Can't authenticate if App-level MFA is turned on

[ostankin]

Summary

If the profile is connected to an Okta application that has Application Level MFA enabled, authentication fails.

OS: OS X 10.13.6
aws-okta version: aws-okta-v0.19.0-darwin-amd64 binary

Details

Prerequisites:

• Two Okta applications: one regular, one with MFA turned on.
  Both applications are assigned to a user with ID john.doe@example.com, and both provide full read-only access to an AWS account with ID 1234567891011.
• two profiles in ~/.aws/config for both applications:

[profile normal-app]
aws_saml_url = home/amazon_aws/XXXXXXXXXXX
role_arn = arn:aws:iam::1234567891011:role/

[profile app-with-mfa]
aws_saml_url = home/amazon_aws/YYYYYYYYYYYY
role_arn = arn:aws:iam::1234567891011:role/

Run results:

$ aws-okta -d exec normal-app -- aws ec2 describe-instances
DEBU[0000] Parsing config file /Users/john.doe/.aws/config
DEBU[0000] Using aws_saml_url from profile: normal-app
DEBU[0000] using okta provider
DEBU[0001] Failed to reuse session token, starting flow from start
DEBU[0001] Step: 1
DEBU[0001] Step: 2
DEBU[0001] Step: 3
DEBU[0004] Writing session for normal-app to keyring
DEBU[0004]  Using session HAAO, expires in 59m58.763470426s
...<successful command execution>

$ aws-okta -d exec app-with-mfa -- aws ec2 describe-instances
DEBU[0000] Parsing config file /Users/john.doe/.aws/config
DEBU[0000] Using aws_saml_url from profile: app-with-mfa
DEBU[0000] using okta provider
DEBU[0004] Failed to reuse session token, starting flow from start
DEBU[0004] Step: 1
DEBU[0005] Step: 2
DEBU[0005] Step: 3
Okta user john.doe@example.com does not have the AWS app added to their account.  Please contact your Okta admin to make sure things are configured properly.

[ewanlyall]

We are just starting to trial Okta with AWS and hit this issue today too. We use Okta for a bunch of apps and don't want to enable MFA globally, rather on a per-app basis.

I have tested that aws-okta works if we enforce MFA globally for all apps and it works nicely with Google Authenticator, Okta Verify etc.

However, if we enforce MFA only on the AWS Application itself, aws-okta fails with the same error as @ostankin describes.

[deiwin]

I proposed a solution in #83. If anybody wants to try it out before it's merged, then I've released a macOS binary that supports app-level MFA if you follow these instructions.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[dsundstrom]

Sad to see this one die on the vine. We were going to switch all our AWS access from local IAM access and assuming roles with MFA to this. The lack of support for application MFA has blocked us.

[nickatsegment]

Sad to see this one die on the vine. We were going to switch all our AWS access from local IAM access and assuming roles with MFA to this. The lack of support for application MFA has blocked us.

#83 was pretty close to being accepted and merged. If you wanna take some time to spruce it up, we can get it in. Also, I'd love to have a non-Segment volunteer to maintain it, since we wouldn't be using it ourselves, and it's a substantial chunk of code.

[dsundstrom]

Fair enough. The python solution from https://github.com/Nike-Inc/gimme-aws-creds works with app-level MFA and SAML, so it'd be worth seeing if there could a solution there. Switching away from SAML isn't something we can take on right now.

[ramamoob]

Any chance for supporting app level MFA. This feature will certainly be very useful.

[nickatsegment]

@ramamoob #63 (comment)