Package: aws-okta-keyman
AWS Okta KeymanThis is a simple command-line tool for logging into Okta and generating
temporary Amazon AWS Credentials. This tool makes it easy and secure to
generate short-lived,logged and user-attributedcredentials that can be
used for any of the Amazon SDK libraries or CLI tools.FeaturesKey features listed here. Keep scrolling for more details.MFA supportMultiple AWS role supportAutomatic reup/refresh modeDynamic AWS/Okta integration listAutomatic username selectionOkta password cachingCommand wrappingScreen/shell only outputGovCloud supportAdjustable key lifetimeConsole login URLsConfig filesInteractive config generationInstallation via pip and HomebrewLinux, Windows, and OSX supportBenefits vs other similar tools:Runs without external dependencies; no servers or lambdas requiredNo API keys required; just your Okta username and passwordNo analytics or metrics collection; this tool doesnotcall home in any wayOpen source distributed as source; you can see what you're runningWide Python version support; works on Python 3.6+Optional MFA AuthenticationIf your organization or integration requires MFA we will automatically detect that
requirement during authentication and prompt the user to complete the
Multi Factor Authentication.In particular, there is support for standard passcode based auth, as well as
support forOkta Verify with PushandDuo Auth. If both
are available, Okta Verify with Push will be prioritized and a push notification isautomatically sent to the user. If the user declines the validation, then
optionally the Passcode can be entered in manually.For Duo Auth Duo wants you to use a web page to load their iframe to pick your factor
and then move forward from there. That is one option and the one most likely to keep
working. This tool now also has an alternative browserless option that attempts to
use Duo for MFA without a browser. This may eventually be stopped/prevented by Duo
but makes this tool work on remote servers or in any other case where you may not
be able to use a browser.Supported MFA SolutionsOkta VerifyDuo Auth (push, call, or OTP via CLI)Duo Auth (push, call, or OTP via web browser)Okta OTPGoogle Auth OTPSMS OTPCall OTPQuestion/AnswerWindows Hello, U2F, email, and physical token (RSA, Symantec) are not supported
at this time.Multiple AWS RolesAWS Okta Keyman supports multiple AWS roles when configured. The user is prompted to
select the role they wish to use before the temporary keys are generated.Re-Up Mode .. Automatic Credential Re-GenerationAmazon IAM defaults to Federated Login sessions that last up to1 hour. For
developers, it can be painful to re-authenticate every hour during your work
day. This is made much worse if your organization requires MFA on each login.You may run the AWS Okta Keyman in "reup" mode to get around this. The tool
will continue to run in a sleep loop periodically reaching out to Okta,
generating a new SAML Assertion, and then generating updated Amazon AWS
credentials. This can run for as long as your Okta administrator has allowed
your Login Session to be - often a full work day.In the case of application-level MFA you will be prompted every 50 minutes or
so to complete the MFA again.See the--reupcommandline option for help here!AWS Accounts from OktaAWS Okta Keyman can pull the AWS Accounts that have been assigned from Okta
itself which means the app ID value no longer needs to be provided in the
command line or in the config file. A config file can still optionally be used
to ensure account names or order if preferred. This means with no configuration
saved you only need to provide your organization.Automatic UsernameAWS Okta Keyman will use the current user as the username for Okta
authentication if no username has been provided.Keyring Password CacheAWS Okta Keyman can use your local keyring to store your Okta password to allow you to
run the tool repeatedly without needing to type your password in each time. For details on how this
is accomplished check outkeyring.aws_okta_keyman -P    # Enable the password cache
aws_okta_keyman -R    # Reset the cached password in case of mistaken entry or password changeCommand WrappingCommand wrapping provides a simple way to execute any command you would like directly from
Keyman where the AWS access key environment variables will be provided when starting the
command. An example of this is provided here:$ aws_okta_keyman --command "echo \$AWS_ACCESS_KEY_ID"

----snip----

14:07:17   (INFO) Wrote profile "default" to /home/nathan/.aws/credentials 💾
14:07:17   (INFO) Current time is 2020-01-10 22:07:17.027964
14:07:17   (INFO) Session expires at 2020-01-10 23:07:16+00:00 ⏳
14:07:17   (INFO) Running requested command...


AXXXXXXXXXXXXXXXXXXXScreen-only Key OutputScreen-only output for cases were the key needs to be copied
elsewhere for use. This makes using the temporary keys in other apps simpler and easier.
They will not be written out to the AWS credentials file when this option is specified.$ aws_okta_keyman --screen

----snip----

14:14:04   (INFO) Assuming role: arn:aws:iam::1234567890:role/Admin
14:14:04   (INFO) AWS Credentials:

AWS_ACCESS_KEY_ID = AXXXXXXXXXXXXXXXXXXX
AWS_SECRET_ACCESS_KEY = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
AWS_SESSION_TOKEN = xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

