search

cevoaustralia / aws-google-auth

Provides AWS STS credentials based on Google Apps SAML SSO auth (what a jumble!)
MIT License
537 stars 181 forks source link

Add support for --bg-response challenge override #150

Closed ruimarinho closed 4 years ago

ruimarinho commented 4 years ago

Hi,

Recently, I have started experiencing an issue obtaining credentials with the usual fatal error of "Could not find SAML response, check your credentials". Debugging led me to believe it is connected with the fact that bgresponse is set to js_disabled, which is the input's default value before a javascript function call modifies it during submission.

This is the same behavior you will get if you attempt to authenticate with javascript disabled:

Screen Shot 2019-09-11 at 01 38 44

Some research suggests bg stands for Botguard, a reCaptcha (-like) service to score the reputation of the request.

I don't know if Google is getting more aggressive fighting bots and this is only a step forward in that direction, or if for some other reason my account started requiring elevated checks.

In any case, the only workaround I have found is to generate a bgresponse token once by invoking document.bg.invoke() in the web console on the login URL. This token can be persisted and at the moment I do not know for how long will it remain valid. This PR will detect a rejected signin attempt and prompt the user to restart the process with the --bg-response parameter set. In the future, this could be done interactively.

As far as I am aware, it is not possible to execute this javascript call inside python (using bs4 or other parser) since we're just parsing text. A headless browser would be required instead, leading to a complete refactor.

There might be other ways of fixing this, but what I have noticed is that as soon as you hit this dead wall, you'll be stuck without this PR.

Testing

  1. Clone this branch.
  2. Change directory to the cloned folder and run export PYTHONPATH="$(pwd)".
  3. Run python3 aws_google_auth/__init__.py.

carbon

coveralls commented 4 years ago

Coverage Status

Coverage increased (+0.2%) to 46.691% when pulling 64f22130619dbdfdc9be9d00aa6e58532cea0343 on ruimarinho:enhancement/bg-response into dd18ac63475a86c945169b0c83ddd2197c568bda on cevoaustralia:master.

ruimarinho commented 4 years ago

@stevemac007 any chance you could take a look at this?