Merge branch 'master' into dev

Author: epierce

README.md

@@ -539,9 +539,11 @@ gimme-aws-creds can retrieve temporary Alibaba Cloud RAM credentials using the s
 
 1. **Okta Identity Engine** - Alibaba Cloud support requires the OIE Device Authorization flow. The Okta Classic flow is not supported.
 2. **Optional Alibaba Cloud SDK** - Install the optional dependency group:
+
    ```bash
    pip install "gimme-aws-creds[alicloud]"
    ```
+
    Without this extra, gimme-aws-creds will refuse to enable Alibaba Cloud and report a clear error pointing to the install command.
 3. **Okta application configuration** - In your Okta org, configure:
    - An Alibaba Cloud SAML app with the appropriate Alibaba Cloud RAM role mappings.
@@ -614,6 +616,7 @@ The authentication policies on the OIDC Native Application and the AWS/Alibaba C
 
 **`Alibaba Cloud is enabled but optional SDK packages are not installed`**
 You set `enable_alicloud = True` (or passed `--enable-alicloud`) but did not install the optional extra. Run:
+
 ```bash
 pip install "gimme-aws-creds[alicloud]"
 ```

gimme_aws_creds/config.py

@@ -325,6 +325,7 @@ def update_config_file(self):
                 okta_username = Okta username
                 aws_default_duration = Default AWS or Alibaba Cloud session duration in seconds (default: 3600)
                 preferred_mfa_type = (optional, Okta Classic only) Select this MFA device type automatically
+                preferred_mfa_factor_id = (optional, Okta Classic only) Pin a specific Okta factor by id (overrides preferred_mfa_type when matched)
                 include_path - (optional) includes the full role path to the role name for profile
                 enable_keychain = (optional, Okta Classic only) enable the use of the system keychain to store the user's password
                 enable_alicloud = (optional, OIE only) y/n - use Native-to-Web SSO scope for Alibaba Cloud RAM
@@ -350,6 +351,7 @@ def update_config_file(self):
             'resolve_aws_alias': 'n',
             'include_path': 'n',
             'preferred_mfa_type': '',
+            'preferred_mfa_factor_id': '',
             'remember_device': 'n',
             'aws_default_duration': '3600',
             'output_format': 'export',

gimme_aws_creds/main.py

@@ -779,6 +779,9 @@ def okta(self):
             if self.conf_dict.get('preferred_mfa_provider'):
                 okta.set_preferred_mfa_provider(self.conf_dict['preferred_mfa_provider'])
 
+            if self.conf_dict.get('preferred_mfa_factor_id'):
+                okta.set_preferred_mfa_factor_id(self.conf_dict['preferred_mfa_factor_id'])
+
             if self.conf_dict.get('duo_universal_factor'):
                 okta.set_duo_universal_factor(self.conf_dict.get('duo_universal_factor'))
 

gimme_aws_creds/okta_classic.py

@@ -76,6 +76,7 @@ def __init__(self, gac_ui, okta_org_url, verify_ssl_certs=True, device_token=Non
         self._password = None
         self._preferred_mfa_type = None
         self._preferred_mfa_provider = None
+        self._preferred_mfa_factor_id = None
         self._duo_universal_factor = 'Duo Push'
         self._mfa_code = None
         self._remember_device = None
@@ -113,6 +114,9 @@ def set_preferred_mfa_type(self, preferred_mfa_type):
     def set_preferred_mfa_provider(self, preferred_mfa_provider):
         self._preferred_mfa_provider = preferred_mfa_provider
 
+    def set_preferred_mfa_factor_id(self, preferred_mfa_factor_id):
+        self._preferred_mfa_factor_id = preferred_mfa_factor_id
+
     def set_mfa_code(self, mfa_code):
         self._mfa_code = mfa_code
 
@@ -813,6 +817,17 @@ def _choose_factor(self, factors):
             else:
                 preferred_factors = preferred_factors_with_preferred_provider
 
+        # Pin to a specific factor by its Okta factor id. Overrides the type/provider
+        # filters above when matched, since the id uniquely identifies one factor.
+        if self._preferred_mfa_factor_id is not None:
+            factor_id_matches = [item for item in factors if item.get('id') == self._preferred_mfa_factor_id]
+            if factor_id_matches:
+                preferred_factors = factor_id_matches
+            else:
+                self.ui.notify('Preferred factor id {!r} not found among {} enrolled factors.'.format(
+                    self._preferred_mfa_factor_id, len(factors)
+                ))
+
         if len(preferred_factors) == 1:
             factor_name = self._build_factor_name(preferred_factors[0])
             self.ui.info(factor_name + ' selected')
@@ -827,7 +842,7 @@ def _choose_factor(self, factors):
             for i, factor in enumerate(factors):
                 factor_name = self._build_factor_name(factor)
                 if factor_name != "":
-                    self.ui.info('[{}] {}'.format(i, factor_name))
+                    self.ui.info('[{}] {} (id: {})'.format(i, factor_name, factor.get('id')))
             selection = self._get_user_int_factor_choice(len(factors))
 
         # make sure the choice is valid

tests/test_okta_classic_client.py

@@ -1150,6 +1150,26 @@ def test_choose_non_number_factor_totp(self, mock_input):
         with self.assertRaises(errors.GimmeAWSCredsExitBase):
             result = self.client._choose_factor(self.factor_list)
 
+    def test_choose_factor_pinned_by_id(self):
+        """Pinning preferred_mfa_factor_id auto-selects the matching factor without prompting"""
+        self.client.set_preferred_mfa_factor_id(self.webauthn_factor['id'])
+        result = self.client._choose_factor(self.factor_list)
+        self.assertEqual(result, self.webauthn_factor)
+
+    @patch('builtins.input', return_value='0')
+    def test_choose_factor_pinned_by_id_miss_falls_back_to_prompt(self, mock_input):
+        """An unmatched factor id falls through to the interactive picker rather than failing"""
+        self.client.set_preferred_mfa_factor_id('no_such_factor_id')
+        result = self.client._choose_factor(self.factor_list)
+        self.assertEqual(result, self.sms_factor)
+
+    def test_choose_factor_pinned_by_id_overrides_type(self):
+        """A pinned factor id wins over preferred_mfa_type when both are set"""
+        self.client.set_preferred_mfa_type('push')
+        self.client.set_preferred_mfa_factor_id(self.webauthn_factor['id'])
+        result = self.client._choose_factor(self.factor_list)
+        self.assertEqual(result, self.webauthn_factor)
+
     def test_build_factor_name_sms(self):
         """ Test building a display name for SMS"""
         result = self.client._build_factor_name(self.sms_factor)