{"action":"created","issue":{"url":"https://api.github.com/repos/oktadeveloper/okta-aws-cli-assume-role/issues/257","repository_url":"https://api.github.com/repos/oktadeveloper/okta-aws-cli-assume-role","labels_url":"https://api.github.com/repos/oktadeveloper/okta-aws-cli-assume-role/issues/257/labels{/name}","comments_url":"https://api.github.com/repos/oktadeveloper/okta-aws-cli-assume-role/issues/257/comments","events_url":"https://api.github.com/repos/oktadeveloper/okta-aws-cli-assume-role/issues/257/events","html_url":"https://github.com/oktadeveloper/okta-aws-cli-assume-role/issues/257","id":395431187,"node_id":"MDU6SXNzdWUzOTU0MzExODc=","number":257,"title":"Why is Okta SAML so slow compared to a naive implementation?","user":{"login":"dunindd","id":43970647,"node_id":"MDQ6VXNlcjQzOTcwNjQ3","avatar_url":"https://avatars1.githubusercontent.com/u/43970647?v=4","gravatar_id":"","url":"https://api.github.com/users/dunindd","html_url":"https://github.com/dunindd","followers_url":"https://api.github.com/users/dunindd/followers","following_url":"https://api.github.com/users/dunindd/following{/other_user}","gists_url":"https://api.github.com/users/dunindd/gists{/gist_id}","starred_url":"https://api.github.com/users/dunindd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dunindd/subscriptions","organizations_url":"https://api.github.com/users/dunindd/orgs","repos_url":"https://api.github.com/users/dunindd/repos","events_url":"https://api.github.com/users/dunindd/events{/privacy}","received_events_url":"https://api.github.com/users/dunindd/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2019-01-03T01:17:30Z","updated_at":"2019-01-03T13:33:33Z","closed_at":null,"author_association":"NONE","body":"**Describe the bug**\r\nCalling `withOkta` while `cookies.properties` is present is 3-7x slower than a naive implementation. I have also noticed that `com.okta.tools.authentication.BrowserAuthentication.login()` seems to be a bit slower than `com.okta.tools.saml.OktaSaml.getSamlResponseForAwsRefresh()`, but I don't quite understand why. Ideally, they would be using the same code when `cookies.properties` is present and valid. A browser only needs to be opened if the cookie values are stale or a user needs to refresh their session.\r\n\r\n**To Reproduce**\r\n```\r\n$ time okta-aws my-profile sts get-caller-identity\r\nreal    0m9.853s\r\nuser    0m6.332s\r\nsys    0m0.470s\r\n```\r\n\r\n```\r\n$ time pipenv run python2 get_sts_token.py \r\nreal    0m1.911s\r\nuser    0m0.507s\r\nsys    0m0.224s\r\n```\r\n\r\n**Expected behavior**\r\nI would expect the Okta SAML implementation to be as fast, or faster than the Python implementation.\r\n\r\n**Additional context**\r\n```\r\nimport boto3\r\nimport botocore\r\nimport os\r\nimport datetime\r\nimport json\r\nimport urllib2\r\nimport re\r\nimport HTMLParser\r\nfrom subprocess import call\r\n\r\ndef main():\r\n    cookes_file_path = '{0}/.okta/cookies.properties'.format(os.path.expanduser('~'))\r\n    saml_re = re.compile(r'^\\s*<input name=\"SAMLResponse\"')\r\n    html_parser = HTMLParser.HTMLParser()\r\n    role_arn = 'arn:aws:iam::1234567890:role/MY_ROLE'\r\n    principal_arn = 'arn:aws:iam::1234567890:saml-provider/Okta'\r\n    region = 'us-east-1'\r\n\r\n    with open(cookes_file_path, \"r\") as cookies_file:\r\n        lines = cookies_file.readlines()\r\n        opener = urllib2.build_opener()\r\n\r\n        cookies = [l.replace('\\n', '') for l in filter(lambda x: x.find('#') == -1, lines)]\r\n\r\n        opener.addheaders.append(('Cookie', '; '.join(cookies)))\r\n\r\n        resp = opener.open('https://company.okta.com/app/amazon_aws/abc1234567890exz/sso/saml')\r\n\r\n        if resp.getcode() == 200:\r\n            dom_lines = resp.readlines()\r\n            START_STR = 'value=\"'\r\n            END_STR = '\"/>'\r\n            saml_response_line = filter(lambda x: saml_re.match(x), dom_lines)[0].replace('\\n','')\r\n            saml_response = html_parser.unescape(saml_response_line[saml_response_line.find(START_STR)+len(START_STR):saml_response_line.find(END_STR)])\r\n\r\n            bs = botocore.session.get_session({ 'profile': ( None, ['', ''], None, None ) })\r\n            bs.set_credentials('','','')\r\n            s = boto3.session.Session(botocore_session = bs)\r\n            client = s.client('sts', region_name = region)\r\n\r\n            assumed_role = client.assume_role_with_saml(RoleArn=role_arn, PrincipalArn=principal_arn, SAMLAssertion=saml_response)\r\n\r\n            bs = botocore.session.get_session({ 'profile': ( None, ['', ''], None, None ) })\r\n            bs.set_credentials(assumed_role['Credentials'][u'AccessKeyId'],\r\n                               assumed_role['Credentials'][u'SecretAccessKey'],\r\n                               assumed_role['Credentials'][u'SessionToken'])\r\n            s = boto3.session.Session(botocore_session = bs)\r\n            client = s.client('sts', region_name = region)\r\n\r\n            print(client.get_caller_identity())\r\n        else:\r\n            call(['get-okta-sts-token', '-r MY-PROFILE'])\r\n\r\n\r\nif __name__ == \"__main__\":\r\n    main()\r\n```"},"comment":{"url":"https://api.github.com/repos/oktadeveloper/okta-aws-cli-assume-role/issues/comments/451143836","html_url":"https://github.com/oktadeveloper/okta-aws-cli-assume-role/issues/257#issuecomment-451143836","issue_url":"https://api.github.com/repos/oktadeveloper/okta-aws-cli-assume-role/issues/257","id":451143836,"node_id":"MDEyOklzc3VlQ29tbWVudDQ1MTE0MzgzNg==","user":{"login":"AlainODea","id":16341,"node_id":"MDQ6VXNlcjE2MzQx","avatar_url":"https://avatars1.githubusercontent.com/u/16341?v=4","gravatar_id":"","url":"https://api.github.com/users/AlainODea","html_url":"https://github.com/AlainODea","followers_url":"https://api.github.com/users/AlainODea/followers","following_url":"https://api.github.com/users/AlainODea/following{/other_user}","gists_url":"https://api.github.com/users/AlainODea/gists{/gist_id}","starred_url":"https://api.github.com/users/AlainODea/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/AlainODea/subscriptions","organizations_url":"https://api.github.com/users/AlainODea/orgs","repos_url":"https://api.github.com/users/AlainODea/repos","events_url":"https://api.github.com/users/AlainODea/events{/privacy}","received_events_url":"https://api.github.com/users/AlainODea/received_events","type":"User","site_admin":false},"created_at":"2019-01-03T13:33:33Z","updated_at":"2019-01-03T13:33:33Z","author_association":"COLLABORATOR","body":"It’s possible that the JSoup piece (parsing the HTML) is slow. It’s definitely heavier than indexOf and substring. I prefer using a parser and rules from SAML 2.0 itself to landmarking.\r\n\r\nThe other piece is the performance of the AWS SDK for Java. It’s possible that AssumeRoleWithSaml is faster in boto3.\r\n\r\nI think this tool also parses the SAMLResponse prior to running AssumeRoleWithSAML. That is definitely not needed once the role ARN is known."}}
{"actor":{"display_login":"AlainODea"}}