search

prolane / samltoawsstskeys

Google Chrome Extension which converts a SAML 2.0 assertion to AWS STS Keys.
MIT License
139 stars 91 forks source link

Manual override the SessionDuration param if "Apply the SessionDuration requested" is set to No #31

Open nitrocode opened 5 years ago

nitrocode commented 5 years ago

Our AWS has a default of 1 hour session but allows up to 12 hours. The current SessionDuration doesn't seem to collect this maximum of 12 hours, goes to null, and AWS defaults to all generated credentials to one hour.

https://github.com/prolane/samltoawsstskeys/blob/master/background/script.js#L109

It would be nice if when we set Apply the SessionDuration requested to no, an input box could pop up to set an override value or is there a better way to dynamically get the maximum SessionDuration allowed by AWS?

etendards commented 5 years ago

This is the error when I try to go above 1 hour. I have to set the Extension option to "No" for it to work with Roles that have been set to higher than 1 hour. Since Okta is giving us a Role already, the assume role gets limited to 1 hour for all other roles you assume. But the first role from your IdP can be higher than 1 hour. https://forums.aws.amazon.com/thread.jspa?threadID=242680

"ValidationError: The requested DurationSeconds exceeds the 1 hour session limit for roles assumed by role chaining."