{"_id":"@abcops/aws-azure-login","_rev":"1-f3db89466e4f88a4814e6bd12422df24","name":"@abcops/aws-azure-login","dist-tags":{"latest":"1.7.0"},"versions":{"1.7.0":{"name":"@abcops/aws-azure-login","version":"1.7.0","description":"Use Azure AD SSO to log into the AWS CLI.","main":"index.js","author":{"name":"Dave T. Johnson","email":"dave@dtjohnson.net"},"license":"MIT","bin":{"aws-azure-login":"bin/index.js"},"engines":{"node":">=8.0"},"dependencies":{"aws-sdk":"^2.323.0","bluebird":"^3.5.2","cheerio":"^1.0.0-rc.2","commander":"^2.18.0","debug":"^4.0.1","ini":"^1.3.5","inquirer":"^6.2.0","lodash":"^4.17.11","mkdirp":"^0.5.1","proxy-agent":"^3.0.3","puppeteer":"^1.8.0","uuid":"^3.3.2"},"repository":{"type":"git","url":"git+https://github.com/dtjohnson/aws-azure-login.git"},"bugs":{"url":"https://github.com/dtjohnson/aws-azure-login/issues"},"homepage":"https://github.com/dtjohnson/aws-azure-login#readme","directories":{"lib":"lib"},"scripts":{"test":"echo \"Error: no test specified\" && exit 1"},"gitHead":"38a72bfaa838b1f1adcb2d691cf2fe46821a18b3","_id":"@abcops/aws-azure-login@1.7.0","_nodeVersion":"10.16.0","_npmVersion":"6.9.0","dist":{"integrity":"sha512-AHkLin8qOYwI7u2XDphX+IOS36X7kplGi2mSg3Bm3aKmirriF9PUmKI0iD6NPkPzD3pEQ3xCz//toyeic/qVwQ==","shasum":"ed43aca9955d707a09588d828b8bd7c075ce2096","tarball":"https://registry.npmjs.org/@abcops/aws-azure-login/-/aws-azure-login-1.7.0.tgz","fileCount":13,"unpackedSize":50535,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.4\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJdZMFcCRA9TVsSAnZWagAAab8QAJQ67TbMQwEWVzuFjtVb\nHZbHWSatcdrzgK9neU2LphNpakguhxha5pOfOaRw+SmoIzZowcNrcsQYcRoX\n1FLfFWYWjjSvl8ru2fva/mxw2m6G19EmhH9tt8nG823KwMcktOkriJUNph/0\nqb3wpVT/ABbuE2xjT6kSCq4C6h6/vePR798lw4aBP1N/TUiRwISKz6puhXzh\nKIbLvX1fT7FbAhGunYnzCBxYYHB22MnbHgF+m7A1jEHP+KeMrBi747QRNRBy\nSbfizn9S3zPOcu+9TSu6/85/CkL4jFYGpKuT/m5jo6rDDdmUCfdPs+m1G+bP\neZI4uO6yuk6Z7e+Uq558BmeWNcmR65n0/XxC6PyReuyEw1rkJp5shVqOjror\ntVNec3Wqon6w525xfsrSuVjafVV46ZsbZpqhHfNMc6guYeK14zKeEgEZ1CAp\n8Qavk+hzroobdOyGew4JEs7YL++IN9znpkzRvWXX0sVQkZeKNZQbpSW3kXnp\nhQnxkNZoxfzqtcw4i7J4RODjCm+bIourPkPqSjdrZposLeT0nj5Z5kcgOzlY\nBK02OfViWupe+epKUVGR3Q4gEv08HEPGDgc899/zelQKK9DjfaHzJiUTpXdW\n/z2Sypw7LIoAT3pyGTUr1aq1+0uJrRJYnia6j3uf55Xh1yIoMOzd5nlJ7Bo3\nk2uk\r\n=btSW\r\n-----END PGP SIGNATURE-----\r\n","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEUCIQCDwNLBnFdpzuBiBLbxQO0yaJ02Az0WIpivV3GZs35DRwIgE7fJVjcFugglX6nlpWW8G7tdJFPnnBvEg0CY/aFL7DA="}]},"maintainers":[{"name":"crysmi","email":"crysmi@live.com"}],"_npmUser":{"name":"crysmi","email":"crysmi@live.com"},"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/aws-azure-login_1.7.0_1566884187716_0.777062796017947"},"_hasShrinkwrap":false}},"time":{"created":"2019-08-27T05:36:27.502Z","1.7.0":"2019-08-27T05:36:27.982Z","modified":"2022-04-04T10:58:05.821Z"},"maintainers":[{"name":"crysmi","email":"crysmi@live.com"}],"description":"Use Azure AD SSO to log into the AWS CLI.","homepage":"https://github.com/dtjohnson/aws-azure-login#readme","repository":{"type":"git","url":"git+https://github.com/dtjohnson/aws-azure-login.git"},"author":{"name":"Dave T. Johnson","email":"dave@dtjohnson.net"},"bugs":{"url":"https://github.com/dtjohnson/aws-azure-login/issues"},"license":"MIT","readme":"[![view on npm](http://img.shields.io/npm/v/aws-azure-login.svg)](https://www.npmjs.org/package/aws-azure-login)\r\n[![npm module downloads per month](http://img.shields.io/npm/dm/aws-azure-login.svg)](https://www.npmjs.org/package/aws-azure-login)\r\n\r\n# aws-azure-login\r\nIf your organization uses [Azure Active Directory](https://azure.microsoft.com) to provide SSO login to the AWS console, then there is no easy way to log in on the command line or to use the [AWS CLI](https://aws.amazon.com/cli/). This tool fixes that. It lets you use the normal Azure AD login (including MFA) from a command line to create a federated AWS session and places the temporary credentials in the proper place for the AWS CLI and SDKs.\r\n\r\n## Installation\r\n\r\n### Windows\r\nInstall [Node.js](https://nodejs.org/) v7.6.0 or higher. Then install aws-azure-login with npm:\r\n\r\n    npm install -g aws-azure-login\r\n\r\n### Linux\r\n\r\nIn Linux you can either install for all users or just the current user. In either case, you must first install [Node.js](https://nodejs.org/) v7.6.0 or higher and any [puppeteer dependencies](https://github.com/GoogleChrome/puppeteer/blob/master/docs/troubleshooting.md#chrome-headless-doesnt-launch). Then follow the appropriate instructions. \r\n\r\n#### Option A: Install for All Users\r\n\r\nInstall aws-azure-login globally with npm:\r\n\r\n    sudo npm install -g aws-azure-login --unsafe-perm\r\n    \r\nPuppeteer doesn't install globally with execution permissions for all users so you'll need to modify them:\r\n\r\n    sudo chmod -R go+rx $(npm root -g)\r\n\r\n#### Option B: Install Only for Current User\r\n\r\nFirst configure npm to install global packages in [your home directory](https://docs.npmjs.com/getting-started/fixing-npm-permissions):\r\n   \r\n    mkdir ~/.npm-global\r\n    npm config set prefix '~/.npm-global'\r\n    export PATH=~/.npm-global/bin:$PATH\r\n    source ~/.profile\r\n    echo 'export PATH=~/.npm-global/bin:$PATH' >> ~/.profile\r\n    source ~/.profile\r\n     \r\nThen install aws-azure-login:\r\n\r\n    npm install -g aws-azure-login\r\n\r\n### Docker\r\n\r\nA Docker image has been built with aws-azure-login preinstalled. You simply need to run the command with a volume mounted to your AWS configuration directory.\r\n\r\n    docker run --rm -it -v ~/.aws:/root/.aws dtjohnson/aws-azure-login\r\n    \r\nThe Docker image is configured with an entrypoint so you can just feed any arguments in at the end.\r\n\r\nYou can also put the docker-launch.sh script into your bin directory for the aws-azure-login command to function as usual:\r\n\r\n    sudo curl -o /usr/local/bin/aws-azure-login https://raw.githubusercontent.com/dtjohnson/aws-azure-login/master/docker-launch.sh\r\n    sudo chmod o+x /usr/local/bin/aws-azure-login\r\n\r\nNow just run `aws-azure-login`.\r\n\r\n## Usage\r\n\r\n### Configuration\r\n\r\n#### AWS\r\n\r\nTo configure the aws-azure-login client run:\r\n\r\n    aws-azure-login --configure\r\n    \r\nYou'll need your Azure Tenant ID and the App ID URI. To configure a named profile, use the --profile flag.\r\n\r\n    aws-azure-login --configure --profile foo\r\n\r\n#### Environment Variables\r\n\r\nYou can optionally store your responses as environment variables:\r\n\r\n* `AZURE_TENANT_ID`\r\n* `AZURE_APP_ID_URI`\r\n* `AZURE_DEFAULT_USERNAME`\r\n* `AZURE_DEFAULT_PASSWORD`\r\n* `AZURE_DEFAULT_ROLE_ARN`\r\n* `AZURE_DEFAULT_DURATION_HOURS`\r\n\r\nTo avoid having to ``<Enter>`` through the prompts after setting these environment variables, use the `--no-prompt` option when running the command.\r\n\r\n    aws-azure-login --no-prompt\r\n\r\nUse the `HISTCONTROL` environment variable to avoid storing the password in your bash history (notice the space at the beginning):\r\n\r\n    $ HISTCONTROL=ignoreboth\r\n    $  export AZURE_DEFAULT_PASSWORD=mypassword\r\n    $ aws-azure-login\r\n\r\n### Logging In\r\n\r\nOnce aws-azure-login is configured, you can log in. For the default profile, just run:\r\n\r\n    aws-azure-login\r\n    \r\nYou will be prompted for your username and password. If MFA is required you'll also be prompted for a verification code or mobile device approval. To log in with a named profile:\r\n\r\n    aws-azure-login --profile foo\r\n\r\nAlternatively, you can set the `AWS_PROFILE` environmental variable to the name of the profile just like the AWS CLI.