Repository: Versent/saml2aws
Pull request #226 (2018-09-27 19:54:28)

add support for role configured in the ini


Patch:
diff --git a/cmd/saml2aws/commands/login.go b/cmd/saml2aws/commands/login.go
index bfb414f..7d7bddf 100644
--- a/cmd/saml2aws/commands/login.go
+++ b/cmd/saml2aws/commands/login.go
@@ -79,7 +79,7 @@ func Login(loginFlags *flags.LoginExecFlags) error {
 		return errors.Wrap(err, "error storing password in keychain")
 	}
 
-	role, err := selectAwsRole(samlAssertion, loginFlags)
+	role, err := selectAwsRole(samlAssertion, account)
 	if err != nil {
 		return errors.Wrap(err, "Failed to assume role, please check you are permitted to assume the given role for the AWS service")
 	}
@@ -162,7 +162,7 @@ func resolveLoginDetails(account *cfg.IDPAccount, loginFlags *flags.LoginExecFla
 	return loginDetails, nil
 }
 
-func selectAwsRole(samlAssertion string, loginFlags *flags.LoginExecFlags) (*saml2aws.AWSRole, error) {
+func selectAwsRole(samlAssertion string, account *cfg.IDPAccount) (*saml2aws.AWSRole, error) {
 	data, err := base64.StdEncoding.DecodeString(samlAssertion)
 	if err != nil {
 		return nil, errors.Wrap(err, "error decoding saml assertion")
@@ -184,15 +184,15 @@ func selectAwsRole(samlAssertion string, loginFlags *flags.LoginExecFlags) (*sam
 		return nil, errors.Wrap(err, "error parsing aws roles")
 	}
 
-	return resolveRole(awsRoles, samlAssertion, loginFlags)
+	return resolveRole(awsRoles, samlAssertion, account)
 }
 
-func resolveRole(awsRoles []*saml2aws.AWSRole, samlAssertion string, loginFlags *flags.LoginExecFlags) (*saml2aws.AWSRole, error) {
+func resolveRole(awsRoles []*saml2aws.AWSRole, samlAssertion string, account *cfg.IDPAccount) (*saml2aws.AWSRole, error) {
 	var role = new(saml2aws.AWSRole)
 
 	if len(awsRoles) == 1 {
-		if loginFlags.CommonFlags.RoleSupplied() {
-			return saml2aws.LocateRole(awsRoles, loginFlags.CommonFlags.RoleArn)
+		if account.RoleARN != "" {
+			return saml2aws.LocateRole(awsRoles, account.RoleARN)
 		}
 		return awsRoles[0], nil
 	} else if len(awsRoles) == 0 {
@@ -206,8 +206,8 @@ func resolveRole(awsRoles []*saml2aws.AWSRole, samlAssertion string, loginFlags
 
 	saml2aws.AssignPrincipals(awsRoles, awsAccounts)
 
-	if loginFlags.CommonFlags.RoleSupplied() {
-		return saml2aws.LocateRole(awsRoles, loginFlags.CommonFlags.RoleArn)
+	if account.RoleARN != "" {
+		return saml2aws.LocateRole(awsRoles, account.RoleARN)
 	}
 
 	for {
diff --git a/pkg/cfg/cfg.go b/pkg/cfg/cfg.go
index 8962c89..853ba13 100644
--- a/pkg/cfg/cfg.go
+++ b/pkg/cfg/cfg.go
@@ -42,6 +42,7 @@ type IDPAccount struct {
 	SessionDuration      int    `ini:"aws_session_duration"`
 	Profile              string `ini:"aws_profile"`
 	Subdomain            string `ini:"subdomain"` // used by OneLogin
+	RoleARN              string `ini:"role_arn"`
 }
 
 func (ia IDPAccount) String() string {
@@ -61,7 +62,8 @@ func (ia IDPAccount) String() string {
   AmazonWebservicesURN: %s
   SessionDuration: %d
   Profile: %s
-}`, appID, ia.URL, ia.Username, ia.Provider, ia.MFA, ia.SkipVerify, ia.AmazonWebservicesURN, ia.SessionDuration, ia.Profile)
+  RoleARN: %s
+}`, appID, ia.URL, ia.Username, ia.Provider, ia.MFA, ia.SkipVerify, ia.AmazonWebservicesURN, ia.SessionDuration, ia.Profile, ia.RoleARN)
 }
 
 // Validate validate the required / expected fields are set
diff --git a/pkg/flags/flags.go b/pkg/flags/flags.go
index eb0ab61..787e4f8 100644
--- a/pkg/flags/flags.go
+++ b/pkg/flags/flags.go
@@ -25,11 +25,6 @@ type CommonFlags struct {
 	Subdomain            string
 }
 
-// RoleSupplied role arn has been passed as a flag
-func (cf *CommonFlags) RoleSupplied() bool {
-	return cf.RoleArn != ""
-}
-
 // LoginExecFlags flags for the Login / Exec commands
 type LoginExecFlags struct {
 	CommonFlags *CommonFlags
@@ -76,4 +71,8 @@ func ApplyFlagOverrides(commonFlags *CommonFlags, account *cfg.IDPAccount) {
 	if commonFlags.Subdomain != "" {
 		account.Subdomain = commonFlags.Subdomain
 	}
+
+	if commonFlags.RoleArn != "" {
+		account.RoleARN = commonFlags.RoleArn
+	}
 }


Test patch:
diff --git a/cmd/saml2aws/commands/login_test.go b/cmd/saml2aws/commands/login_test.go
index 4fc480f..39c4c19 100644
--- a/cmd/saml2aws/commands/login_test.go
+++ b/cmd/saml2aws/commands/login_test.go
@@ -39,7 +39,7 @@ func TestResolveRoleSingleEntry(t *testing.T) {
 		adminRole,
 	}
 
-	got, err := resolveRole(awsRoles, "", &flags.LoginExecFlags{CommonFlags: &flags.CommonFlags{}})
+	got, err := resolveRole(awsRoles, "", cfg.NewIDPAccount())
 	assert.Empty(t, err)
 	assert.Equal(t, got, adminRole)
 }
diff --git a/pkg/flags/flags_test.go b/pkg/flags/flags_test.go
index 1a4b27e..4a1f684 100644
--- a/pkg/flags/flags_test.go
+++ b/pkg/flags/flags_test.go
@@ -7,26 +7,6 @@ import (
 	"github.com/versent/saml2aws/pkg/cfg"
 )
 
-func TestRoleSuppliedIsTrueWithNonEmptyRole(t *testing.T) {
-
-	commonFlags := &CommonFlags{RoleArn: "arn:aws:iam::456456456456/role:myrole"}
-
-	expected := true
-	actual := commonFlags.RoleSupplied()
-
-	assert.Equal(t, expected, actual)
-}
-
-func TestRoleSuppliedIsFalseWithEmptyRole(t *testing.T) {
-
-	commonFlags := &CommonFlags{RoleArn: ""}
-
-	expected := false
-	actual := commonFlags.RoleSupplied()
-
-	assert.Equal(t, expected, actual)
-}
-
 func TestOverrideAllFlags(t *testing.T) {
 
 	commonFlags := &CommonFlags{