okta-aws-cli-assume-role icon indicating copy to clipboard operation
okta-aws-cli-assume-role copied to clipboard

Published 20 hours ago • verified publisher icon oktadev

okta-credential_process does not cache credentials

Open llamahunter opened this issue 5 years ago • 12 comments

Describe the bug the okta-credential_process does not cache credentials, making it very slow on every invocation.

To Reproduce Steps to reproduce the behavior:

  1. run okta-credential_process
  2. see that contents of .aws/credentials are not created/updated

Expected behavior On invocation of missing or expired credentials, okta-credential_process updates .aws/credentials with new temporary credentials like it does when running okta-aws. On subsequent calls to okta-credential_process, if the .aws/credentials are still unexpired, reuse them. Only refetch new credentials (updating .aws/credentials) when expired. Speeds up repeated usage by 10x.

Screenshots N/A

Additional context It appears the problem is due to conflation of OKTA_ENV_MODE to both control how the results are communicated via the environment and whether session reuse should be enabled. I think these are two different things. A bit of hacking in OktaAwsCliAssumeRole.doRequest() to comment out the if test of environment.oktaEnvMode around the call to profileHelper.createAwsProfile() seems to make it work 10x faster. (also, had to set OKTA_PROFILE=default). But, not sure of what else is going on. Seems the caller of credentials_process is smart about only calling it if there aren't unexpired credentials in ~/.aws/credentials.

llamahunter avatar Dec 21 '18 21:12 llamahunter