Authentication locks tools without stdin - windows credentials support hack

[ecarter-godaddy]

This pull request isn't intended to be merged as-is, but it's here to demonstrate an issue and hack solution for a problem with aws-okta-processor.

If you work with AWS entirely from the command line, then aws-okta-processor is fine. But if you ever use an AWS-aware tool that doesn't redirect stdin and stdout then aws-okta-processor, when configured as a credential_process, will wait indefinitely for user prompts that the user never receives. As an example: AWS Tools for Powershell breaks when aws-okta-processor prompts as, for some reason, it doesn't redirect stdin/stdout.

The hack I'm presenting here is a partial solution to the problem. Instead of using Python's getpass, I'm leveraging Powershell.exe to call Get-Credentials which shows the standard Windows credentials prompt. Preferably the call to Powershell should be replaced with real winapi calls, but that is considerably more effort. It also doesn't solve the problem for other operating systems. Also, I'm not handling hardware token prompts at all so that will still fail silently.

The proper solution here would be for aws-okta-processor to detect if it's running interactively and/or expose flags to control interactivity. If the process is non-interactive or is disabled by flags then it should not prompt for input and fail quickly when invoked. If the process is interactive then show the user prompt, depending on what input is available. Preferably leveraging secure credentials prompts provided by the user's operating system.

[sonarqubecloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
No Duplication information