BC-ProfileNames (oktadev#73)

* Added WithOkta method and script, so that Terraform and other environments could connect to Okta and become Okta profiles.

* Added WithOkta method and script, so that Terraform and other environments could connect to Okta and become Okta profiles.

* Add withokta.bat batch file

out/withokta

@@ -0,0 +1,17 @@
+#!/bin/bash
+#
+# Copyright 2017 Okta
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http:https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+java -classpath .:oktaawscli.jar com.okta.tools.WithOkta $@

out/withokta.bat

@@ -0,0 +1,16 @@
+rem
+rem Copyright 2017 Okta
+rem
+rem Licensed under the Apache License, Version 2.0 (the "License");
+rem you may not use this file except in compliance with the License.
+rem You may obtain a copy of the License at
+rem
+rem http:https://www.apache.org/licenses/LICENSE-2.0
+rem
+rem Unless required by applicable law or agreed to in writing, software
+rem distributed under the License is distributed on an "AS IS" BASIS,
+rem WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+rem See the License for the specific language governing permissions and
+rem limitations under the License.
+rem
+java -classpath .;oktaawscli.jar com.okta.tools.WithOkta %*

src/main/java/com/okta/tools/OktaAwsCliAssumeRole.java

@@ -27,6 +27,7 @@
 import com.okta.tools.aws.settings.Configuration;
 import com.okta.tools.aws.settings.Credentials;
 import com.okta.tools.saml.*;
+import org.apache.commons.lang.StringUtils;
 import org.apache.http.HttpStatus;
 import org.apache.http.StatusLine;
 import org.apache.http.client.entity.UrlEncodedFormEntity;
@@ -39,6 +40,7 @@
 import org.apache.http.message.BasicNameValuePair;
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
+import org.ini4j.Profile;
 import org.json.JSONArray;
 import org.json.JSONException;
 import org.json.JSONObject;
@@ -67,16 +69,18 @@ final class OktaAwsCliAssumeRole {
  private final String oktaUsername;
  private final String oktaPassword;
  private final String awsRoleToAssume;
+ private final String oktaProfile;
 
- static OktaAwsCliAssumeRole createOktaAwsCliAssumeRole(String oktaOrg, String oktaAWSAppURL, String oktaAWSUsername, String oktaAWSPassword, String oktaAWSRoleToAssume) {
- return new OktaAwsCliAssumeRole(oktaOrg, oktaAWSAppURL, oktaAWSUsername, oktaAWSPassword, oktaAWSRoleToAssume);
+ static OktaAwsCliAssumeRole createOktaAwsCliAssumeRole(String oktaOrg, String oktaAWSAppURL, String oktaAWSUsername, String oktaAWSPassword,String oktaProfile, String oktaAWSRoleToAssume) {
+ return new OktaAwsCliAssumeRole(oktaOrg, oktaAWSAppURL, oktaAWSUsername, oktaAWSPassword,oktaProfile, oktaAWSRoleToAssume);
  }
 
- private OktaAwsCliAssumeRole(String oktaOrg, String oktaAWSAppURL, String oktaUsername, String oktaAWSPassword, String awsRoleToAssume) {
+ private OktaAwsCliAssumeRole(String oktaOrg, String oktaAWSAppURL, String oktaUsername, String oktaAWSPassword,String oktaProfile, String awsRoleToAssume) {
  this.oktaOrg = oktaOrg;
  this.oktaAWSAppURL = oktaAWSAppURL;
  this.oktaUsername = oktaUsername;
  this.oktaPassword = oktaAWSPassword;
+ this.oktaProfile = oktaProfile;
  this.awsRoleToAssume = awsRoleToAssume;
  }
 
@@ -387,7 +391,6 @@ private Document getSigninPageDocument(String samlResponse) throws IOException {
  }
 
  private String createAwsProfile(AssumeRoleWithSAMLResult assumeResult) throws IOException {
- String credentialsProfileName = assumeResult.getAssumedRoleUser().getArn();
  BasicSessionCredentials temporaryCredentials =
  new BasicSessionCredentials(
  assumeResult.getCredentials().getAccessKeyId(),
@@ -398,15 +401,24 @@ private String createAwsProfile(AssumeRoleWithSAMLResult assumeResult) throws IO
  String awsSecretKey = temporaryCredentials.getAWSSecretKey();
  String awsSessionToken = temporaryCredentials.getSessionToken();
 
- if (credentialsProfileName.startsWith("arn:aws:sts::")) {
- credentialsProfileName = credentialsProfileName.substring(13);
- }
- if (credentialsProfileName.contains(":assumed-role")) {
- credentialsProfileName = credentialsProfileName.replaceAll(":assumed-role", "");
- }
-
+ String credentialsProfileName = getProfileName(assumeResult);
  updateCredentialsFile(credentialsProfileName, awsAccessKey, awsSecretKey, awsSessionToken);
+ return credentialsProfileName;
+ }
 
