{"action":"opened","issue":{"url":"https://api.github.com/repos/aws/aws-cli/issues/3912","repository_url":"https://api.github.com/repos/aws/aws-cli","labels_url":"https://api.github.com/repos/aws/aws-cli/issues/3912/labels{/name}","comments_url":"https://api.github.com/repos/aws/aws-cli/issues/3912/comments","events_url":"https://api.github.com/repos/aws/aws-cli/issues/3912/events","html_url":"https://github.com/aws/aws-cli/issues/3912","id":407601393,"node_id":"MDU6SXNzdWU0MDc2MDEzOTM=","number":3912,"title":"Support for SAML authentication to get temporary credentials","user":{"login":"rebtelmiguel","id":47413582,"node_id":"MDQ6VXNlcjQ3NDEzNTgy","avatar_url":"https://avatars0.githubusercontent.com/u/47413582?v=4","gravatar_id":"","url":"https://api.github.com/users/rebtelmiguel","html_url":"https://github.com/rebtelmiguel","followers_url":"https://api.github.com/users/rebtelmiguel/followers","following_url":"https://api.github.com/users/rebtelmiguel/following{/other_user}","gists_url":"https://api.github.com/users/rebtelmiguel/gists{/gist_id}","starred_url":"https://api.github.com/users/rebtelmiguel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rebtelmiguel/subscriptions","organizations_url":"https://api.github.com/users/rebtelmiguel/orgs","repos_url":"https://api.github.com/users/rebtelmiguel/repos","events_url":"https://api.github.com/users/rebtelmiguel/events{/privacy}","received_events_url":"https://api.github.com/users/rebtelmiguel/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2019-02-07T09:13:07Z","updated_at":"2019-02-07T09:13:07Z","closed_at":null,"author_association":"NONE","body":"In my company we use GSuite as main Identity provider, having SAML integration to our AWS accounts, but this is limited to access to the console.\r\n\r\nCurrently we use temporary credentials for console login and CLI even for CodeCommit, which we retrieve using a 3rd party library (python and GO libs, such as saml2aws and samlapi) to execute the auth and retrieve of the keys stored in `~/.aws/credentials`\r\n\r\nAnother issue (3447) already requests this type of auth but for AWS SSO only. Maybe it could be implemented something more broad.\r\n\r\nPlease use as reference this session from Quint Van Deman in AWS re:Invent 2018, where he uses this type of approach. https://youtu.be/vbjFjMNVEpc?t=1238\r\n\r\nA known problem with the libraries I mentioned (samlapi and saml2aws) is that they parse the HTML of the response. Initially they didn’t support Captcha (in case Google would trigger), and now they have problems with Google Titan Keys.\r\n\r\nAlso for reference, the Snowflake authentication through CLI can use an external browser pointing to the IDP. With that approach, any kind of MFA or extra security handling will be covered by them. \r\n"}}
{"actor":{"display_login":"rebtelmiguel"}}