Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Handle unknown SAML providers #933

Open
wants to merge 5 commits into
base: main
Choose a base branch
from
Open

Handle unknown SAML providers #933

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
e8436bd
Soft-code SAML providers and tolerate unknown ones when generating re…
jtyers Nov 6, 2020
886692b
Merge branch 'main' of https://github.com/duo-labs/cloudmapper into w…
jtyers Nov 6, 2020
d5e2b00
fix typo
jtyers Nov 6, 2020
aef0520
move to YAML-based config for providers
jtyers Nov 6, 2020
c0501b6
Merge branch 'main' into weboftrust-handle-unknown
jtyers Aug 31, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
105 changes: 17 additions & 88 deletions commands/weboftrust.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@
query_aws,
get_regions,
get_account_by_id,
get_saml_providers,
)

__description__ = "Create Web Of Trust diagram for accounts"
Expand Down Expand Up @@ -209,99 +210,27 @@ def get_iam_trusts(account, nodes, connections, connections_to_get):
):
saml_provider_arn = saml["Arn"]

if "saml-provider/okta" in saml_provider_arn.lower():
node = Account(
json_blob={"id": "okta", "name": "okta", "type": "Okta"}
)
assume_role_nodes.add(node)
elif "saml-provider/onelogin" in saml_provider_arn.lower():
node = Account(
json_blob={
"id": "onelogin",
"name": "onelogin",
"type": "Onelogin",
}
)
assume_role_nodes.add(node)
elif "saml-provider/waad" in saml_provider_arn.lower():
node = Account(
json_blob={
"id": "WAAD",
"name": "WAAD",
"type": "waad",
}
)
assume_role_nodes.add(node)
elif "saml-provider/allcloud-sso" in saml_provider_arn.lower():
node = Account(
json_blob={
"id": "AllCloud-SSO",
"name": "AllCloud-SSO",
"type": "AllCloud-SSO",
}
)
assume_role_nodes.add(node)
elif "saml-provider/awssso" in saml_provider_arn.lower():
node = Account(
json_blob={
"id": "AWSSSO",
"name": "AWS SSO",
"type": "Amazon",
}
)
assume_role_nodes.add(node)
elif "saml-provider/adfs" in saml_provider_arn.lower():
node = Account(
json_blob={"id": "adfs", "name": "adfs", "type": "ADFS"}
)
assume_role_nodes.add(node)
elif "saml-provider/auth0" in saml_provider_arn.lower():
node = Account(
json_blob={
"id": "auth0",
"name": "auth0",
"type": "auth0",
}
)
assume_role_nodes.add(node)
elif "saml-provider/google" in saml_provider_arn.lower():
node = Account(
json_blob={
"id": "google",
"name": "google",
"type": "google",
}
)
assume_role_nodes.add(node)
elif "saml-provider/gsuite" in saml_provider_arn.lower():
found = False
for p in get_saml_providers():
if p["name"] in saml_provider_arn.lower():
found = True
if p.get("node") != None:
node = Account(**p["node"])

if p.get("assumed"):
assume_role_nodes.add(node)

break

if not found:
node = Account(
json_blob={
"id": "gsuite",
"name": "gsuite",
"type": "gsuite",
"id": "unknown",
"name": "saml-unknown",
"type": "saml-unknown",
}
)
assume_role_nodes.add(node)
elif (
"cognito-identity.amazonaws.com"
in saml_provider_arn.lower()
):
continue
elif "www.amazon.com" in saml_provider_arn.lower():
node = Account(
json_blob={
"id": "Amazon.com",
"name": "Amazon.com",
"type": "Amazon",
}
)
continue
else:
raise Exception(
"Unknown federation provider: {}".format(
saml_provider_arn.lower()
)
)

except (StopIteration, IndexError):
if (
Expand Down
73 changes: 73 additions & 0 deletions saml_providers.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,73 @@
- name: saml-provider/okta
node:
json_blob:
id: okta
name: okta
type: Okta
assumed: true

- name: saml-provider/onelogin
node:
json_blob:
id: onelogin
name: onelogin
type: Onelogin
assumed: true

- name: saml-provider/waad
node:
json_blob:
id: WAAD
name: WAAD
type: waad
assumed: true

- name: saml-provider/allcloud-sso
node:
json_blob:
id: AllCloud-SSO
name: AllCloud-SSO
type: AllCloud-SSO
assumed: true

- name: saml-provider/adfs
node:
json_blob:
id: adfs
name: adfs
type: ADFS
assumed: true

- name: saml-provider/auth0
node:
json_blob:
id: auth0
name: auth0
type: auth0
assumed: true

- name: saml-provider/google
node:
json_blob:
id: google
name: google
type: google
assumed: true

- name: saml-provider/gsuite
node:
json_blob:
id: gsuite
name: gsuite
type: gsuite
assumed: true

- name: cognito-identity.amazonaws.com
node: null

- name: www.amazon.com
node:
json_blob:
id: Amazon.com
name: Amazon.com
type: Amazon
7 changes: 7 additions & 0 deletions shared/common.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -261,6 +261,13 @@ def parse_arguments(arguments, parser=None):
return (args, accounts, config)


def get_saml_providers():
"""Returns support SAML providers"""

with open("saml_providers.yaml", "r") as f:
return yaml.safe_load(f)


def get_account_stats(account, all_resources=False):
"""Returns stats for an account"""

Expand Down