noovolari / leapp Goto Github PK
View Code? Open in Web Editor NEWLeapp is the DevTool to access your cloud
Home Page: https://www.leapp.cloud/
License: Mozilla Public License 2.0
Leapp is the DevTool to access your cloud
Home Page: https://www.leapp.cloud/
License: Mozilla Public License 2.0
Describe the bug
Every time i come back to the home screen using the "back button" inside the new account definition page, the credentials are refreshed.
To Reproduce
Steps to reproduce the behavior:
Desktop (please complete the following information):
Describe the bug
On ubuntu the menu in the notification bar only shows the last 5 inserted accounts, not the last used ones
Desktop (please complete the following information):
Describe the bug
The client stucks/hangs during the loading screen after the first installation.
To Reproduce
Steps to reproduce the behavior:
Expected behavior
Would like to see what's next to the loading screen
Additional Information
I can't update my OS since my PC is old!
Describe the solution you'd like
Ability to use Azure AD as an identity provider for AWS accounts.
Additional context
We would like to use Leapp to programatically access multiple AWS accounts. The SSO is federated by Azure AD, we log in through myapps.microsoft.com
and choose "AWS SSO" from the list of options. This in turn takes us to the usual AWS accounts list. From here we choose "Command line or programmatic access".
Current steps
myapps.microsoft.com
xyzxyzxyz.awsapps.com/start
gets opened with all accounts presentDescribe the bug
Hamburger menu button does not work after the menu is closed.
Leapp Version
0.2.6
To Reproduce
Expected behavior
Open the menu with one click.
Desktop
Describe the bug
The quick list only shows the current section and the last ADDED not USED accounts.
To Reproduce
Steps to reproduce the behavior:
Expected behavior
A clear and concise description of what you expected to happen.
Desktop (please complete the following information):
It would be great if there was the possibility to export workspace.json (that contains all the personal configuration), and import it in another installation.
First of all, I like your idea. Looks like it's a really useful solution for multi-account access.
Is your feature request related to a problem? Please describe.
Currently, Leapp doesn't support another IdP except for AWS SSO and Google.
Describe the solution you'd like
Support Okta as IdP provider for temporary credentials fetching and using with the app
Describe the bug
Every time i come back to the home screen using the "back button" inside the new account definition page, the credentials are refreshed.
To Reproduce
Steps to reproduce the behavior:
Desktop (please complete the following information):
Is your feature request related to a problem? Please describe.
Every time you start an SSM Session with Session Manager, you have to prompt /bin/bash
to open the terminal.
Describe the solution you'd like
I suggest opening the terminal with a message from leapp, maybe with an Ascii art.
Then start with the
bin/bash
the command to launch the session in the right way.
Additional context
This would work for Linux instances only, how to manage Windows Instances?
Is your feature request related to a problem? Please describe.
I have some account alias which are quite long, so the account name on the main page is truncated.
It's not possible to resize the window to show the full account name.
Describe the solution you'd like
Make the window resizable and "expand" the shown account name.
Describe alternatives you've considered
Right-click on the system try icon to see the full name
Additional context
Leapp 0.3.2
Hi, when i configure the federated login and go to the "small browser" for login into gsuite account i get error with the browser is not compatible with google.
Describe the bug
Command path for launching SSM command must be absolute for MAC OSX because of how the compiled app works.
This must differ from the az one.
To Reproduce
Steps to reproduce the behavior:
Expected behavior
The SSM procedure must start as expected.
Desktop (please complete the following information):
Describe the bug
The string list in the SSM session tab is unformatted. Buttons are pushed to the next line.
To Reproduce
Steps to reproduce the behavior:
Expected behavior
I expect to have a short view of the name of the EC2 (and it's IP) with a tooltip with the entire one.
Screenshots
Is your feature request related to a problem? Please describe.
When configuring trusted accounts, I cannot use another truster account as a credentials source.
In my scenario I have my company account T. To access customer's accounts I now have a trust relationship to their org account C. This org account has trust relationships with the workload accounts of the clients W1, W2, ...
I now need to use the following cred chain: T -> C -> W1
Describe the solution you'd like
I would love to have a truster account as a credential source
Describe alternatives you've considered
None come to my mind
Is your feature request related to a problem? Please describe.
We need a way to troubleshoot user bugs.
Describe the solution you'd like
A logging solution that writes errors to disk.
For every account definition it would be nice if there was a chance to select a the default region for the generated credentials.
Is your feature request related to a problem? Please describe.
Plain credentials (AWS Access and Secret) are directly injected in the credentials file.
Describe the solution you'd like
In the credentials file should be injected only short-lived credentials.
Solution is to inject the result of get-session-token.
https://docs.aws.amazon.com/cli/latest/reference/sts/get-session-token.html
Additional context
The --duration-seconds parameter can e just at default but consider on making it customizable.
Describe the solution you'd like
I would like to setup a default ouput, global and for session using this output format :
https://docs.aws.amazon.com/cli/latest/userguide/cli-usage-output.html
Describe alternatives you've considered
We can always append output or setup a variabile like this : export AWS_DEFAULT_OUTPUT but it works only for Linux system
Direct SSO URL is supporte correctly, but many customers (i.e. myself) use SSO with an alias (i.e. aws.mycompany.com). If the alias is entered, the app hangs up immediately, and becomes unresponsive. I had to force quit Leapp and start over.
Describe the bug
Do not see a list of instances to connect to.
Leapp Version
Version 0.2.6 (0.2.6)
10.14.6 (18G6032) Mac OSX Majave
To Reproduce
Expected behavior
A list of instances
Additional context
Tried disconnecting VPN. Tried different AWS users. Tried accessing session manager via console - all ok.
Is your feature request related to a problem? Please describe.
Add AWS SSO as an identity provider for AWS.
AWS SSO provides OAuth 2.0 Device Authorization Grant compatible APIs to enable command line tools to use AWS SSO to obtain AWS credentials. While those APIs are already documented and used by the AWS Command Line Interface version 2 (AWS CLI) they are not yet actively promoted by AWS.
The corresponding AWS APIs are:
With Leapp, we have to setup the integration with this specific Identity provider.
The thought is to provide an Integrations page to manage every external integration with Leapp.
So in the menu we will find and Integration button.
By clicking the integrations menu you will see an info to register AWS SSO as identity provider.
Whenever you click the AWS SSO button the auth flow must start.
The Auth flow in AWS SSO is made up with OIDC and is divided in three different steps:
CREDENTIALS ARE NOT NEEDED FOR THOSE THREE CALLS!
The first thing we have to do is to register a local client.
The AWS SSO OIDC service currently implements only the portions of the OAuth 2.0 Device Authorization Grant standard (https://tools.ietf.org/html/rfc8628) that are necessary to enable SSO authentication with the AWS CLI. Support for other OIDC flows frequently needed for native applications, such as Authorization Code Flow (+ PKCE), is planned in future releases.
As soon as the button is started, the RegisterClient Api will be invoked.
aws sso-oidc register-client --client-name leapp --client-type public
NOTES: public is the only client type available at the moment.
it will generate a response like the one below:
{
"clientId": "Clhq.....tMQ",
"clientSecret": "eyJra.....wi...lK",
"clientIdIssuedAt": 1603898686,
"clientSecretExpiresAt": 1611674686
}
By decoding the Client secret you will see:
{
"expired": false,
"clientId": {
"value": "R-j5yN-4-TPNs...tMQ"
},
"clientName": "my-client",
"clientType": "PUBLIC",
"templateArn": null,
"templateContext": null,
"expirationTimestamp": 1594932567.612,
"createdTimestamp": 1587156567.612,
"updatedTimestamp": 1587156567.612,
"createdBy": null,
"updatedBy": null
}
We have to locally save those info and pass them into the next call
in order to make this call the user of Leapp need to have registered into AWS SSO and provide a valid start-url, that is the portal url
Having a valid OIDC client registration we can now initiate the device authorization flow using the StartDeviceAuthorization API action.
aws sso-oidc start-device-authorization
--client-id mVZBEoa-gUBj8nugHZUIsWV1LXdlc3QtMQ
--client-secret eyJra...a_tV-htKetQH8
--start-url ENDPOINTURL
That will produce a response like this:
{
"deviceCode": "8Acq...DUg",
"expiresIn": 600,
"interval": 1,
"userCode": "RPXP-JSQA",
"verificationUri": "https://device.sso.eu-central-1.amazonaws.com/",
"verificationUriComplete": "https://device.sso.eu-central-1.amazonaws.com/?user_code=RPXP-JSQA"
}
Where:
userCode
to authorize the device.In order to verify this device, Leapp will prompt you to the LOGIN PAGE and the verification code page, by opening a web browser with the
verificationUriComplete
After the verification of the device we can now call the CreateToken
API
Having the userCode
and deviceCode
values we can now us the CreateToken API action to obtain a device access token. However, before we can request any tokens we need to open the verificationUriComplete
URL in a web browser, complete authentication and provide authorization. At this point the end-user has to provide personal credentials in order to authenticate himself, for example by entering his username, password and maybe also has to provide multi factory authentication (MFA) credentials.
curl -X POST https://oidc.eu-central-1.amazonaws.com/token -d
'{"clientId": "R-j5yN-4-TPNs...tMQ", "clientSecret": "eyJr...x74", "deviceCode": "8Acq...DUg", "grantType": "urn:ietf:params:oauth:grant-type:device_code"}'
If everything worked out as expected, the token endpoint will return a valid accessToken, which we later can use with the AWS SSO Portal API to obtain temporary AWS credentials using the GetRoleCredentials action.
The returned tokens are valid for 8 hours.
This API call is region sensible, so we have to extract the region from the
verificationUriComplete
url with a RegEx!
With this token we can now call the AWS SSO Portal API to autogenerate sessions in Leapp.
In order to fill the session available with AWS SSO we have to use those APIs
The following actions are supported:
and in order to complete this action we need scan for account and roles inside them, so it's a time consuming moment.
so a loading modal will appear:
What happens whenever this modal will appear?
Firstly we have to check all the accounts available for the current user.
Lists all AWS accounts assigned to the user. These AWS accounts are assigned by the administrator of the account.
GET /assignment/accounts?max_result=maxResults&next_token=nextToken HTTP/1.1
x-amz-sso_bearer_token: accessToken
CreateToken
API call. Required: YesRESPONSE
{
"accountList": [
{
"accountId": "string",
"accountName": "string",
"emailAddress": "string"
}
],
"nextToken": "string"
}
The following data is returned in JSON format by the service.
For each account retrieved by this API, we need to check all the possible roles inside it.
aws sso list-account-roles --access-token eyJlbmMiOiJBM...nZEpteo-dHw --account-id 198863347786
Response:
{
"roleList": [
{
"roleName": "ViewOnlyAccess",
"accountId": "198000000086"
}
]
}
After that for each pair of Account and role found we will add an AWS session that is available to get the correct credentials.
in order to retrieve credentials we have to make this call
Having a valid access token, we can use the AWS SSO Portal API to obtain temporary AWS credentials using the GetRoleCredentials action.
curl 'https://portal.sso.eu-central-1.amazonaws.com/federation/credentials?account_id=999999999999&role_name=MyIamRoleName' -H 'x-amz-sso_bearer_token: eyJl...Blw'
Which will then provide us with temporary AWS session credentials, which by default are valid for 12 hours.
{
"roleCredentials": {
"accessKeyId": "ASIA...Z3XM",
"secretAccessKey": "+t6UnVLWia...hFOzGL",
"sessionToken": "IQoJb3JpZ2lu...dK6",
"expiration": 150000008000
}
}
I tried several additional query parameters (session_duration
, duration_seconds
, …) to figure out whether one can choose a shorter session duration, but it looks like 12 hours is all you can get. While AWS STS API’s actions like AssumeRole or AssumeRoleWithWebIdentity allow callers to specify custom session duration, GetRoleCredentials does not yet support that.
there are still two actions to be implemented in the App, the Logout
action and the Sync
action.
The first call the api call of the portal
The second one will synchronize the session with the current configuration.
Is your feature request related to a problem? Please describe.
Opening a web console with a specific AWS role and User has always been a pain.
Describe the solution you'd like
Open a web console directly from the Session in Leapp.
