piontas/python-aada

Azure AD AWS Cli Authorization

Azure AD AWS Cli Authentication

Generates STS Tokens based on SAML Assertion from Azure AD (with MFA enabled also)

System Requirements

• Python3.6+

Installation

Simply run:

$ pip install git+https://github.com/piontas/python-aada.git

In order to install with keyring for password management:

$ pip install "git+https://github.com/piontas/python-aada.git#egg=aada [keyring]"

Usage

To see help message:

$ aada --help

To configure default profile

$ aada configure

To configure named profile

$ aada configure --profile <profile_name>

To login to Azure AD and assume role with SAML and pick role from a list

$ aada login

To login to Azure AD and assume role with SAML with preselected role and account

$ aada login -a <account number>  -r <rolename>

To login with named profile

$ aada login --profile <profile_name>

To login in debug mode

$ aada login -d

To login in non-headless mode

$ aada login -n

Configuration options

Before aada can be used, below details has to be collected:

• Azure Tenant ID
• Azure App ID URI
• Azure Username
• Azure MFA (Leave empty if not using MFA).
• AWS CLI session duration (3600 seconds by default)

MFA Options:

• PhoneAppOTP - mobile phone application generated token
• OneWaySMS - sms based token
• PhoneAppNotification - mobile phone application notification
• TwoWayVoiceMobile - voice call confirmation

Running in Docker

Build

First build the container. It will install Chrome and configure pyppeteer to use the downloaded version instead of downloading each time you run the container.

docker build -t localhost/python-aada:latest -f Dockerfile .

You can run the container now but must specify the seccomp profile to allow Chrome to run it's sandbox. This mounts your local $HOME/.aws directory for access to profiles.

docker run -it --rm \
    -v $HOME/.aws:/home/chrome/.aws \
    --log-driver none \
    --security-opt seccomp:chrome.json \
    localhost/aada login --profile <profile-name>

TODO

• Documentation
• Tests
• Installation steps
• Logging, debugging

python-aada's Issues

Unable to provide MFA Token

When trying to login, it fails to ask me for the MFA token and then exits with the following stacktrace:

ᐅ aada login
Azure username: [email protected]
Azure password:
Azure MFA Token: Traceback (most recent call last):
  File "/usr/local/bin/aada", line 10, in <module>
    sys.exit(main())
  File "/usr/local/lib/python3.7/site-packages/aada/cli.py", line 84, in main
    return cli.main()
  File "/usr/local/lib/python3.7/site-packages/aada/cli.py", line 79, in main
    return self.__getattribute__('_{}'.format(self._parsed_args.command))()
  File "/usr/local/lib/python3.7/site-packages/aada/cli.py", line 52, in _login
    return login()
  File "/usr/local/lib/python3.7/site-packages/aada/login.py", line 82, in __call__
    return self._login()
  File "/usr/local/lib/python3.7/site-packages/aada/login.py", line 285, in _login
    url, username_input, password_input, self._azure_mfa))
  File "/usr/local/Cellar/python/3.7.4_1/Frameworks/Python.framework/Versions/3.7/lib/python3.7/asyncio/base_events.py", line 579, in run_until_complete
    return future.result()
  File "/usr/local/lib/python3.7/site-packages/aada/login.py", line 163, in _render_js_form
    mfa_token = input('Azure MFA Token: ')
EOFError: EOF when reading a line

Issue installing aada with pip

I am having hard time to install aada with pip on mac os catalina.

aada has been successfully installed but I am constantly getting command command not found error

Any thoughts what could be the issue ?
Thanks in advance
Kind Regards

Random login error when using PhoneAppNotification

Occasionally, when login in using PhoneAppNotification (don't know of others), I get the following error:

Azure password: 
Processing MFA authentication...
Future exception was never retrieved
future: <Future finished exception=NetworkError('Protocol error Target.sendMessageToTarget: Target closed.',)>
pyppeteer.errors.NetworkError: Protocol error Target.sendMessageToTarget: Target closed.
An error occured while authenticating, check credentials.

This happens after I approve the login in my mobile phone, so I guess it should not be caused by a mistyped password (?)
Any suggestion on this?
Also, thanks for this project 😃

How to use aada in linux terminal, without browser support?

