Testing Discussion for Next Version

[BenPhegan]

As per request on #890 this is a discussion to look at getting community input for testing the next version.

As per linked PR, there are example binaries and Docker images here:

https://github.com/gliptak/saml2aws/pkgs/container/saml2aws
https://github.com/gliptak/saml2aws/actions/runs/5086259720
https://github.com/gliptak/saml2aws/actions/runs/5086251019

I can confirm that using the linked Docker image worked as expected, with the addition of a CAPTCHA that is not usually presented. Details as per below (obfuscated to protect the innocent!):

docker run --user 502:20 -it --rm -v /Users/work/somecompany/deploy/terraform:/Users/work/somecompany/deploy/terraform:delegated -w /Users/work/somecompany/deploy/terraform -e SAML2AWS_USERNAME -e AWS_CONFIG_FILE=/Users/work/somecompany/deploy/terraform/.aws/config -e AWS_SHARED_CREDENTIALS_FILE=/Users/work/somecompany/deploy/terraform/.aws/credentials "ghcr.io/gliptak/saml2aws:2.37.6" --role=arn:aws:iam::123456789101:role/ClownAccess --mfa=Auto --idp-provider=GoogleApps --url="https://accounts.google.com/o/saml2/initsso?idpid=asdfasdfasd&spid=123123123123&forceauthn=false" login --credentials-file=/Users/work/somecompany/deploy/terraform/.aws/credentials --profile=sts --cache-saml --cache-file=/Users/work/somecompany/deploy/terraform/.aws/saml2aws/cache_default
Using IdP Account default to access GoogleApps https://accounts.google.com/o/saml2/initsso?idpid=asdfasdfasd&spid=123123123123&forceauthn=false
To use saved password just hit enter.
? Username [email protected]
? Password *****************

Authenticating as [email protected] ...
Open this link in a browser:
 https://accounts.google.com/Captcha?v=2&ctoken=ABWk9lasdfNTj4ow4S1_l9zVIsdfa2xg0wjqQ7GUNdfaDeIWoZJfJyzYAI3Oy2Vnhjf6DSnMYLs5b_a6q5BJuU2CTBOYy7mK7lGl_16N6zQnxoG-JCIcxhN137xAp0vJ2M0O-yJBGWzBPOsy0sDSAU3RVDhnnrpIXq29qDfjcq8lzdbG2VIQ
? Captcha somecaptcha
Check your phone and tap 'Yes' on the prompt. Then press ENTER to continue.

Selected role: arn:aws:iam::123456789101:role/ClownAccess
Requesting AWS credentials using SAML assertion.
Logged in as: arn:aws:sts::123456789101:assumed-role/ClownAccess/[email protected]

Your new access key pair has been stored in the AWS configuration.
Note that it will expire at 2023-05-31 00:21:57 +0000 UTC
To use this credential, call the AWS CLI with the --profile option (e.g. aws --profile sts ec2 describe-instances).

This has effectively tested:

1. Docker image functionality (digest, selection of Docker image, download and execution)
2. Google Auth
3. CAPTCHA
4. MFA

If anyone is in a position to test the additional assets it would be great.

Tagging @mapkon and @gliptak .

[mapkon]

@BenPhegan It would be nice to list the delta since the last release. That way, people sign up for the individual features/fixes that were implemented.

[jjensenp44]

Hi Team,

Not sure this is the right place to post, but would you consider supporting sending the device compliance status with the authentication to AzureAD. We have a conditional access policy setup in AzureAD that requires the device to be compliant to be able to access any AzureAD SSO federated app. Saml2aws is not currently working with this setup as it is not able to pass the compliance state of the machine to AzureAD and access is therefor denied with a "Error authenticating to IdP.: failed get SAMLAssertion" Error . Normally passing the compliance state is done through the browser. Edge works out of the box but with Chrome you need to add the "Windows Accounts" extension from the Chrome app store. Is this something you could please look into integrating into saml2aws?

Regards
Jacob

[BenPhegan]

Hi Jacob,

I would suggest raising an issue. This is probably not the right place.

Thanks.

[BenPhegan]

Delta of change since last release:

v2.36.8...master

Main changes seem to be associated with the following contributors:

• @rushndr
• @mapkon
• @BenPhegan
• @smlx
• @gliptak
• @lizduty
• @anothertobi

@mapkon - As the process you are suggesting is not documented anywhere, I am not sure what the expectation is on contributors. My assumption is that everyone that has contributed a feature has tested the integrated result. What process would you like people to go through, and what output is expected? It would be really helpful if this formed part of the readme, perhaps it is worth discussing with the other admins and putting together some release process documentation?

In the meantime, it would be great to get a release out. Let me know what is necessary. If I have tagged anyone erroneously here, please disregard. Otherwise, if you have a chance to test your PR (based on the link above) or have already done so, please note as part of this discussion so we can move forward with a release (if that is what is expected).

Thanks!

[anothertobi]

While my minor CI contribution that is on master ( #1074 ) does work, the only e2e part I can test is Okta + WebAuthn which remains broken (see #1059 ).

[rushndr]

Since my contribution ( #1047 ) was merged, I've been using builds from the master branch with Ping and I have had no issues. This is the only real-world test I know how to provide since I'm limited to the environment provided by the client I'm working with.

I'm a big fan of this tool, so if anyone has suggestions on further tests I can do to get the next version released, I'd be happy to contribute further.

[BenPhegan]

Thanks all. @anothertobi - so we would need #1059 in this release? @mapkon - is there anything blocking that PR? Looking at it, it seems to be in reasonable shape and appears to correct a small inadvertent historical change. Can we get that in for testing as well?

[mapkon]

@BenPhegan

I will be sure to document the test process for the release on a wiki somewhere. I am terribly sorry for not having done that. Please note that I inherited maintenance rights earlier this year, and I mainly just help with merging PRs and bumping up dependencies, given my limited experience with the project and Golang in general.

The aim has always been to test the changes implemented in tandem with other changes, since the introduction of new changes to an existing code base heightens the risk of regressions or introducing bugs. We have had a few of those recently, as the list of issues shows.

That said, it looks like we are in good shape for the release. I will see if I can cut a release this weekend or early next week.

[anothertobi]

@anothertobi - so we would need #1059 in this release?

Yes :)

[mapkon]

Hello,

The v2.36.9 has been released

[BenPhegan]

Awesome! I can see that the Docker image release seems to have worked. Will shift over to these images today!

[mapkon]

You could help me announce the release - here is a template: #1040