\r\n\r\nOnce you log in you can use the AWS CLI or SDKs as usual!\r\n\r\nIf you are logging in on an operating system with a GUI, you can log in using the actual Azure web form instead of the CLI:\r\n\r\n    aws-azure-login --mode gui\r\n\r\nLogging in with GUI mode is likely to be much more reliable.\r\n\r\n_Note:_ on Linux you will likely need to disable the Puppeteer sandbox or Chrome will fail to launch:\r\n\r\n    aws-azure-login --no-sandbox\r\n\r\n### Behind corporate proxy\r\n\r\nIf behind corporate proxy, then just set https\\_proxy env variable.\r\n\r\n## Getting Your Tenant ID and App ID URI\r\n\r\nYour Azure AD system admin should be able to provide you with your Tenant ID and App ID URI. If you can't get it from them, you can scrape it from a login page from the myapps.microsoft.com page.\r\n\r\n1. Load the myapps.microsoft.com page.\r\n2. Click the chicklet for the login you want.\r\n3. In the window the pops open quickly copy the login.microsoftonline.com URL. (If you miss it just try again. You can also open the developer console with nagivation preservation to capture the URL.)\r\n4. The GUID right after login.microsoftonline.com/ is the tenant ID.\r\n5. Copy the SAMLRequest URL param.\r\n6. Paste it into a URL decoder ([like this one](https://www.samltool.com/url.php)) and decode.\r\n7. Paste the decoded output into the a SAML deflated and encoded XML decoder ([like this one](https://www.samltool.com/decode.php)).\r\n8. In the decoded XML output the value of the Issuer tag is the App ID URI.\r\n\r\n## How It Works\r\n\r\nThe Azure login page uses JavaScript, which requires a real web browser. To automate this from a command line, aws-azure-login uses [Puppeteer](https://github.com/GoogleChrome/puppeteer), which automates a real Chromium browser. It loads the Azure login page behind the scenes, populates your username and password (and MFA token), parses the SAML assertion, uses the [AWS STS AssumeRoleWithSAML API](http://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithSAML.html) to get temporary credentials, and saves these in the CLI credentials file.\r\n\r\n## Troubleshooting\r\n\r\nThe nature of browser automation with Puppeteer means the solution is bit brittle. A minor change on the Microsoft side could break the tool. If something isn't working, you can fall back to GUI mode (above). To debug an issue, you can run in debug mode (--mode debug) to see the GUI while aws-azure-login tries to populate it. You can also have the tool print out more detail on what it is doing to try to do in order to diagnose. aws-azure-login uses the [Node debug module](https://www.npmjs.com/package/debug) to print out debug info. Just set the DEBUG environmental variable to 'aws-azure-login'. On Linux/OS X:\r\n\r\n    DEBUG=aws-azure-login aws-azure-login\r\n\r\nOn Windows:\r\n\r\n    set DEBUG=aws-azure-login\r\n    aws-azure-login\r\n\r\n## Support for Other Authentication Providers\r\n\r\nObviously, this tool only supports Azure AD as an identity provider. However, there is a lot of similarity with how other logins with other providers would work (especially if they are SAML providers). If you are interested in building support for a different provider let me know. It would be great to build a more generic AWS CLI login tool with plugins for the various providers.\r\n","readmeFilename":"README.md"}