search

fidelity / kconnect

Kubernetes Connection Manager CLI
https://fidelity.github.io/kconnect/
Apache License 2.0
220 stars 37 forks source link

fix: Browser IDP & Browser MFA support using saml2aws/v2 #650

Closed 0rax closed 6 months ago

0rax commented 7 months ago

What this PR does / why we need it:

This also allows users to use more complex 2FA methods, as well as adding support for browser IDPs. This is based on the work done in PR #350 which has been pretty stale.

Reading through the original PR and with https://github.com/Versent/saml2aws/pull/794 being merged, the need for a fork of saml2aws is no longer needed. I thus also updated the dependency to saml2aws to the current latest version (using go mod), allowing the submodule to be removed.

I also updated the logic in pkg/plugins/identity/saml/sp/aws/resolver.go to use the ProviderList already available in saml2aws so updating the dependency should also update the list of idp-provider supported.

In the end, I needed the dependency to be updated to be able to use g.co/sc as my 2FA provider in kconnect which works flawlessly in saml2aws.

image

The config used to test it is:

apiVersion: kconnect.fidelity.github.com/v1alpha1
kind: Configuration
spec:
  providers:
    eks:
      region: eu-west-3
      idp-protocol: saml
      idp-provider: GoogleApps
      idp-endpoint: https://accounts.google.com/o/saml2/initsso?idpid=XXXXXXXXX&spid=XXXXXXXXXXXX&forceauthn=false

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged): Fixes #349