Nike-Inc / gimme-aws-creds

A CLI that utilizes Okta IdP via SAML to acquire temporary AWS credentials
Apache License 2.0
920 stars 262 forks source link

Prevent bad device token #408

Closed longbowrocks closed 1 year ago

longbowrocks commented 1 year ago

Description

This PR does two things:

  1. It prevents gimme-aws-creds --configure from setting device_token to an invalid value.
  2. It forces device registration for any user that uses clasic okta with an invalid device token set.

Related Issue

407

Motivation and Context

I was getting double-MFAs. My config file contained device_token=. After some pondering, I decided the default value for a feature is likely not intended to break said feature.

How Has This Been Tested?

  1. gimme-aws-creds --configure && gimme-aws-creds && gimme-aws-creds without my changes. 2 MFAs on second gimme-creds.
  2. gimme-aws-creds && gimme-aws-creds without my changes. 2 MFAs on second gimme-creds.
  3. gimme-aws-creds --configure && sed -i'.bak' "s/device_token =.*//" ~/.okta_aws_login_config && gimme-aws-creds && gimme-aws-creds without my changes. 1 MFA on second gimme-creds.
  4. gimme-aws-creds --configure && gimme-aws-creds && gimme-aws-creds with my changes. 1 MFA on second gimme-creds.
  5. gimme-aws-creds && gimme-aws-creds with my changes. 1 MFA on second gimme-creds.

Types of changes

Checklist: