search

onelogin / onelogin-aws-cli-assume-role

MIT License
29 stars 38 forks source link

Question: can assume onelogin user? #35

Closed ZsoltPath closed 3 years ago

ZsoltPath commented 3 years ago

Is it possible to assume a user with this package? If not, would it be possible to add the feature?

The application would be same as in the web UI.

pitbulk commented 3 years ago

This aws-cli assumes roles. It is similar to: https://docs.aws.amazon.com/cli/latest/reference/sts/assume-role.html https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html

If you are trying to use aws sso at aws cli, check: https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html

ZsoltPath commented 3 years ago

Sorry, I think I was confusing.

I meant to assume another OL user and then assume the AWS role assigned to that user. As I could do this on the web console.

pitbulk commented 3 years ago

This AWS-CLI uses OL API to interact with its services.

In order to retrieve the SAMLResponse to be used at AWS, this API endpoint is used: https://developers.onelogin.com/api-docs/1/saml-assertions/generate-saml-assertion

and that endpoint requires user username + password (+mfa). So it requires the user to know the other user credentials.

ZsoltPath commented 3 years ago

OK. I thought if it's working on one platform, it could work on another.