Wrong parsing of IAM roles with '/' in role name

When role name contains '/' characters it's not possible to use -r parameter for these roles because of current implementation splits ARN by '/' and compare second item from split result with value of '-r' parameter.
So in case when the role named "dep1/group2/super.role3" its arn is something like "arn:aws:iam::123456789012:role/dep1/group2/super.role3".

Please fix.

python-aada/aada/login.py

Line 237 in 8bc01f7

role = row.split('/')[1]

It's now
role = row.split('/')[1]
Should be
role = row.split('/',maxsplit=1)[1]

SAMLResponse only after inspecting (CTRL + SHIFT + I)

Hello,
this piece of code:

if req.url == 'https://signin.aws.amazon.com/saml':
self.saml_response = parse_qs(req.postData)['SAMLResponse'][0]

is working only, when in no headless mode I click right mouse button on the page and then choose inspect option.
Is there any way to make it automate?

Headless login does not work under macOS 10.15

Firstly I want to say thanks for writing this awesome tool :)

Now for the bug report:
The login process bombs out under macOS Catalina with the following error.

[E:pyppeteer.connection] connection unexpectedly closed
Task exception was never retrieved
future: <Task finished coro=<Connection._async_send() done, defined at /Users/xxxxxxx/.pyenv/versions/3.7.3/lib/python3.7/site-packages/pyppeteer/connection.py:69> exception=InvalidStateError('invalid state')>

Non headless mode logs in just fine.

"Azure username: None" ??

As soon as I enter aada login, it auto populates the Azure username: None, so I have no option to enter the username.
Any ideas?

$ aada login
Azure username: None
Azure password: Traceback (most recent call last):

AttributeError: 'coroutine' object has no attribute 'newPage' on login

Steps to reproduce

1. Set up profile
2. Run: aada login --profile profile_name
3. Enter Azure password

Result

Traceback (most recent call last): File "/usr/bin/aada", line 11, in <module> load_entry_point('aada==0.1.3', 'console_scripts', 'aada')() File "/usr/lib/python3.6/dist-packages/aada/cli.py", line 70, in main return cli.main() File "/usr/lib/python3.6/dist-packages/aada/cli.py", line 65, in main return self.__getattribute__('_{}'.format(self._parsed_args.command))() File "/usr/lib/python3.6/dist-packages/aada/cli.py", line 45, in _login return login() File "/usr/lib/python3.6/dist-packages/aada/login.py", line 65, in __call__ return self._login() File "/usr/lib/python3.6/dist-packages/aada/login.py", line 224, in _login self._azure_mfa)) File "/usr/lib64/python3.6/asyncio/base_events.py", line 467, in run_until_complete return future.result() File "/usr/lib/python3.6/dist-packages/aada/login.py", line 100, in _render_js_form page = await browser.newPage() AttributeError: 'coroutine' object has no attribute 'newPage' sys:1: RuntimeWarning: coroutine 'Launcher.launch' was never awaited

Environment

• Amazon Linux 2017.09
• Python 3.2.6
• Installed packages:
  aada==0.1.3
  awscli==1.14.54
  boto==2.48.0
  boto3==1.6.7
  botocore==1.9.7
  certifi==2018.1.18
  chardet==3.0.4
  colorama==0.3.7
  docutils==0.14
  idna==2.6
  jmespath==0.9.3
  jprops==2.0.2
  lxml==4.1.1
  pimento==0.7.1
  pkgconfig==1.3.1
  pyasn1==0.4.2
  pyee==5.0.0
  pyppeteer==0.0.13
  python-dateutil==2.7.0
  PyYAML==3.12
  requests==2.18.4
  rsa==3.4.2
  s3transfer==0.1.13
  saml==0.9.0
  six==1.11.0
  untangle==1.1.1
  urllib3==1.22
  virtualenv==15.1.0
  websockets==4.0.1
  xmlsec==1.3.3

WARNING: Generating metadata for package python-aada produced metadata for project name aada. Fix your #egg=python-aada fragments.

Hi, I am getting the following output when installing as per directions on the README. I am using virtualenv with a homebrew installed python3.7. The following is the output:

python-aada-install-error.txt