Describe alternatives you've considered
Add an action to the session to Open a web console with the Favorite Browser.
When launched for the first time, Leapp deletes .aws/credentials
file, after making a backup copy into .aws/credentials.bpk
which is a pretty generic name (other app use the same name).
Moreover the user is not warned about this operation and doing a ```cat`` on credentials file produces an empty result
Describe the solution you'd like
Currently we have to delete and create the account again to update the access/secret keys when the older ones are invalidated. It would be great if we could provide an Edit option in the options menu next to the profile to update the keys.
Describe the bug
When hitting the force refresh key combination, the page tries to refresh but it doesn't load anymore and become unresponsive. Quit will not work and only way to restart is to kill the process.
To Reproduce
Steps to reproduce the behavior:
Expected behavior
App should refresh the page and display the home page or the page the user was on.
Desktop (please complete the following information):
Describe the bug
The drop down forgets history when account is changed using the task bar dropdown
Leapp Version
0.2.7 deb ubuntu
To Reproduce
Steps to reproduce the behavior:
Desktop (please complete the following information):
Please make available for non-Debian based distros, like .rpm, .AppImage, ecc...
Describe the bug
The current version does not support AWS accounts that require multi-factor authentication.
To Reproduce
Steps to reproduce the behavior:
Expected behavior
After creating a plain account, there should a possibility to click on "Truster" and add a truster account.
Desktop (please complete the following information):
Bug description
Inside the Create Account wizard, if I'm creating a Plain Account as the first one, the Save Button remains disabled.
How to reproduce the bug
Steps to reproduce the behavior:
Expected behavior
We expect the Save Button to be enabled once all the Account attributes are filled in the form.
Desktop
Or leave only in the development version.
Describe the bug
Remove notification message on credentials successfully refreshed
Describe the bug
Dialog boxes "A new version has been downloaded. Close and re-open Leapp to use the new version." keep popping up after automatic application update and closing then re-opening the app as indicated. The app crashes when trying to open it.
Leapp Version
0.3.2 (before automatic update)
Expected behavior
Screenshots
If applicable, add screenshots to help explain your problem.
Desktop (please complete the following information):
Bug description
When a Session Card is clicked, new tray icons appear in the top bar.
To Reproduce
Steps to reproduce the behavior:
Expected behavior
Only one tray icon is expected to be shown in the top bar.
Desktop (please complete the following information):
Hello,
I just downloaded for the first time the release 0.3 and moved it on the application directory.
When I start it I just get a blank screen and nothing happen.
If I run the app from the cli I get:
/Applications/Leapp.app/Contents/MacOS/Leapp
12:35:29.461 › Setupping workspace for the first time
feedURL https://update.electronjs.org/Noovolari/leapp/darwin-x64/0.3.0
requestHeaders { 'User-Agent': 'update-electron-app/2.0.1 (darwin: x64)' }
checking-for-update
update-not-available
(node:22785) DeprecationWarning: Passing functions, DOM objects and other non-cloneable JavaScript objects to IPC methods is deprecated and will throw an exception beginning with Electron 9.
My blank screen:
Is your feature request related to a problem? Please describe.
If I start the Create Account wizard and change my mind, there is apparently no way to go back to the main page.
Except... that little "<" button in the "My Access strategy" area, which I found when I was already writing this issue :-)
I think that that button is not evident enough to the user.
Describe the solution you'd like
Replace the "<" button with an "exit" (or "back", "home") button on the left of the "save" button, which exits the wizard and shows me the main page.
Describe alternatives you've considered
Restarting the app :-)
Additional context
I'm using version 0.3.2
Is your feature request related to a problem? Please describe.
Users should be able to change the "default region" at any time for a specific session.
Describe the solution you'd like
We already have a region setting, it would be perfect if this setting would be used as a default on each session start.
Users should be able to switch region for the current session using a simple selector. The selector should reset to the "default region" for the account when changing the session.
Describe the bug
I configured a "truster" account. When I try to activate it I get an error.
