Git Product home page Git Product logo

onelogin-aws-cli-assume-role's Introduction

OneLogin CLI

Go Report Card gopherbadger-tag-do-not-edit

Description

The OneLogin CLI is your way to manage OneLogin resources such as Apps, Users, and Mappings via the Command Line.

Get Started

Install From Source - Requires Go

clone this repository from inside the repository go build ./... to create a runnable binary from inside the repository go install . to add a the runnable CLI to your GOPATH /bin directory

Alternatively you may run make install which just runs the above commands

Install with Homebrew (Mac OS Only)

brew install onelogin/tap-onelogin/onelogin

Or brew tap onelogin/tap-onelogin and then brew install onelogin.

Binaries

There are binaries available for the major platforms in this project's /build directory. Download the binary for your system and add it to your /bin folder or run it directly per your system's requirements.

  • darwin-amd64 => mac 64 bit and linux
  • windows-386 => windows 32 bit
  • windows-amd64 => windows 64 bit
  • linux-386 => linux 32 bit
  • linux-amd64 => linux 64 bit

Install Binary on Mac

Download and extract the darwin-amd64 package from the release artifacts list

tar -xvf darwin-amd64.tar.gz && sudo mv build/darwin-amd64/onelogin-darwin-amd64 /usr/local/bin/onelogin (you can specifiy a different name to invoke such as usr/local/bin/ol)

You'll likely get hit with a security warning when you try running onelogin for the first time.

To fix, go to System Preferences > Security & Privacy

you'll be presented with the warning about the binary not being from an identified developer. Allow this app to run.

Try running the command again and click Open from the popup and you should be good to go.

Install Binary on Windows

Download and extract the windows-amd64 package from the release artifacts list

Navigate to the extracted folder which should be in your Downloads folder and navigate to the .exe file (build > windows-amd64).

Create a folder in Program Files (Program Files \ Onelogin) and add the .exe to that folder.

Add Program Files \ Onelogin to your path by changing the environment variables

Hit the window key and type path. Select "Edit the system environment variables" Toward the bottom on the Advanced tab, select "Environment Variables" In the System variables list, click the Path variable on the list and click "Edit" Click "New" and add C:\Program Files\Onelogin Click OK on all the windows

Open a Cmd window and start using onelogin

/usr/local/bin/onelogin

Features

onelogin profiles [action] <profile_name> Maintains a listing of accounts used by the CLI in a home/.onelogin/profiles file and facilitates creating, changing, deleting, indexing, and using known configurations. You are of course, free to go and edit the profiles file yourself and use this as a way to quickly switch out your environment. Available Actions:

use             [name - required] => CLI will use this profile's credentials in all requests to OneLogin
show            [name - required] => shows information about the profile
edit   (update) [name - required] => edits selected profile information
remove (delete) [name - required] => removes selected profile
add    (create) [name - required] => adds profile to manage
list   (ls)     [name - optional] => lists managed profile that can be used. if name given, lists information about that profile
which  (current)                  => returns current active profile

onelogin smarthooks [action] <id> Creates a .js and .json file with the configuration needed for a Smart Hook and its backing javascript code. Available Actions:

new                                        => creates a new smart hook project in a sub-directory of the current working directory, with the given name and hook type.
list                                       => lists the hook IDs and types of hooks associated to your account.
deploy                                     => deploys the smart hook defined in the hook.js and hook.json files in the current working directory via a create/update request to OneLogin API.
test                                       => passes an example context defined in context.json to the hook code and runs it in lambda-local.
get         [id - required]                => creates a new smart hook project from an existing hook in OneLogin in current directory. ⚠️ Will overwrite existing project! To track changes or treat smart hook like a NodeJS project use a VCS.
delete      [ids - required]               => accepts a list of IDs to be destroyed via a delete request to OneLogin API.

env_vars                                   => lists the defined environment variable names. E.g. environment variables like FOO=bar BING=baz would turn up [FOO, BING].
put_env_vars [key=value pairs - required]  => creates or updates the environment variable with the given key. Must be given as FOO=bar BING=baz.
rm_env_vars  [key - required]              => deletes the environment variable with the given key.

