Conversation
… usage in the codebase
- Introduced a default HTTP timeout of 30 seconds in both OktaClassicClient and OktaIdentityEngine. - Enhanced error handling for JSON responses to raise specific errors when invalid data is encountered. - Updated methods to ensure timeout is applied consistently across HTTP requests. - Improved safety in accessing nested response data to prevent KeyErrors.
… configuration - Implemented tests to ensure that environment variables (OKTA_USERNAME, OKTA_API_KEY) correctly override values in the configuration file. - Added tests to verify that CLI arguments for username, profile, and output format take precedence over both environment variables and config file settings. - Included tests for profile inheritance, ensuring proper error handling for non-existent profiles and circular references. - Validated reading of configuration files with various formats and handling of empty values gracefully.
…lity and security
- Add comprehensive keyring tests covering enabled/disabled scenarios - Add tests for password storage/retrieval/deletion flows - Add tests for FailKeyring detection and error handling - Add deprecation warning verification tests (AC #5) - Fix code review findings: HIGH issues #1, #2 and MEDIUM issues #4 Addresses story 2-3 code review findings.
- Updated the authorization header in both OktaClassicClient and OktaIdentityEngine to use the OAuth ID token instead of the access token when the _use_oauth_id_token flag is set to True.
- Updated furl from >=2.1.3 to >=2.1.4 in requirements.txt - All tests passing (103/103) - No deprecation warnings - Verified furl API compatibility (constructor, / operator, .origin, .url properties)
- Updated docs/project-overview.md to match requirements.txt version
- Changed base image in Dockerfile from python:3.8-alpine to python:3.10-alpine - Updated python_requires in setup.py to >=3.10 - Expanded .dockerignore and .gitignore to exclude additional files and directories
- Updated the timeout condition to check if token_response is None when max_iterations is reached, ensuring proper error handling during device authorization.
- Modified the Python version matrix in the GitHub Actions workflow to include newer versions, ensuring compatibility with the latest Python releases.
- Upgraded actions/checkout from v4 to v5 and v6 in different steps. - Updated CodeQL actions from v3 to v6 for improved scanning capabilities. - Enhanced setup-python action from v5 to v6 to ensure compatibility with the latest Python versions.
…ncements - Removed the requirement to submit the Individual Contributor License Agreement from CONTRIBUTING.md. - Expanded the development guide with detailed steps for the release process, including version updates, GitHub release creation, Homebrew formula updates, and post-release tasks.
- Implemented a specific error message for 401 responses in the OktaIdentityEngine class, indicating that the client_id is not authorized for the Device Authorization flow. - Added a unit test to verify that the appropriate error message is raised when a 401 error occurs during the device flow initiation.
- Introduced a debug flag in the Config class to enable or disable debug logging. - Implemented debug logging setup in GimmeAWSCreds, OktaClassicClient, and OktaIdentityEngine to log HTTP requests and responses when the debug flag is enabled. - Updated unit tests to include the new debug parameter in configuration.
- Introduced a specific error message for 400 responses in the OktaIdentityEngine class, indicating that the token exchange has failed. - This enhancement improves the clarity of error reporting during the authentication process.
- Updated requirements_dev.txt to include the Alibaba Cloud SDK for STS tests. - Enhanced setup.py to define an 'alicloud' extra requirement for the SDK. - Modified the Config class to support Alibaba Cloud configuration options, including a new command-line argument for enabling Alibaba Cloud support. - Updated GimmeAWSCreds to handle Alibaba Cloud credentials and role naming. - Added unit tests to verify the new Alibaba Cloud functionality and configuration handling.
- Introduced a maximum session duration constant for AssumeRoleWithSAML, ensuring compliance with Alibaba Cloud's limits. - Updated the GimmeAWSCreds class to support writing Alibaba Cloud credentials to a JSON configuration file. - Refactored methods for writing AWS and Alibaba Cloud credentials, improving code clarity and functionality. - Enhanced unit tests to validate changes in SAML response handling and credential writing for Alibaba Cloud.
- Updated the Python version requirement in README.md from 3.7+ to 3.10+. - Refactored common functions in common.py to improve code organization and reusability, including user agent and request header generation. - Enhanced the handling of SAML responses and role attributes across multiple files, improving code clarity and maintainability. - Updated various classes to utilize the new common functions for consistency in HTTP requests and SAML processing.
- Updated README.md to include support for Alibaba Cloud RAM credentials via Okta SAML flow. - Expanded architecture documentation to reflect changes in credential retrieval for both AWS and Alibaba Cloud. - Revised development guide to specify Python version requirement as 3.10 or higher. - Added detailed instructions for enabling Alibaba Cloud support in configuration files. - Improved clarity in various documentation files regarding the integration and usage of Alibaba Cloud features.
… AWS - Modified CLI argument descriptions to clarify support for both AWS and Alibaba Cloud. - Enhanced documentation for optional parameters related to Alibaba Cloud credentials. - Improved user prompts for credential writing and profile naming to reflect the dual-cloud functionality.
- Added support for retrieving the Okta authentication server entry in the Config class. - Ensured proper handling of the Okta authentication server configuration for both classic and non-classic setups.
- Introduced tracking for environment variables and CLI flags that override profile values, enabling detailed output for --debug mode. - Added methods to log resolved configuration, including how each value was determined. - Updated Config class to maintain records of environment variables used during initialization and the inheritance chain of profiles. - Enhanced DebugFormatter to redact sensitive information in debug output. - Updated tests to verify the new debug logging features and ensure sensitive data is not exposed.
- Introduced a new optional configuration parameter `alicloud_region` to specify the Alibaba Cloud STS region for AssumeRoleWithSAML. - Updated the Config class to include default value handling for `alicloud_region`. - Added a method to prompt users for the Alibaba Cloud STS region during configuration setup.
- Upgraded the Okta SDK dependency from version 2.9.13 to 3.4.2 - Refactored the AWS account information retrieval to utilize the new Okta management client, improving error handling with specific exceptions. - Added a static method to summarize Okta API errors for better debugging and user feedback.
Document the new optional configuration key `preferred_mfa_factor_id`, which allows users to pin a specific MFA factor by its Okta factor id, enhancing the MFA selection process.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Add support for authentication to Alibaba Cloud accounts in addition to AWS
Motivation and Context
We have teams using Alibaba Cloud accounts in addition to AWS. AliClo
ud authentication is very similar to AWS, so support was added to this tool instead of forking and creating a parallel project.
How Has This Been Tested?
Tests are included
Live testing with multiple AWS, AWS-CN and AliCloud accounts
Screenshots (if appropriate):
Types of changes
Checklist: