Hello, Thank you for the tool, it appears to be the best around for Okta/AWS but I'm having an issue running the command after the utility. Should there be more debug logs after the successful login?

$ DEBUG=* oktad dp -- aws s3 ls
18:21:57.206 86us   86us   oktad:main - loading configuration data
18:21:57.206 148us  148us  oktad:config - trying to load from config param file
18:21:57.206 4us    4us    oktad:config - trying to load from CWD
18:21:57.206 5us    5us    oktad:config - trying to load from home dir
18:21:57.206 10us   10us   oktad:config - loading /Users/ianmo/.okta-aws/config
18:21:57.234 28ms   28ms   oktad:credStore - no credentials found for supplied profile: dp
18:21:57.234 28ms   28ms   oktad:main - cred load err credentials not found!
Username: [email protected]
Password: 
18:22:04.630 7s     7s     oktad:okta - let the login dance begin
18:22:05.906 1s     1s     oktad:okta - login response body {"expiresAt":"2017-06-12T18:27:07.000Z","status":"SUCCESS","sessionToken":"000000fake","_embedded":{"user":{"id":"000000fake","profile":{"login":"[email protected]","firstName":"Guy","lastName":"Guy","locale":"en","timeZone":"America/Los_Angeles"}}}}
$ DEBUG=* oktad dp -- echo "test"
18:22:17.187 87us   87us   oktad:main - loading configuration data
18:22:17.187 152us  152us  oktad:config - trying to load from config param file
18:22:17.187 1us    1us    oktad:config - trying to load from CWD
18:22:17.187 5us    5us    oktad:config - trying to load from home dir
18:22:17.187 10us   10us   oktad:config - loading /Users/ianmo/.okta-aws/config
18:22:17.214 27ms   27ms   oktad:credStore - no credentials found for supplied profile: dp
18:22:17.214 27ms   27ms   oktad:main - cred load err credentials not found!
Username: [email protected]
Password: 
18:22:25.083 7s     7s     oktad:okta - let the login dance begin
18:22:26.604 1s     1s     oktad:okta - login response body {"expiresAt":"2017-06-12T18:27:28.000Z","status":"SUCCESS","sessionToken":"000000fake","_embedded":{"user":{"id":"000000fake","profile":{"login":"[email protected]","firstName":"Guy","lastName":"Guy","locale":"en","timeZone":"America/Los_Angeles"}}}}

I'm not sure what to put in appUrl setting. Using the URL I get from okta doesn't work and it doesn't look like the example in the README.

I see that the readme says Windows is not supported right now. Has this been tested? If so, are there plans and/or a timeline for Windows support?

Because the credential caching in ~/.okta-aws/credentials is not namespaced by profile you cannot have 2 sessions to different accounts open in 2 seperate terminal windows. When you attempt to open the 2nd session it sees the credentials file and if those haven't expired it just puts them in your environment without checking that they are for the requested account.

This tool is inspired by okta-aws (https://github.com/99designs/aws-vault), and I would prefer that oktad's command structure more closely followed okta-aws.

I'm thinking...

oktad exec aws ec2 describe-instances
oktad add main

and more details as I fill them out here.

go-keytar links against some dependencies that weren't in my docker build container, need to figure this out or convert go-keytar to use libsecret...

Hi,

I'm getting the following error when attempting to use oktad. Since the Okta supplied tool doesn't seem to work anywher near as slick, it'd be nice to get this going.

The error is below:

18:31:53.270 427ms  427ms  oktad:okta - didn't find saml response element
18:31:53.270 14s    14s    oktad:main - got saml:

Error preparing to AssumeRole!
18:31:53.270 2us    2us    oktad:main - getSaml err was Invalid saml response!

This was immediately following a "SUCCESS" JSON response from Okta.

Any ideas?

This tool should assume role into the parent account if you don't specify a profile, making it possible to run commands with temporary credentials there as well.

Although the credentials we grab only work for an hour now, it's probably better that we store them somewhere a little safer than a plaintext file on disk.

We've been experimenting internally with a new tool which works similarly to oktad, but stores the HTTP session cookie retrieved from Okta in the OSX Keychain / Windows Credential Vault. We're using node for our version with the keytar library for cross platform support. By storing this cookie, users are able to get keys from AWS for the duration of their Okta session without being asked for username/password/MFA which is a huge convenience.

So the feature request is to store this session cookie (the cookie name is sid) so users can get multiple keys if required.

When I run a command, something like oktad production -- /bin/bash from my home directory I get an error message "Error reading config file!". If I move to a subdirectory inside my home directory it seems to work fine. Example:

~ : oktad production -- /bin/bash
Error reading config file!
~ : cd libs/test/mytestfolder/tf/
~/libs/test/mytestfolder/tf : oktad production -- /bin/bash
Username:

Running v0.6.0

The credentials we get should be valid for an hour—would be nice to store them until they're invalid. Might be safe to store them in plaintext.

The title pretty much says it all.