1

I have figured out that to use OneLogin Protect with saml assertions, you need to call the SAML verify factor without the OTP provided, and read about a similar question here, but if I simply put this in a loop with a sleep, the User is bombarded with OTP calls, until they hit "Accept". If the user takes 10-20 seconds to pull their phone out, and I sleep for 20 seconds, that means that users who have their phone immediatly available and could response in 2-3 seconds, have to wait 20 seconds to cover the slower calls.

To adress this, I would like to check the saml assertion verify without sending a push notification, and just the state_token.

I have also noticed that if I were not to use SAML assertions, I could do this as described here: https://developers.onelogin.com/api-docs/1/multi-factor-authentication/overview but that requires me to give either Manage users or Manage All permissions to the API keys. As this is a Python cli utility to handle aws saml auth, and one way or another, we need to distribute those API keys to users, this seems like excessive privileges for a user to log into AWS.

Does anyone know how can I check the status of an OTP for OneLogin Protect with SAMl assertions, without creating a new OTP call every time I check the status?

Example code

ol_client = OneLoginClient(
    'client_id',
    'client_secret',
    'us',
)
saml_resp = ol_client.get_saml_assertion(
    'ol_username',
    'ol_password',
    'aws_app_id',
    'subdomain'
)
call_result =ol_client.get_saml_assertion_verifying(
    'onelogin_aws_app_id',
    device.id,
    saml_resp.mfa.state_token
)

if call_result is None:

    verify_result = None
    while verify_result is None:
        sleep(1)
        verify_result =ol_client.get_saml_assertion_verifying(
            'aws_app_id',
            device.id,
            saml_resp.mfa.state_token
        )
4

1 回答 1

0

我现在已经找到了答案。刚刚忘记更新：

API 在 verifyFactor 端点中公开一个 Message 字段。虽然等待用户对其进行操作，但它将包含字符串pending。

rMfa, err = c.VerifyFactor(token, &pMfa)
for strings.Contains(rMfa.Message, "pending") && timeout > 0 {
    time.Sleep(time.Duration(MFAInterval) * time.Second)
    rMfa, err = c.VerifyFactor(token, &pMfa)
    if err != nil {
        s.Stop()
        return nil, err
    }
    timeout -= MFAInterval
}

我采取每秒检查一次，直到超时到期。完整的实现可以在这里看到：https ://github.com/allcloud-io/clisso/blob/master/onelogin/get.go#L133

于 2021-09-03T11:45:41.257 回答