The configured role contains a path, e.g. pathpart1/pathpart2/rolename
Leapp Version
0.3.2
To Reproduce
Steps to reproduce the behavior:
Desktop (please complete the following information):
Additional context
This is the error I see in the log file (I replaced the actual role name):
[2020-11-19 22:54:51.923] [error] [renderer] [t] Error in assume role from plain to truster in get session token: ValidationError: 1 validation error detected: Value 'truster-on-xxx/yyy/rolename' at 'roleSessionName' failed to satisfy constraint: Member must satisfy regular expression pattern: [\w+=,.@-]*
at constructor.extractError (file:///C:/Users/fulgoni/AppData/Local/Programs/Leapp/resources/app.asar/dist/leapp-client/main.120160f17d385276afa2.js:2:3499698)
at constructor.callListeners (file:///C:/Users/fulgoni/AppData/Local/Programs/Leapp/resources/app.asar/dist/leapp-client/main.120160f17d385276afa2.js:2:2539143)
at constructor.emit (file:///C:/Users/fulgoni/AppData/Local/Programs/Leapp/resources/app.asar/dist/leapp-client/main.120160f17d385276afa2.js:2:2538853)
at constructor.emitEvent (file:///C:/Users/fulgoni/AppData/Local/Programs/Leapp/resources/app.asar/dist/leapp-client/main.120160f17d385276afa2.js:2:2723145)
at constructor.e (file:///C:/Users/fulgoni/AppData/Local/Programs/Leapp/resources/app.asar/dist/leapp-client/main.120160f17d385276afa2.js:2:2718652)
at r.runTo (file:///C:/Users/fulgoni/AppData/Local/Programs/Leapp/resources/app.asar/dist/leapp-client/main.120160f17d385276afa2.js:2:753905)
at file:///C:/Users/fulgoni/AppData/Local/Programs/Leapp/resources/app.asar/dist/leapp-client/main.120160f17d385276afa2.js:2:754111
at constructor.<anonymous> (file:///C:/Users/fulgoni/AppData/Local/Programs/Leapp/resources/app.asar/dist/leapp-client/main.120160f17d385276afa2.js:2:2718922)
at constructor.<anonymous> (file:///C:/Users/fulgoni/AppData/Local/Programs/Leapp/resources/app.asar/dist/leapp-client/main.120160f17d385276afa2.js:2:2723201)
at constructor.callListeners (file:///C:/Users/fulgoni/AppData/Local/Programs/Leapp/resources/app.asar/dist/leapp-client/main.120160f17d385276afa2.js:2:2539249)
It seems the role name is concatenated to truster-on-
for the session name, but the /
char is not supported. If so, removing all the chars which don't match [\w+=,.@-]
may fix the issue.
Issue template url does not work. It returns a 404 page
The client seems stuck after it is resumed from the notification tray, I'm unable to perform any action.
How to Reproduce
Steps to reproduce the behavior:
Windows 10 Pro Version 2004 (OS Build 19041.450)
For large enterprise, our corporate networks are not internet routable, so all egress traffic from a desktop must exit out via a web proxy (example Squid).
Application needs to either use the proxy definition that the OS automatically get via GPO policy or needs to allow end user to setup a variable to define the proxy settings.
Typically setup info needed
http.proxyhost http.proxyhostport
https.proxy https.proxyhostport
proxy auth username/password
As an example see how VS code or other Electron apps are setup, you can leverage same code/config setup.
Describe the bug
When you click on multiple 3-dot menu buttons the menus do not close automatically.
Leapp Version
0.2.6
To Reproduce
Expected behavior
There should be only one open menu at time
Desktop:
AWS Truster account ids are nice, but accounts can be identified also by their name (or alias) which usually works in "switch role" functionality. Having support also for account names would be great
Describe the bug
The current version will only allow for a single account
To Reproduce
Steps to reproduce the behavior:
Create an account
Create AWS account
Select Plain
Fill in the form
will replace the only account in the application
Desktop (please complete the following information):
OS: MacOS
Version 10.15.7
Is your feature request related to a problem? Please describe.
I'd like to be able to edit a "truster" account which I previously created
Describe the solution you'd like
Add an edit menu like the one for "plain" accounts
Describe alternatives you've considered
Delete and create the account again
Additional context
Leapp 0.3.2
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.