search

nathan-v / aws_okta_keyman

AWS Okta Keyman (Key Manager) - An AWS + Okta CLI for generating and managing local AWS API keys
https://nathanv.com
Other
59 stars 38 forks source link

Support for 3-number challenge when Okta Verify mobile app forces extra verification #81

Open SmithTM90 opened 3 years ago

SmithTM90 commented 3 years ago

Is your feature request related to a problem? Please describe. When attempting to use aws_okta_keyman, Okta Verify for Android determines that it is an "unusual" login attempt, and forces an additional layer of verification with the 3-number challenge. Unfortunately, this prevents further use of aws_okta_keyman

Describe the solution you'd like The CLI tool should be able to integrate with this 3-number challenge verification step, and report back the correct number to select in the Okta Verify mobile app so that users can get past this stage and be able to use aws_okta_keyman successfully when additional verification is required.

nathan-v commented 3 years ago

Hi @SmithTM90 I've never seen that issue or case. Do you have an Okta setting that causes this?

jasonmfehr commented 3 years ago

Hi @nathan-v we have this issue too. If Okta detects something amiss with the login attempt, it does an additional challenge. It could be a setting that our org uses, I am not sure though. The way we can cause the three number challenge to happen is by connecting to a VPN that routes outbound internet through a distant city.

nathan-v commented 2 years ago

If someone knows the setting required to cause this I can set it up in a test Okta to try and replicate. I'd love to be able to support this.

krichter commented 2 years ago

@nathan-v - I believe it's this setting: https://help.okta.com/oie/en-us/Content/Topics/identity-engine/authenticators/configure-okta-verify-options.htm

andre-nguyen commented 1 month ago

For some reason (maybe my org put these settings?) I'm getting the 3 number challenge all the time. Any way around this?

Pashtetollo commented 1 month ago

I created PR that fixes the issue for me by pulling the needed number from request status once the Okta issues 3-number challenge, couldn't find any Okta documentation for how to retrieve number challenge answer for this authentication method so just implemented solution by debugging the process. Feel free to rewrite or update it it as needed.

andre-nguyen commented 1 month ago

Alternatively, I've been pointed to this https://github.com/Nike-Inc/gimme-aws-creds which seems to work for me. Not clear if this is org dependent though.