search

aws / aws-tools-for-powershell

The AWS Tools for PowerShell lets developers and administrators manage their AWS services from the PowerShell scripting environment.
Apache License 2.0
235 stars 78 forks source link

ADFS setup works only on windows #134

Closed carathorys closed 2 years ago

carathorys commented 4 years ago

Provide a general summary of the issue in the Title above.

https://docs.aws.amazon.com/powershell/latest/userguide/saml-pst.html Following this guide, I've tried to set up SAML authentication on Mac OS 10.15.3 to use ADFS authentication.

If you're describing a bug, tell us what should happen. If you're suggesting a change/improvement, tell us how it should work.

When I'm trying to use Set-AWSSamlEndpoint or Set-AWSSamlRoleProfile cmdlet I'm getting the following error: 

Set-AWSSamlEndpoint : The encrypted store is not available.  This may be due to use of a non-Windows operating system or Windows Nano Server, or the current user account may not have its profile loaded.
At script.ps1:24 char:11
+ $epName = Set-AWSSamlEndpoint -Endpoint $AdFsUri -AuthenticationType  ...
+           ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo          : NotSpecified: (:) [Set-AWSSamlEndpoint], AmazonClientException
+ FullyQualifiedErrorId : Amazon.Runtime.AmazonClientException,Amazon.PowerShell.Common.SetSamlEndpointProfileCmdlet

If describing a bug, tell us what happens instead of the expected behavior. Include full errors, uncaught exceptions, stack traces, and relevant logs. If service responses are relevant, please include Fiddler-captured wirelogs. If suggesting a change/improvement, explain the difference from current behavior.

I've tried to dig into this, and I gave up digging in the AWSSDK (.NET Standard project, Amazon.Runtime.Internal.Settings.UserCrypto class), which uses DLLImport here and here and requires Crypt32.dll which is available only on windows.

Not required, but suggest a fix/reason for the bug, or ideas how to implement the addition or change.

It would be nice if these data wouldn't be encrypted using Crypt32.dll, or at least the documentations should mention that it doesn't work outside of windows.

Provide a self-contained, concise snippet of code that can be inserted into a PowerShell session to replicate the bug. Including business logic or unrelated code makes diagnosis more difficult.

Simply invoke Set-AWSSamlEndpoint or Set-AWSSamlRoleProfile cmdlet on MacOS, or Linux

How has this issue affected you? What are you trying to accomplish? Providing context helps us come up with a solution that is most useful in the real world. MacOS Catalina 10.15.3 Include as many relevant details about the environment where the bug was discovered.

Amazon Web Services SDK for .NET Core Runtime Version 3.3.104.22 Copyright 2009-2015 Amazon.com, Inc. or its affiliates. All Rights Reserved.

Release notes: https://github.com/aws/aws-tools-for-powershell/blob/master/CHANGELOG.md

This software includes third party software subject to the following copyrights:

stonegate27 commented 4 years ago

@carathorys I saw the same issue with my Macbook. Any suggestion?

ashishdhingra commented 3 years ago

Looks like the error this thrown by SettingsManager() -> EnsureAvailable(). Also as the bug mentions, the EnsureAvailable() makes call to UserCrypto.IsUserCryptAvailable() which P-Invokes Crypt32.dll::CryptProtectData().

Most probably a documentation update issue, need to seek inputs from developer.

github-actions[bot] commented 2 years ago

We have noticed this issue has not recieved attention in 1 year. We will close this issue for now. If you think this is in error, please feel free to comment and reopen the issue.

yevhenhnes commented 1 year ago

Did the issues resolved? I'm trying to use Set-AWSSamlEndpoint on Mac and have the same issue: Set-AWSSamlEndpoint: The encrypted store is not available. This may be due to use of a non-Windows operating system or Windows Nano Server, or the current user account may not have its profile loaded.