Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: Add support for optional profile expiration #153

Open
wants to merge 2 commits into
base: main
Choose a base branch
from

Conversation

ruhulio
Copy link
Contributor

@ruhulio ruhulio commented Dec 13, 2023

Description

These changes add optional support for profile expiration checking. When enabled with the --use-profile-expiration option, tokendito will store the expiration in each profile. Subsequent authentication requests will then check the expiration to see if it's still valid and bypass the need to re-authenticate.

Related Issue

N/A

Motivation and Context

This reduces the friction for our engineering teams when they need to script the use of tokendito and MFA is in play.

How Has This Been Tested?

  • Running without the new option
  • Running with the new option and a clean INI file
  • Running with the new option and an INI file with expiration values

Example output:

# Without profile expiration set
❯ tokendito --use-profile-expiration--profile test_profile --aws-profile test_profile --config-file ./test-tokendito.ini
Organization username. E.g. jane.doe@acme.com: xxxxx.xxxxx
Password:
2023-12-13 10:59:21,642 WARNING |tokendito.user check_profile_expiration():550| Expiration unavailable for config profile test-profile.
…

# With profile expiration in the future set
❯ tokendito --use-profile-expiration--profile test_profile --aws-profile test_profile --config-file ./test-tokendito.ini
Organization username. E.g. jane.doe@acme.com: xxxxx.xxxxx
Password:
2023-12-13 10:57:18,126 INFO |tokendito.user check_profile_expiration():557| Expiration for config profile test-profile is still valid: 2023-12-13 23:17:10+00:00

# With profile expiration in the past set
❯ tokendito --use-profile-expiration--profile test_profile --aws-profile test_profile --config-file ./test-tokendito.ini
Organization username. E.g. jane.doe@acme.com: xxxxx.xxxxx
Password:
2023-12-13 11:02:24,429 WARNING |tokendito.user check_profile_expiration():560| Expiration for config profile test-profile is no longer valid: 2023-12-11 23:17:10+00:00
...

Types of changes

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to change)
  • Documentation update

Checklist:

  • My code follows the style guidelines of this project
  • I have performed a self-review of my own code
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have added tests that prove my fix is effective or that my feature works
  • New and existing unit tests pass locally with my changes

Copy link

@JSpenced JSpenced left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Clean solution grabbing the Expiration from the API 👍 . Minor comments

:return expiration
"""
try:
return role_response["Credentials"]["Expiration"]

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Assuming here that aws returns the expiration time in utc?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yep, the value is returned in UTC.

There is existing code that converts this to local when displaying the role to the user.

Copy link

@JSpenced JSpenced Dec 14, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yup yup! I just knew there was a aws config var for setting timestamps. I have had a problem switching from aws cli version 1 to 2 before. A different issue than this, but just wanted to check as those returned different formats. Think we are good then 👍 !

return

profile_expiration = datetime.fromisoformat(profile_expiration_str)
now = datetime.now(timezone.utc)

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Probably not necessary but if it isn't guaranteed to return utc.

Suggested change
now = datetime.now(timezone.utc)
now = datetime.now(profile_expiration.tzinfo if profile_espiration.tzinfo else timezone.utc)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants