From 95b9234e716548a01b00822bdedd71ab5b08ce42 Mon Sep 17 00:00:00 2001 From: Joe-Zer0 Date: Tue, 20 Oct 2020 11:15:55 -0500 Subject: [PATCH 1/5] update aad to account for mfa being skipped --- pkg/provider/aad/aad.go | 368 ++++++++++++++++++++-------------------- 1 file changed, 187 insertions(+), 181 deletions(-) diff --git a/pkg/provider/aad/aad.go b/pkg/provider/aad/aad.go index 796400e8f..01073a366 100644 --- a/pkg/provider/aad/aad.go +++ b/pkg/provider/aad/aad.go @@ -19,6 +19,7 @@ import ( "github.com/versent/saml2aws/v2/pkg/creds" "github.com/versent/saml2aws/v2/pkg/prompter" "github.com/versent/saml2aws/v2/pkg/provider" + "golang.org/x/net/html" ) // Client wrapper around AzureAD enabling authentication and retrieval of assertions @@ -682,190 +683,223 @@ func (ac *Client) Authenticate(loginDetails *creds.LoginDetails) (string, error) if err != nil { return samlAssertion, errors.Wrap(err, "error retrieving login results") } + resBody, _ = ioutil.ReadAll(res.Body) resBodyStr = string(resBody) - // require reprocess - if strings.Contains(resBodyStr, "Working...") { + // require reprocess + if strings.Contains(resBodyStr, " - var loginPasswordJson string - if strings.Contains(resBodyStr, "$Config") { - startIndex := strings.Index(resBodyStr, "$Config=") + 8 - endIndex := startIndex + strings.Index(resBodyStr[startIndex:], ";") - loginPasswordJson = resBodyStr[startIndex:endIndex] - } - var loginPasswordResp passwordLoginResponse - var loginPasswordSkipMfaResp SkipMfaResponse - - if err := json.Unmarshal([]byte(loginPasswordJson), &loginPasswordResp); err != nil { - return samlAssertion, errors.Wrap(err, "loginPassword response unmarshal error") - } - if err := json.Unmarshal([]byte(loginPasswordJson), &loginPasswordSkipMfaResp); err != nil { - return samlAssertion, errors.Wrap(err, "loginPassword response unmarshal error") - } - var restartSAMLResp startSAMLResponse - if err := json.Unmarshal([]byte(loginPasswordJson), &restartSAMLResp); err != nil { - return samlAssertion, errors.Wrap(err, "startSAML response unmarshal error") - } - - mfas := loginPasswordResp.ArrUserProofs - // If there's an explicit option to skip MFA, do so - if loginPasswordSkipMfaResp.URLSkipMfaRegistration != "" { - res, err = ac.client.Get(loginPasswordSkipMfaResp.URLSkipMfaRegistration) - if err != nil { - return samlAssertion, errors.Wrap(err, "error retrieving skip mfa results") - } - } else if len(mfas) != 0 { - // There's no explicit option to skip MFA, and MFA options are available - // Start MFA - if len(mfas) == 0 { - return samlAssertion, errors.Wrap(err, "mfa not found") + // data is embedded javascript object + //