
Expand Down
22 changes: 5 additions & 17 deletions cmd/saml2aws/commands/login.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -142,30 +142,18 @@ func Login(loginFlags *flags.LoginExecFlags) error {
return errors.Wrap(err, "Error logging into AWS role using SAML assertion.")
}

err = saveCredentials(awsCreds, sharedCreds)
if err != nil {
return err
}

// print credential process if needed
if loginFlags.CredentialProcess {
err = PrintCredentialProcess(awsCreds)
if err != nil {
return err
}
// Check if a custom credential file is used
customCredentialsFile, err := CustomCredentialsFile(sharedCreds.Filename)
if err != nil {
return err
}
// If a custom credential file is used then save credentials. This allows for autorefreshing of credentials, which is not supported with the default credential file. See https://github.com/Versent/saml2aws/issues/895
if customCredentialsFile {
err = saveCredentials(awsCreds, sharedCreds)
if err != nil {
return err
}
}
} else {
err = saveCredentials(awsCreds, sharedCreds)
if err != nil {
return err
}

log.Println("Logged in as:", awsCreds.PrincipalARN)
log.Println("")
log.Println("Your new access key pair has been stored in the AWS configuration.")
Expand Down
Loading