crowbar 0.4.10

Securily generates temporary AWS credentials through Identity Providers using SAML
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76

pub mod auth;
pub mod client;
pub mod factors;
pub mod login;
pub mod response;
pub mod verification;

use crate::config::app::AppProfile;
use crate::credentials::aws::AwsCredentials;
use crate::credentials::config::ConfigCredentials;
use crate::credentials::Credential;
use crate::providers::okta::client::Client;
use crate::providers::okta::login::LoginRequest;
use crate::saml;

use anyhow::{Context, Result};
use log::{debug, trace};

const API_AUTHN_PATH: &str = "api/v1/authn";

pub struct OktaProvider {
    client: Client,
    profile: AppProfile,
}

impl OktaProvider {
    pub fn new(profile: &AppProfile) -> Result<OktaProvider> {
        Ok(OktaProvider {
            client: Client::new(profile.clone())?,
            profile: profile.clone(),
        })
    }

    pub fn new_session(&mut self) -> Result<&Self> {
        let profile = &self.profile;
        let config_credentials =
            ConfigCredentials::load(profile).or_else(|_| ConfigCredentials::create(profile))?;

        let username = &profile.username;
        let password = &config_credentials.password;
        let login_response = self
            .client
            .login(&LoginRequest::from_credentials(
                username.clone(),
                password.clone(),
            ))
            .with_context(|| "Unable to login")?;

        trace!("Login response: {:?}", login_response);

        let session_token = self.client.get_session_token(login_response)?;

        config_credentials.write(profile)?;

        self.client.session_token = Some(session_token);
        Ok(self)
    }

    pub fn fetch_aws_credentials(&self) -> Result<AwsCredentials> {
        let profile = &self.profile;
        debug!("Requesting temporary STS credentials for {}", &profile.name);

        let url = profile.clone().request_url().unwrap();
        let input = self
            .client
            .get(url)
            .with_context(|| format!("Error getting SAML response for profile {}", profile.name))?
            .text()?;

        debug!("Text for SAML response: {:#?}", input);

        let credentials = saml::get_credentials_from_saml(input, profile.role.clone())?;
        trace!("Credentials: {:?}", credentials);
        Ok(credentials)
    }
}