Merge Changes from Dev into Master #457
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
force_classic
parameter from the config fileforce_classic
DT
cookie when inforce_classic
modeDescription
The default behavior is to treat any missing or empty parameter in
~/.okta_aws_login_config
as False. This causes an issue for orgs that are migrating from Okta to Classic to OIE because it forces all users to use the --force-classic parameter, modify their config file directly or rungimme-aws-creds --configure
after migration to update the force_classic value.We want to make migrations as seamless as possible for users, the default behavior from now on will be to treat a missing or empty value for force_classic as True. This will make gimme-aws-creds behave in the same way before and after the migration. You can then create a new OIDC app for the device authorization flow and have both flows available for a phased transition to the browser-based login.
When using a Global Session Policy that triggers MFA based on the DT cookie and an application policy that requires MFA, OIE uses the "step-up authentication" process, which is not supported by gimme-aws-creds "classic" mode. Disabling the use of the DT cookie avoids this situation and makes the classic mode useable in more auth policy configurations.
The move to building gimme-aws-creds using PIP instead of setup.py starting in 2.8.0 changes the filenames that were output, which broke the homebrew build (homebrew doesn't recognize that gimme-aws-creds has updated). The updated filename configuration should take care of this issue.
Related Issue
#455
#454
#452
How Has This Been Tested?
Tested with migrating domain from Classic to OIE and updated unit tests
Screenshots (if appropriate):
Types of changes
Checklist: