Multiple SSO instances + browser sessions issue

[synfinatic]

If you have multiple SSO instances ($AWS_SSO) things aren't awesome because your web browser has a cookie which is tied to your SSO provider. So if you are using the same SSO provider for multiple SSO instances you can't actually switch between, because when you go through SSO and get your auth token, it is for the previous SSO provider instance- even if you do a aws-sso flush -t sso

So we either need to revert #491 (to keep the cookies in their own browser session) or do something else? Seems like we need each SSO instance to specify it's own container (or keep the default container).

[synfinatic]

Just noticed that the AWS SSO auth workflow is going through the default browser??? Does not honor the open-url-in-container or UrlExecCommand => Firefox and is using the default browser, Safari.

[amphied]

Hi @synfinatic this might be a niche use case, but I'd like to specify a different browser for auth. Is that something you could add here as well?

Example:

• open auth in Chrome
• open console sessions in Firefox with containers
• (neither Chrome nor Firefox being the default browser)

[synfinatic]

@amphied Can you explain why you want to use a 3rd browser for SSO auth? I get wanting to use the default browser for SSO auth (allows re-using an existing SSO session), but not a 3rd one.

[amphied]

@synfinatic I'd like to send the auth url to a script that relays it to a separate machine where my password safe and yubikey are located. Niche use case, I know :)

[synfinatic]

So you have like two laptops? Or is one of them an EC2 or bastion host or something?

[amphied]

Thank you for taking the time and answering!

Two local machines.

I think adding an authUrlExecCommand similar to the authUrlAction would do the trick, but I'd completely understand if you consider this out of scope.

Without that I see two workarounds:

1. setting UrlExecCommand to a script that determines how to proceed based on the url
2. setting the new config option authUrlAction to open and packaging my script into an .app so that it can be called with open -a foo.app (see open-golang) via the Browser config

[synfinatic]

Thanks for explaining... I'm trying to think about the security ramifications of this. Do you mind opening a new ticket for the ask?

[amphied]

Thank you! Done: #550