Skip to main content
Warning: You are using the test version of PyPI. This is a pre-production deployment of Warehouse. Changes made here affect the production instance of TestPyPI (testpypi.python.org).
Help us improve Python packaging - Donate today!

Acquire AWS STS (temporary) credentials via Google Apps SAML Single Sign On

Project Description

This command-line tool allows you to acquire AWS temporary (STS) credentials using Google Apps as a federated (Single Sign-On, or SSO) provider.

Setup

You’ll first have to set up Google Apps as a SAML identity provider (IdP) for AWS. There are tasks to be performed on both the Google Apps and the Amazon sides; these references should help you with those configurations:

If you need a fairly simple way to assign users to roles in AWS accounts, we have another tool called Google AWS Federator that might help you.

Important Data

You will need to know Google’s assigned Identity Provider ID, and the ID that they assign to the SAML service provider.

Once you’ve set up the SAML SSO relationship between Google and AWS, you can find the SP ID by drilling into the Google Apps console, under Apps > SAML Apps > Settings for AWS SSO – the URL will include a component that looks like ...#AppDetails:service=123456789012... – that number is GOOGLE_SP_ID

You can find the GOOGLE_IDP_ID, again from the admin console, via Security > Set up single sign-on (SSO) – the SSO URL includes a string like https://accounts.google.com/o/saml2/idp?idpid=aBcD01AbC where the last bit (after the =) is the IDP ID.

Installation

You can install quite easily via pip, if you want to have it on your local system:

localhost$ sudo pip install aws-google-auth

If you don’t want to have the tool installed on your local system, or if you prefer to isolate changes, there is a Dockerfile provided, which you can build with:

localhost$ cd ..../aws-google-auth && docker build -t aws-google-auth .

Usage

  1. Set environment variables for GOOGLE_USERNAME, GOOGLE_IDP_ID, and GOOGLE_SP_ID (see above under “Important Data” for how to find the last two; the first one is usually your email address)
  2. For Docker: docker run -it -e GOOGLE_USERNAME -e GOOGLE_IDP_ID -e GOOGLE_SP_ID aws-google-auth
  3. For Python: aws-google-auth

You’ll be prompted for your password. If you’ve set up an MFA token for your Google account, you’ll also be prompted for the current token value.

If you have more than one role available to you, you’ll be prompted to choose the role from a list; otherwise, if your credentials are correct, you’ll just see the AWS keys printed on stdout.

You should eval the export statements that come out, because that’ll set environment variables for you. This tools currently doesn’t write credentials to an ~/.aws/credentials file

Notes on Authentication

Google supports a number of 2-factor authentication schemes. Each of these results in a slightly different “next” URL, if they’re enabled, during do_login

Google controls the preference ordering of these schemes in the case that you have multiple ones defined.

The varying 2-factor schemes and their representative URL fragments handled by this tool are:

Method URL Fragment
No second factor (none)
TOTP (eg Google
Authenticator or Authy)
.../signin/challenge/totp/2?...
SMS (or voice
call)
.../signin/challenge/ipp/2?...
Google Prompt
(phone app)
.../signin/challenge/az/2?...
Backup code
(printed codes)
... (unknown yet) ...
Security key
(eg yubikey)
... (unknown yet) ...

Acknowledgements

This work is inspired by keyme – their digging into the guts of how Google SAML auth works is what’s enabled it.

Release History

Release History

This version
History Node

0.0.6

History Node

0.0.3

History Node

0.0.2

History Node

0.0.1

Download Files

Download Files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

File Name & Checksum SHA256 Checksum Help Version File Type Upload Date
aws-google-auth-0.0.6.tar.gz (8.4 kB) Copy SHA256 Checksum SHA256 Source Jul 10, 2017

Supported By

WebFaction WebFaction Technical Writing Elastic Elastic Search Pingdom Pingdom Monitoring Dyn Dyn DNS Sentry Sentry Error Logging CloudAMQP CloudAMQP RabbitMQ Heroku Heroku PaaS Kabu Creative Kabu Creative UX & Design Fastly Fastly CDN DigiCert DigiCert EV Certificate Rackspace Rackspace Cloud Servers DreamHost DreamHost Log Hosting