+ private String getProfileName(AssumeRoleWithSAMLResult assumeResult) {
+ String credentialsProfileName;
+ if(StringUtils.isNotBlank(oktaProfile)) {
+ credentialsProfileName = oktaProfile;
+ } else {
+ credentialsProfileName = assumeResult.getAssumedRoleUser().getArn();
+ if (credentialsProfileName.startsWith("arn:aws:sts::")) {
+ credentialsProfileName = credentialsProfileName.substring(13);
+ }
+ if (credentialsProfileName.contains(":assumed-role")) {
+ credentialsProfileName = credentialsProfileName.replaceAll(":assumed-role", "");
+ }
+ }
  return credentialsProfileName;
  }
 

src/main/java/com/okta/tools/OktaAwsConfig.java

@@ -0,0 +1,37 @@
+package com.okta.tools;
+
+import java.io.FileInputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.InputStreamReader;
+import java.util.Properties;
+
+final class OktaAwsConfig {
+ static OktaAwsCliAssumeRole createAwscli() throws IOException {
+ Properties properties = new Properties();
+ InputStream config;
+ try {
+ config = new FileInputStream("config.properties");
+ } catch (IOException ex) {
+ // Fallback to classpath input stream
+ config = properties.getClass().getResourceAsStream("/config.properties");
+ }
+ properties.load(new InputStreamReader(config));
+
+ return OktaAwsCliAssumeRole.createOktaAwsCliAssumeRole(
+ getEnvOrConfig(properties, "OKTA_ORG"),
+ getEnvOrConfig(properties, "OKTA_AWS_APP_URL"),
+ getEnvOrConfig(properties, "OKTA_USERNAME"),
+ getEnvOrConfig(properties, "OKTA_PASSWORD"),
+ getEnvOrConfig(properties, "OKTA_PROFILE"),
+ getEnvOrConfig(properties, "OKTA_AWS_ROLE_TO_ASSUME")
+
+ );
+ }
+
+ private static String getEnvOrConfig(Properties properties, String propertyName) {
+ String envValue = System.getenv(propertyName);
+ return envValue != null ?
+ envValue : properties.getProperty(propertyName);
+ }
+}

src/main/java/com/okta/tools/WithOkta.java

@@ -0,0 +1,32 @@
+package com.okta.tools;
+
+import java.time.Instant;
+
+/*
+ * Copyright 2017 Okta
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http:https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+
+public class WithOkta {
+ public static void main(String[] args) throws Exception {
+ OktaAwsConfig.createAwscli().run(Instant.now());
+ ProcessBuilder awsProcessBuilder = new ProcessBuilder().inheritIO().command(args);
+ Process awsSubProcess = awsProcessBuilder.start();
+ int exitCode = awsSubProcess.waitFor();
+ System.exit(exitCode);
+ }
+
+}
+

src/main/java/com/okta/tools/awscli.java

@@ -15,10 +15,6 @@
  */
 package com.okta.tools;
 
-import java.io.FileInputStream;
-import java.io.IOException;
-import java.io.InputStream;
-import java.io.InputStreamReader;
 import java.time.Instant;
 import java.util.*;
 
@@ -30,7 +26,7 @@ public static void main(String[] args) throws Exception {
  System.exit(0);
  return;
  }
- String profileName = createAwscli().run(Instant.now());
+ String profileName = OktaAwsConfig.createAwscli().run(Instant.now());
  List<String> awsCommand = new ArrayList<>();
  awsCommand.add("aws");
  awsCommand.add("--profile");
@@ -40,31 +36,5 @@ public static void main(String[] args) throws Exception {
  Process awsSubProcess = awsProcessBuilder.start();
  int exitCode = awsSubProcess.waitFor();
  System.exit(exitCode);
- }
-
- private static OktaAwsCliAssumeRole createAwscli() throws IOException {
- Properties properties = new Properties();
- InputStream config;
- try {
- config = new FileInputStream("config.properties");
- } catch (IOException ex) {
- // Fallback to classpath input stream
- config = properties.getClass().getResourceAsStream("/config.properties");
  }
- properties.load(new InputStreamReader(config));
-
- return OktaAwsCliAssumeRole.createOktaAwsCliAssumeRole(
- getEnvOrConfig(properties, "OKTA_ORG"),
- getEnvOrConfig(properties, "OKTA_AWS_APP_URL"),
- getEnvOrConfig(properties, "OKTA_USERNAME"),
- getEnvOrConfig(properties, "OKTA_PASSWORD"),
- getEnvOrConfig(properties, "OKTA_AWS_ROLE_TO_ASSUME")
- );
- }
-
- private static String getEnvOrConfig(Properties properties, String propertyName) {
- String envValue = System.getenv(propertyName);
- return envValue != null ?
- envValue : properties.getProperty(propertyName);
- }
 }