Authentication locks tools without stdin - windows credentials support hack #51
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This pull request isn't intended to be merged as-is, but it's here to demonstrate an issue and hack solution for a problem with
aws-okta-processor
.If you work with AWS entirely from the command line, then
aws-okta-processor
is fine. But if you ever use an AWS-aware tool that doesn't redirectstdin
andstdout
then aws-okta-processor, when configured as acredential_process
, will wait indefinitely for user prompts that the user never receives. As an example: AWS Tools for Powershell breaks whenaws-okta-processor
prompts as, for some reason, it doesn't redirect stdin/stdout.The hack I'm presenting here is a partial solution to the problem. Instead of using Python's
getpass
, I'm leveraging Powershell.exe to callGet-Credentials
which shows the standard Windows credentials prompt. Preferably the call to Powershell should be replaced with real winapi calls, but that is considerably more effort. It also doesn't solve the problem for other operating systems. Also, I'm not handling hardware token prompts at all so that will still fail silently.The proper solution here would be for
aws-okta-processor
to detect if it's running interactively and/or expose flags to control interactivity. If the process is non-interactive or is disabled by flags then it should not prompt for input and fail quickly when invoked. If the process is interactive then show the user prompt, depending on what input is available. Preferably leveraging secure credentials prompts provided by the user's operating system.