Package: tokendito
TokenditoGenerate temporary AWS credentials via Okta.Usetokenditoto generate temporary AWS credentials via Okta for
programmatic authentication to AWS. Tokendito signs you into Okta and
uses your existing AWS integration to broker a SAML assertion into
your AWS accounts, returningSTStokens into your local~/.aws/credentialsfile.What's newSeeReleasesfor a detailed Changelog.Tokendito 2.4.0Version 2.4.0 of Tokendito introduces the following new features:Add support for Okta question MFA.Many bug fixes and contributions.Tokendito 2.3.0Version 2.3.0 of Tokendito introduces the following new features:Basic OIE support while forcing Classic mode.Support for saving the Device Token ID for later reuse.Misc bug fixesNote: This feature currently works with locally enabled OIE organizations, but it does not for Organizations with chained Authentication in mixed OIE/Classic environments.Tokendito 2.2.0Version 2.2.0 of Tokendito introduces the following new features:Shared HTTP Client to leverage keepalives and Python's connection pool (by @fsilvamaia)Support for Step-Up Authorization (by @ruhulio)Misc bug fixesTokendito 2.1.0Version 2.1.0 of Tokendito introduces the following new features:IdP redirectionDocker support (by @opis-mark)Interactive support for AWS profile names (by @opis-mark)Docker container signing to ensure you are on a 'certified' Tokendito containerMisc bug fixesTokendito 2.0.0With the release of tokendito 2.0, many changes and fixes were introduced.It is a breaking release: your configuration needs to be updated, the command line arguments have changed, and support for Python < 3.7 has been removed.
The following changes are part of this release:Set the config file to be platform dependent, and follow the XDG standard.Extend configuration capabilities.Modernize output.Change the MFA method from strict match to partial match.Mask secrets from output logs.Automatically discover AWS URLs.Fix authentication with DUO.Add support for setting the logging level via both the INI file and ENV vars.Add support for Python 3.9, 3.10, and 3.11.And many fixes.Consultadditional notesfor how to use tokendito.RequirementsPython 3.7+, or a working Docker environmentAWS account(s) federated with OktaTokendito is compatible with Python 3 and can be installed with either
pip or pip3.Getting startedInstall (via PyPi):pip install tokenditoRuntokendito --configure.Runtokendito.NOTE: Advanced users may shorten thetokenditointeraction to asingle
command.Have multiple Okta tiles to switch between? View ourmulti-tile
guide.DockerUsing Docker eliminates the need to install tokendito and its requirements. We are providing experimental Docker image support inDockerhubRunning the container imageRun tokendito with thedocker runcommand. Tokendito supportsDCT, and we encourage you to enforce image signature validation before running any containers.exportDOCKER_CONTENT_TRUST=1thendockerrun--rm-ittokendito/tokendito--versionYou must map a volume in the Docker command to allow tokendito to write AWS credentials to your local filesystem for use.  This is done with the-vflag.  SeeDocker documentationfor help setting the syntax.  The following directories are used by tokendito and should be considered when mapping volumes:/app/.aws/(AWS credential storage)/app/.config/tokendito/(tokendito profile storage)These can be covered by mapping a single volume to both the host and container users' home directories (/appis the home directory in the container and must be explicitly defined).  You may also map multiple volumes if you have custom configuration locations and require granularity.Be sure to set the-itflags to enable an interactive terminal session.On Windows, you can do the following:dockerrun--rm-it-v"%USERPROFILE%\.aws":/app/.aws-v"%USERPROFILE%\.config":/app/.configtokendito/tokenditoIn a Mac OS system, you can run:dockerrun--rm-it-v"$HOME/.aws":/app/.aws-v"$HOME/.config":/app/.configtokendito/tokenditoOn a Linux system, however, you must specify the user and group IDs for the mount mappings to work as expected.
Additionally the mount points within the container move to a different location:dockerrun--user$(id-u):$(id-g)--rm-it-v"$HOME/.aws":/.aws-v"$HOME/.config":/.configtokendito/tokenditoTokendito command line arguments are supported as well.NOTE: In the following examples the entire home directory is exported for simplicity. This is not recommended as it exposes too much data to the running container:dockerrun--rm-it-v"$HOME":/tokendito/tokendito\--okta-tilehttps://acme.okta.com/home/amazon_aws/000000000000000000x0/123\--usernameusername@example.com\--okta-mfapush\--aws-outputjson\--aws-regionus-east-1\--aws-profilemy-profile-name\--aws-role-arnarn:aws:iam::000000000000:role/role-name\Tokendito profiles are supported while using containers provided the proper volume mapping exists.dockerrun--rm-ti-v"$HOME":/apptokendito/tokendito\--profilemy-profile-nameTips, tricks, troubleshooting, examples, and more docs arehereContributions are welcome!