search

whilenull / 7777-support

Documentation and support for 7777.
https://port7777.com
53 stars 3 forks source link

Support for SSO Config #24

Open flemzord opened 2 years ago

flemzord commented 2 years ago

Hello,

I have the same error as issue #15 & #21 . It's possible to add support for SSO login ?

Regards, Maxence

mnapoli commented 2 years ago

Hello! Just to clarify, SSO is unfortunately not supported at the moment.

To anyone reading this: if you are interested in SSO support feel free to add a 👍 on this issue (we can track interest that way).

shadowhand commented 2 years ago

Just FYI to anyone else that lands here, you can use SSO if you also use aws-vault:

aws-vault exec -- 7777
pooley182 commented 1 year ago

Is this on the roadmap at all? We're transitioning all of our staff away from traditional credentials in favour of SSO. We'd love to still be able to use this application with SSO support

mnapoli commented 1 year ago

To be honest, I would love to have this as well. I've been using https://github.com/ryansonshine/aws-sso-creds-helper and run that command before running 7777/doing anything with the SSO profile. That's not ideal but it works.

I looked at this last week, but I haven't figured out how to address that. We are using the AWS SDK v2, and it is marked compatible with SSO. But I suspect we might need a prompt or similar, I just haven't found the docs that explain this. If one of you have done this before, any link would be welcome.

shadowhand commented 1 year ago

@mnapoli I did a bit of digging and the only official programatic SSO initiation documentation I was able to find was for .NET, but it might be helpful:

https://docs.aws.amazon.com/sdk-for-net/v3/developer-guide/sso.html

I also found this StackOverflow answer for performing an SSO flow using the Python (boto) SDK:

https://stackoverflow.com/a/71850591

Perhaps between these two code samples you'll be able to figure out how to do it with JS.

shadowhand commented 1 year ago

From a very high level, I think the flow would look like:

  1. User selects a profile
  2. 7777 looks to see if the sso_* variables are defined in the profile config
  3. use the sso_start_url to determine where to initiate the SSO flow
  4. use background polling to determine when the SSO credentials are available, similar to OAuth device flow
  5. once credentials are available, store them in memory for the rest of the session
  6. operate as normal