search

awslabs / ssosync

Populate AWS SSO directly with your G Suite users and groups using either a CLI or AWS Lambda
Apache License 2.0
512 stars 175 forks source link

Feature: Avoid impersonation #202

Open philomory opened 2 months ago

philomory commented 2 months ago

Issue #, if available:

192

Description of changes: Replaces --google-admin (and associated environment variables, template options) with --customer-id, while incorporating @behobu's changes from #192. This allows the app to function without needing to impersonate an Google Workspace admin user.

I'm not as confident in the CF/SAM changes as I am in the code changes; if desired, I have an alternative branch I can recreate the PR using, which only changes the app code, and which would allow you to handle the templates as you see fit.

Also note that as-implemented, the code currently replaces the --google-admin option with the --customer-id option. For my own purposes, this was acceptable, even desirable, but if retaining the option to do user impersonation is desirable it probably wouldn't be too hard to adjust things so you can pass either option (though not both).

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

philomory commented 2 months ago

I've just noticed that my editor seems to have made some unnecessary whitespace changes, I'll try to revert those.