Azure CLI Login with MFA

1
votes

We are trying to configure AWS CLI integration with Azure. We have used the https://github.com/sportradar/aws-azure-login which works great for the GUI mode but we are looking for an experience from CLI. The following is the experience we are looking for. Any guidance to a new package or update the aws-azure-login package will be helpful.

  1. User submits her Azure AD username/password credentials to the CLI.

  2. The CLI uses the credentials to authenticate against Azure, which returns either a token or another challenge for the end user (e.g., MFA). If another challenge is returned, the CLI waits for input from the user (e.g., MFA code) and submits the input to Azure AD MFA input.

  3. If successful, Azure AD returns a token. The CLI submits the returned token & SAML2 request to Azure AD SAML endpoint and gets back from Azure AD a SAML2 response.

  4. The CLI then submits the SAML2 response to AWS SAML endpoint and gets back AWS IAM temporary credentials.

1
amazon-web-servicesazurecommand-line-interfacemulti-factor-authentication

1 Answers

1
votes

In aws-azure login the way is to that you make the following changes in the configuration:

  1. To configure the aws-azure-login client run:

    aws-azure-login --configure

  2. During the configuration you can decide to stay logged in:

    ? Stay logged in: skip authentication while refreshing aws credentials (true|false) (false)

If you set this configuration to true, the usual authentication with username/password/MFA is skipped as it's using session cookies to remember your identity. This enables you to use --no-prompt without the need to store your password anywhere. As soon as you went through the full login procedure once, you can just use:

aws-azure-login --no-prompt

or

aws-azure-login --profile foo --no-prompt

Another way could be the one I'm mentioning below, but I'm not sure if aws-azure-login has way for that, and you wann stick to Aws-azure login I guess.

The best way will be to create a service principal and try logging In using that.

The service principal won't have MFA, and you can assign just the required Roles and Permission to the Service principal/AAD app so it will be more secure too :)