terraform-import <resource>: Import your remote resources into a local Terraform State. Running this command will do the following:

  1. Pull all your resources from the OneLogin API (remote)
  2. Establish a basic main.tf that represents all the apps in your account. Each app will get an empty Terraform resource "placeholder"
  3. Call terraform import for all the apps and update the .tfstate
  4. Using .tfstate, update main.tf to fill in the editable fields of the resource

Profiles

Add your OneLogin profiles with onelogin profiles add <profile_name>

You'll be prompted for your client_id and client_secret (obtained by creating a set of developer keys in the onelogin admin portal)

You can add as many profiles as you like, and you can switch the active profile with onelogin profiles use <profile_name> which will point the CLI at the active account.

Smart Hooks

From an empty directory, where you plan to manage your Smart Hook run: onelogin smarthooks create

Select the hook type from the propmpt and you'll be presented with some files

hook.json - Config file for your Smart Hook where you can modify things like timeout and retries.

⚠️   Do NOT modify the function, env_vars, packages, or type! This tool will handle that for you.

hook.js - The good stuff. This is your Smart Hook code that gets run every time the triggering event happens.

⚠️   Do not remove the exports line. Smart Hooks use exports.handler = async (context) => {} as its main function.

⚠️   You must also return from your code an object with the success node defined. In a new project, this defaults to return {success: true}

.env - Where you manage environment variables as you would in other NodeJS projects

.gitignore - Lists things that are not recommended for check in to version control (like test artifacts, and .env)


To apply changes to your Smart Hook, call the onelogin smarthooks save command from inside the directory containing hook.js and hook.json

Create an empty Smart Hook project

onelogin smarthooks create

Update a Smart Hook

onelogin smarthooks save

To run tests against your Smart Hook code:

  • Create a context.json file (the input to the function). You can get one for Pre-Authentication or User-Migration
  • Run onelogin smarthooks test from inside your Smart Hook Project
  • Results will print to the screen

Terraform Import

Import all OneLogin apps, create a main.tf file, and establish Terraform state.

From an empty directory, where you plan to manage your main.tf file run:

onelogin terraform-import onelogin_apps

If you have pre-existing resources defined in main.tf the tool is smart enough to merge those definitions.

Contributing

Generally

Fork this repository, make your change and submit a PR to this repository against the develop branch.

Adding Resources for Import - Terraform Importer

To add an importable resource, do these things:

  1. Under the terraform/importables directory, add a file with the scheme _.go
  2. Add a struct to represent your importable, add whatever filtering or special criteria fields you need. OneLogin importables typically have at least a field for the resource's service from our SDK.
  3. On that struct you just made, implement the Importable interface. this is where we pull all the resources from the remote/api and represent them as resources in terraform
  4. Add structs that represent the fields you want to pull from tfstate into main.tf after the import for users to manage later. the state struct is how a resource is represented in .tfstate so in order for json marshalling to work, this struct has to look like your resource in tfstate.
  5. Refer to this in terraform/import/state.go in the 'molds' section so the importer is aware of the fields that should be read from tfstate and will marshal the respective data.
  6. in cmd/terraform-import add to the importables struct <resource_name>: tfimportables.YourImportable{} to register it

onelogin-aws-cli-assume-role's People

Contributors

andromedarabbit avatar bzvestey avatar dependabot[bot] avatar gkhaburzaniya-onelogin avatar jutley avatar mattbarrio avatar mbcmike avatar pitbulk avatar richet avatar snyk-bot avatar subterrane avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

onelogin-aws-cli-assume-role's Issues

NumberFormatException thrown when running loop

Environment: configured the onelogin.sdk.properties normally, passing information in arguments (except password), using --profile and --loop. My user has MFA app configured, which works normally for the first run. The .aws/credentials is updated, works correctly.
When the session ends, hence, running the authentication for the second time, I get an NFE:

Temporary AWS Credentials Granted via OneLogin

Updated AWS profile 'saml' located at /Users/braun/.aws/credentials
This process will regenerate credentials 9 more times.

Press Ctrl + C to exit
Exception in thread "main" java.lang.NumberFormatException: null
	at java.lang.Long.parseLong(Long.java:552)
	at java.lang.Long.parseLong(Long.java:631)
	at com.onelogin.aws.assume.role.cli.OneloginAWSCLI.getSamlResponse(OneloginAWSCLI.java:458)
	at com.onelogin.aws.assume.role.cli.OneloginAWSCLI.main(OneloginAWSCLI.java:256)

I didn't find anything on past issues related to this. Since this client doesn't have logging for debugging, I'm gonna start to modify the code to print everything, to see if I can have more info on what happened.

Mac OS X 10.14.2, Java 1.8.0_201

Question: can assume onelogin user?

Is it possible to assume a user with this package?
If not, would it be possible to add the feature?

The application would be same as in the web UI.

Warning about prepended `profile`, but latest AWS CLI doesn't support

After downloading the latest version of the jar, the latest awscli, a fresh ~/.aws directory, running aws configure --profile default while only setting the region, and running the java command...

$ aws --version
aws-cli/1.16.30 Python/3.7.0 Darwin/18.0.0 botocore/1.12.20
$ rm ~/.aws/config
$ cat ~/.aws/config
cat: /Users/vdc/.aws/config: No such file or directory
$ aws configure --profile default
AWS Access Key ID [None]:
AWS Secret Access Key [None]:
Default region name [None]: us-west-2
Default output format [None]:
$ cat ~/.aws/config
[profile default]
region = us-west-2
$ java -jar onelogin-aws-cli.jar -r us-west-2 -d "redacted" -a "redacted" -u "${USER}" -p default

I get this notice at the bottom of the jar output:

AWS Region: us-west-2Feb 27, 2019 12:14:48 PM com.amazonaws.profile.path.cred.CredentialsLegacyConfigLocationProvider getLocation
WARNING: Found the legacy config profiles file at [/Users/vdc/.aws/config]. Please move it to the latest default location [~/.aws/credentials].
Feb 27, 2019 12:14:48 PM com.amazonaws.auth.profile.internal.BasicProfileConfigLoader loadProfiles
WARNING: The legacy profile format requires the 'profile ' prefix before the profile name. The latest code does not require such prefix, and will consider it as part of the profile name. Please remove the prefix if you are seeing this warning.

-----------------------------------------------------------------------
Success!

Temporary AWS Credentials Granted via OneLogin

Updated AWS profile 'default' located at /Users/vdc/.aws/config

When I don't specify a profile in aws configure, I still get an warning that something is legacy:

$ aws configure
AWS Access Key ID [None]:
AWS Secret Access Key [None]:
Default region name [None]: us-west-2
Default output format [None]:
$ cat ~/.aws/config
[default]
region = us-west-2
$ java -jar aws/onelogin-aws-cli.jar -r us-west-2 -d "redacted" -a "redacted" -u "${USER}" -p default
Unable to find a $JAVA_HOME at "/usr", continuing with system-provided Java...

OneLogin AWS Assume Role Tool

OneLogin Username: vdc
OneLogin Password:
AWS App ID: redacted
Onelogin Instance Sub Domain: redacted

Available AWS Roles
-----------------------------------------------------------------------
 0 | OneLogin-SAML-ENG-ROLE (Account redacted)
 1 | OneLogin-SAML-Role (Account redacted)
-----------------------------------------------------------------------
Select the desired Role [0-1]: 0
AWS Region: us-west-2Feb 27, 2019 1:37:03 PM com.amazonaws.profile.path.cred.CredentialsLegacyConfigLocationProvider getLocation
WARNING: Found the legacy config profiles file at [/Users/vdc/.aws/config]. Please move it to the latest default location [~/.aws/credentials].

-----------------------------------------------------------------------
Success!

Temporary AWS Credentials Granted via OneLogin

Updated AWS profile 'default' located at /Users/vdc/.aws/config

And here's what happens if I never run aws configure and then run the tool:

AWS Region: us-west-2Exception in thread "main" java.lang.NullPointerException
	at com.amazonaws.auth.profile.ProfilesConfigFileWriter.modifyProfiles(ProfilesConfigFileWriter.java:159)
	at com.amazonaws.auth.profile.ProfilesConfigFileWriter.modifyOneProfile(ProfilesConfigFileWriter.java:129)
	at com.onelogin.aws.assume.role.cli.OneloginAWSCLI.main(OneloginAWSCLI.java:401)

I realize I'm just getting warnings (aside from the last example) but I don't think my usage is legacy if I'm running the aws configure tool. Although, it would be great to accommodate the last pattern since that would help users get connected without having to run another command. Right now I have a wrapper script that handles both for users, but I'd really like to avoid the warnings.

Allow user to pre-select MFA device

I keep an alternate MFA device on my account as a backup. As a result, I get prompted to select a particular device every time I log in:

MFA Required
Authenticate using one of these devices:
-----------------------------------------------------------------------
 0 | Google Authenticator
 1 | Yubico YubiKey
-----------------------------------------------------------------------

Select the desired MFA Device [0-1]:

I'd like to set a default choice through a command-line option or the properties file, to remove the manual step.

Allow user to specify properties file

Currently, we need to place the properties file and the jar next to each other. I would like to keep these in separate places so that we can download the jar and credentials using separate mechanisms.

I've tried to update the classpath when running the jar in order to discover the properties file in a different location, but I have not been able to do so successfully.

I think we should be able to add a --properties flag to specify where our properties file is.

Review the python version and sync

It seems there are several improvements on the python version that were not migrated to java.

For example the use of do_not_notify parameter on the getSAMLAssertionVerifying method.

Review how OL Protect is supported

-f custom path argument on Windows dont work, fail on profile write

Tested both Powershell and CMD shells with and without a period in foldername

....
AWS Region (us-west-2): us-east-1
Exception in thread "main" com.amazonaws.SdkClientException: Unable to restore the original credentials file. File content stashed in C:\scratch\aws.bak.a742c34a-f9b6-45c3-97bd-ef39dabd60a0
        at com.amazonaws.auth.profile.ProfilesConfigFileWriter.modifyProfiles(ProfilesConfigFileWriter.java:232)
        at com.amazonaws.auth.profile.ProfilesConfigFileWriter.modifyOneProfile(ProfilesConfigFileWriter.java:129)
        at com.onelogin.aws.assume.role.cli.OneloginAWSCLI.main(OneloginAWSCLI.java:331)

Should use POST when calling process.jsp

In onelogin-aws-assume-role-jsp/src/main/webapp/index.jsp,
The line:

<form action="process.jsp">

needs to be:

<form action="process.jsp" method="POST">

to avoid publishing all parameters(including passwd) in the URL.

List of Roles, accounts and their Aliases

We are managing lot of AWS accounts that have identical IAM role names. In the onelogin portal for the AWS app, the listing of AWS roles we have access include the Account Number, but also the ALIAS that was set to each AWS Account. Typically we use the alias to have a friendly way to identify the account with the client or project name, and the environment (dev, qa, uat, prod, etc).

Using the onelogin CLI, we just see the role name and the account id. Quite tough and error prone. Could you display the aws alias name too?

Thanks

Publish github releases versions

Hi,

We scripted the process of downloading the jar artifact and it would be very useful if we could check the latest released version using the github api.
At the moment under releases regular tags are shown so the api request for releases is empty e.g curl https://api.github.com/repos/onelogin/onelogin-aws-cli-assume-role/releases .
This feature is already used for the python version of the cli curl https://api.github.com/repos/onelogin/onelogin-python-aws-assume-role/releases so I guess it would not imply much effort.

thx

Password command-line option?

It'd be nice to have a --password option on the command line like the Python client has. One can echo it, ie:

echo "mypassword" | java -jar onelogin-aws-cli.jar ...all the other options...

