Browser based login

[anthonyangel]

Is there a possibility of the CLI opening up a browser page for a UI login? (the equivalent of what the OKTA_BROWSER_AUTH flag would achieve in https://github.com/oktadeveloper/okta-aws-cli-assume-role

I'd have a preference for logging in with a browser rather than copying my password into a terminal (or saving it)

[jarmbruster74]

Went looking for this as well - try saml2aws console
Love it when it's already there :-)

[anthonyangel]

@jarmbruster74 That command will launch an authenticated console session in a browser from the CLI - what I was searching for here is different, it would be a way of starting the login from from the CLI, but then providing authentication credentials via a browser (so that I can use a password manager)

[clausa]

A browser based login would also allow for IdP brokering setups.
If you for instance, have KeyCloak configured as an identity broker and redirects authentication requests to G-Suite (or other IdPs), saml2aws will fail.

[musabmasood]

We're behind Okta for a lot of stuff, this would definitely help pasting passwords/codes in the terminal.

[mvgijssel]

Would love this as well! We are coming from https://github.com/segmentio/aws-okta which opened a browser window for OKTA authentication.

[merusso]

The implementation for this feature downloads independent browser binaries to a cache directory, then launches Chromium.

2023/01/18 10:01:36 Downloading driver to /Users/mrusso/Library/Caches/ms-playwright-go/1.14.0
2023/01/18 10:01:38 Downloaded driver successfully
2023/01/18 10:01:38 Downloading browsers...
Downloading Playwright build of chromium v907428 - 117.5 Mb [====================] 100% 0.0s 
Playwright build of chromium v907428 downloaded to /Users/mrusso/Library/Caches/ms-playwright/chromium-907428
Downloading Playwright build of ffmpeg v1005 - 1.3 Mb [====================] 100% 0.0s 
Playwright build of ffmpeg v1005 downloaded to /Users/mrusso/Library/Caches/ms-playwright/ffmpeg-1005
Downloading Playwright build of firefox v1281 - 74.7 Mb [====================] 100% 0.0s 
Playwright build of firefox v1281 downloaded to /Users/mrusso/Library/Caches/ms-playwright/firefox-1281
Downloading Playwright build of webkit v1530 - 53.6 Mb [====================] 100% 0.0s 
Playwright build of webkit v1530 downloaded to /Users/mrusso/Library/Caches/ms-playwright/webkit-1530
2023/01/18 10:02:09 Downloaded browsers successfully

It would be nice if the system's default browser could be used instead. This is a fairly common pattern for browser-based logins used for other apps, like Slack, VS Code, GitHub, etc.

Is there some technical limitation that restricted the capability to use the system's default browser? @wolfeidau, any insight would be greatly appreciated.

I found a feature request for what I'm asking here: #729

[dannysauer]

#729 was closed; is this ticket still needed?

[seppestas]

@dannysauer yes, this ticket is different from #729 and #815.

The key difference is that SAML2AWS currently uses a sandboxed Playwright session, regardless of what browser type is used. Instead, what a lot of people are really asking for is a non-sandboxed browser instance. Typically (e.g. in okta-aws) this is done by starting a small HTTP server in the CLI app that can retrieve callbacks from the log in action.

It should also be possible to achieve the same by using a non-sandboxed Playwright session, but I'm not a big fan of this, as it gives saml2aws full access to the user's browser (and I think it might be even impossible by design, at least, I kind of hope it is).

The disadvantage of this would be that saml2aws no longer dictates the "user" that is used to log in, kind of breaking the "profile" system.

However, it has 2 mayor benefits:

• The browser's password manager can be used to easily log in to any saved user
• If a SSO session already exist, the user no longer has to sign in again. The browser can just create a new STS key for the session and pass it to SAML2AWS

I suggest renaming this issue to "non-Playwright browse based login" or "non-sandboxed browser based login".