14:14:04 (INFO) All done! 👍GovCloud SupportAWS Okta Keyman now works with AWS GovCloud. Use the--regioncommand-line option
to specify the AWS region to get the keys from.Preferred Key DurationYou can set a key lifetime other than the default 1 hour by setting--durationwhen calling Keyman.
If AWS rejects the request for a longer duration the default 1 hour will be used instead. You can request
key durations from a minimum of 15 minutes (900 seconds) or up to 12 hours (43200 seconds). These
limits are enforced by AWS and are not a limitation of Keyman.AWS Console LoginsAWS Console login links can optionally be generated when yo request keys with Keyman.
The console login link will be output on the screen for you to use. Just provide the--consoleparameter when running Keyman.Config file .. predefined settings for you or your orgThe config file, which defaults to~/.config/aws_okta_keyman.yml, allows you to
pre-set things like your username, Okta organization name (subdomain), and AWS accounts
and App IDs to make this script simpler to use. This also supports username assumption
based on the current user when the username or email is configured asautomatic-usernameif usernames only are an option orautomatic-username@example.comif you need full emails. Arguments will always
be preferred to the config file so you can override what's in the config file
as needed on each run of the tool.Example config file:username:automatic-username@example.comorg:exampleaccounts:-name:Devappid:exampleAppIDFromOkta/234-name:Prodappid:exampleAppIDFromOkta/345When used you'll get a similar interface to AWS Role selection but for your AWS
accounts.Interactive ConfigurationFor interactive configuration and creation of the config file you can start the tool with just config as a parameter and you will be propted to provide the basic information needed to get started. An example of this is shown here:$ aws_okta_keyman config
14:21:41   (INFO) AWS Okta Keyman 🔐 v0.7.0
14:21:41   (INFO) Interactive setup requested

What is your Okta Organization subdomain?
Example; for https://co.okta.com enter 'co'

Okta org: example

What is your Okta user name?
If it is nathan you can leave this blank.

Username: nathan.v

Next we can optionally configure your AWS integrations. This is not
required as the AWS integrations can be picked up automatically from
Okta. If you would prefer to list only specific integrations or prefer
to specify the friendly names yourself you can provide the following
information. You will be prompted to continue providing integration
details until you provide a blank response to the app ID. If you are
unsure how to answer these questions just leave the app ID blank.

What is your AWS integration app ID?
Example; 0oaciCSo1d8/123
App ID: 0oaciCSo1d8/123

Please provide a friendly name for this app.
App ID: AWS Prod

What is your AWS integration app ID?
Example; 0oaciCSo1d8/123
App ID:

14:21:58   (INFO) Config file written. Please rerun KeymanPython VersionsPython 2.7.4+ and Python 3.5.0+ are supported.Support for older Python versions will be maintained as long as is reasonable.
Before support is removed a reminder/warning will be provided.UsageClient SetupMac OS Installationbrew tap nathan-v/aws-okta-keymanand thenbrew install aws_okta_keyman.Or install via URL (which will not receive updates):brew install https://raw.githubusercontent.com/nathan-v/homebrew-aws-okta-keyman/master/Formula/aws_okta_keyman.rbLinux or Windows InstallationBefore you can install this tool you need to have a working Python installation with pip.
If you're not sure if you have this a good place to start would be thePython Beginner's Guide.Once your Python environment is configured simply runpip install aws-okta-keymanto install the tool.Running AWS Okta KeymanFor detailed usage instructions, see the--helpcommandline argument.Typical usage:$ aws_okta_keyman
16:48:22   (INFO) AWS Okta Keyman 🔐 v0.7.0
Password:

16:48:31   (INFO) Using factor: 📲 Duo Push
16:48:33   (WARNING) Duo required; check your phone... 📱
16:48:40   (INFO) Waiting for MFA success...
16:48:41   (INFO) Successfully authed Nathan V
16:48:41   (WARNING) No app ID provided; select from available AWS accounts

    Account
[0] AWS - Sandbox
[1] AWS - Development
[2] AWS - Staging
[3] AWS - Integration
[4] AWS - Production
Selection: 4

16:48:47   (INFO) Using account: AWS - Production / exampleAppIDFromOkta/123
16:48:47   (INFO) Getting SAML Assertion from example
16:48:48   (WARNING) Multiple AWS roles found; please select one

    Account          Role
[0] example-prod     Admin
[1] example-prod     Dev
Selection: 0

16:48:51   (INFO) Getting SAML Assertion from example
16:48:51   (INFO) Assuming role: arn:aws:iam::1234567890:role/Admin
16:48:52   (INFO) Wrote profile "default" to /home/nathan/.aws/credentials 💾
16:48:52   (INFO) Current time is 2019-11-08 00:48:52.265393
16:48:52   (INFO) Session expires at 2019-11-08 01:48:52+00:00 ⏳
16:48:52   (INFO) All done! 👍TroubleshootingTroubleshooting information is available on the project Githubwiki.Okta SetupBefore you can use this tool, your Okta administrator needs to set upAmazon/Okta integrationusing SAML roles.BackgroundThis is a hard fork ofnd_okta_authbyNextdoor.com, Inc..
I decided to move ahead this way as I wanted to be able to move quickly and add
features independently of the existing implementation. A big thank you to @diranged
for the original work that this comes from.The original code is heavily based on the previous work done byThoughtWorksIncon theirOktaAuthandAWS Role
Credentialstools.Developer InfoSee CONTRIBUTING.md for more information on contributing to this project.LicenseCopyright 2020 Nathan VCopyright 2018 Nextdoor.com, IncLicensed under the Apache License, Version 2.0. See LICENSE.txt file for details.Some code inaws_okta_keyman/okta.py,aws_okta_keyman/aws.py,aws_okta_keyman/aws_saml.py, andaws_okta_keyman/test/aws_saml_test.pyis
distributed under MIT license. See the source files for details. A copy of the
license is in the LICENSE_MIT.txt file.