But if one has a MFA device like a Yubikey set up, the echo messes with that:

$ echo "mypassword" | java -jar onelogin-aws-cli.jar --username myusername --appid 123456 --subdomain subdomain --profile default --region ca-central-1

OneLogin AWS Assume Role Tool

18:53:25.338 [main] DEBUG com.onelogin.sdk.util.Settings - properties file onelogin.sdk.properties loaded succesfully
OneLogin Username: myusername
OneLogin Password: AWS App ID: 123456
Onelogin Instance Sub Domain: subdomain

MFA Required
Authenticate using one of these devices:
-----------------------------------------------------------------------
Enter the OTP Token for Yubico YubiKey: Exception in thread "main" java.util.NoSuchElementException
	at java.util.Scanner.throwFor(Scanner.java:862)
	at java.util.Scanner.next(Scanner.java:1371)
	at com.onelogin.aws.assume.role.cli.OneloginAWSCLI.getSamlResponse(OneloginAWSCLI.java:390)
	at com.onelogin.aws.assume.role.cli.OneloginAWSCLI.main(OneloginAWSCLI.java:206)

Quickstart Guide is incomplete

The quickstart instructions make it seem like all you need to do is download the jar file and execute it. However, you're quickly met with an error...

14:23:59.761 [main] ERROR com.onelogin.sdk.util.Settings - properties file 'onelogin.sdk.properties' not found in the classpath
Exception in thread "main" com.onelogin.sdk.exception.Error: properties file 'onelogin.sdk.properties' not found in the classpath
	at com.onelogin.sdk.util.Settings.loadPropFile(Settings.java:112)
	at com.onelogin.sdk.util.Settings.<init>(Settings.java:38)
	at com.onelogin.sdk.conn.Client.<init>(Client.java:123)
	at com.onelogin.sdk.conn.Client.<init>(Client.java:129)
	at com.onelogin.aws.assume.role.cli.OneloginAWSCLI.main(OneloginAWSCLI.java:125)

I have to follow the link to the detailed instructions in order to properly use the quickstart guide. That kind of defeats the purpose of calling it "Quickstart"

Command line arguments do not work

OS: Ubuntu 18.04
Java: oracle-java8-installer 8u171-1webupd80

I have tried multiple flag permutations and none of them appear to work:

java -jar onelogin-aws-cli.jar --username=testusername
08:09:51.493 [main] DEBUG com.onelogin.sdk.util.Settings - properties file onelogin.sdk.propertiesloaded succesfully
OneLogin Username:

java -jar onelogin-aws-cli.jar --username testusername
08:09:58.099 [main] DEBUG com.onelogin.sdk.util.Settings - properties file onelogin.sdk.propertiesloaded succesfully
OneLogin Username:

java -jar onelogin-aws-cli.jar username=testusername
08:10:06.383 [main] DEBUG com.onelogin.sdk.util.Settings - properties file onelogin.sdk.propertiesloaded succesfully
OneLogin Username:

java -jar onelogin-aws-cli.jar username testusername
08:12:01.030 [main] DEBUG com.onelogin.sdk.util.Settings - properties file onelogin.sdk.propertiesloaded succesfully
OneLogin Username:

java -jar onelogin-aws-cli.jar -username testusername
08:10:17.543 [main] DEBUG com.onelogin.sdk.util.Settings - properties file onelogin.sdk.propertiesloaded succesfully
OneLogin Username:

java -jar onelogin-aws-cli.jar -username=testusername
08:10:22.436 [main] DEBUG com.onelogin.sdk.util.Settings - properties file onelogin.sdk.propertiesloaded succesfully
OneLogin Username:

I am constantly required to enter the username.

v1.1.3 not working: this.settings is null

Trying to use the latest release of onelogin-aws-cli v1.1.3 and have the following error.

MFA Required
Authenticate using one of these devices:
-----------------------------------------------------------------------
Enter the OTP Token for Yubico YubiKey: ###########
Exception in thread "main" java.lang.NullPointerException: Cannot invoke "com.onelogin.saml2.settings.Saml2Settings.isTrimAttributeValues()" because "this.settings" is null
	at com.onelogin.saml2.authn.SamlResponse.getAttributes(SamlResponse.java:612)
	at com.onelogin.aws.assume.role.cli.OneloginAWSCLI.main(OneloginAWSCLI.java:303)

The previous version v1.1.2 works well on the same application.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.