okta-aws-cli
okta-aws-cli copied to clipboard
fix: friendly labels as args (including wildcards)
The intention of this PR is to allow the ability to supply idp and role friendly labels as args. The current implementation works if you select the idp and role interactively but when supplied as args fails as it tries to use the friendly label for the idp and the configured wildcard matcher for role.
For example you might get the error (note the friendly label for IDP and role attempting to be used)
Error: STS Assume Role With SAML API error; given idp: "My IdP", role: "arn:aws:iam::.*:role/never", error: InvalidParameter: 1 validation error(s) found.
In my first commit here I moved calling OktaConfig() up a level to promptForIdpAndRole so we could pass the config as args to the individual idp and role functions. I wrote some tests that demonstrate the issue so if you check that out you can see the test results which i'll post here a the end as well.
In order to simplify the logic I refactored the methods so that there are no string variables that may be an ARN, maybe a friendly label, or may be a configured arn with a wildcard. The common denominator here is the friendly label so all logic now chooses the friendly label then converts to the arn using the same map the prompt would use. This is safe when no friendly labels are configured as the map defaults to using the arn as the key if no friendly label is found.
The one area i'd like to call out specifically is the else-if block on the prompts where we may pretty print the selection. These are decided off the fedAppAlreadySelected
or IsProcessCredentialsFormat
properties. It wasn't immediately obvious to me what these use cases are so would appreciate some help with the comments there.
Test results prior to fix:
=== RUN TestPromptForRole/friendly_label
Role: Rock N Role
=== RUN TestPromptForRole/friendly_label_configured_but_arn_arg_supplied
Role: Rock N Role
=== RUN TestPromptForRole/friendly_label_with_wildcard
Role: Never Gonna Give You Up
webssoauth_test.go:355: expected "arn:aws:iam::123:role/never", got "arn:aws:iam::.*:role/never"
=== RUN TestPromptForRole/no_friendly_labels_arn_arg_supplied
Role: arn:aws:iam::123:role/rocknrole
=== RUN TestPromptForRole/single_arn_option_no_arg_supplied
Role: arn:aws:iam::123:role/never
--- FAIL: TestPromptForRole (0.00s)
--- PASS: TestPromptForRole/friendly_label (0.00s)
--- PASS: TestPromptForRole/friendly_label_configured_but_arn_arg_supplied (0.00s)
--- FAIL: TestPromptForRole/friendly_label_with_wildcard (0.00s)
--- PASS: TestPromptForRole/no_friendly_labels_arn_arg_supplied (0.00s)
--- PASS: TestPromptForRole/single_arn_option_no_arg_supplied (0.00s)
FAIL
=== RUN TestPromptForIdp/friendly_label
IdP: My IdP
webssoauth_test.go:459: expected "arn:aws:iam::123:saml-provider/myidp", got "My IdP"
=== RUN TestPromptForIdp/friendly_label_configured_but_arn_arg_supplied
IdP: My IdP
=== RUN TestPromptForIdp/friendly_label_with_wildcard
IdP: A IdP
webssoauth_test.go:459: expected "arn:aws:iam::123:saml-provider/aidp", got "A IdP"
=== RUN TestPromptForIdp/no_friendly_labels_arn_arg_supplied
IdP: arn:aws:iam::123:saml-provider/youridp
=== RUN TestPromptForIdp/single_arn_option_no_arg_supplied
IdP: arn:aws:iam::123:saml-provider/myidp
=== RUN TestPromptForIdp/single_arn_option_no_arg_supplied_with_friendly_label
IdP: My IdP
--- FAIL: TestPromptForIdp (0.00s)
--- FAIL: TestPromptForIdp/friendly_label (0.00s)
--- PASS: TestPromptForIdp/friendly_label_configured_but_arn_arg_supplied (0.00s)
--- FAIL: TestPromptForIdp/friendly_label_with_wildcard (0.00s)
--- PASS: TestPromptForIdp/no_friendly_labels_arn_arg_supplied (0.00s)
--- PASS: TestPromptForIdp/single_arn_option_no_arg_supplied (0.00s)
--- PASS: TestPromptForIdp/single_arn_option_no_arg_supplied_with_friendly_label (0.00s)
FAIL