Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Enable getting password from stdin #86

Merged
merged 8 commits into from
Aug 7, 2018
Merged

Enable getting password from stdin #86

Changes from 1 commit
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
4f0a0c9
extract Google password retrieval
endorama Jul 23, 2018
fca81d7
fix tests breaking after extraction
endorama Jul 23, 2018
944db6f
check for tty when asking password
endorama Jul 23, 2018
a64a8e9
fix flake8
endorama Jul 25, 2018
3ca5e01
import print from future to use end keyword argument
endorama Jul 30, 2018
0a24b92
fix test_process_auth_dont_resolve_alias test
endorama Jul 30, 2018
fa1f5cc
update README
endorama Jul 30, 2018
38bac15
Update README.rst
endorama Aug 2, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 21 additions & 0 deletions README.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -152,6 +152,27 @@ be able to use this via Docker; the Docker container will not be able to
access any devices connected to the host ports. You will likely see the
following error during runtime: "RuntimeWarning: U2F Device Not Found".

Feeding password from stdin
~~~~~~~~~~~~~~~~~~~~~~~~~~~

To enhance usability when using third party tools for managing passwords (aka password manager) you can feed data in
``aws-google-auth`` from ``stdin``.

When receiving data from ``stdin`` ``aws-google-auth`` disables the interactive prompt and uses ``stdin`` data.

All interactive prompt could be feeded from ``stdin``, but before `#82 <https://github.com/cevoaustralia/aws-google-auth/issues/82>`_
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

feeded --> fed

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

😅 ops! Fixed!

was not possible to feed the ``Google Password:`` prompt.

Example usage:
::
$ password-manager show password | aws-google-auth
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not aware of what password-manager is - is it another library?
Is it worth linking to it from here too?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not a particular tool per se, I was meaning "whatever cli tool you are using as password manager".

I would prefer not tying the example to a specific password manager, as any cli tool that can output a password on stdout would be good.

Do you think your-password-manager-cli would be clearer?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think something like echo "my_password" | aws-google-auth ... would also work. People who use this tool are likely to know they can swap out the echo for anything that writes the password to stdout. Just my 2c.

Copy link
Contributor Author

@endorama endorama Aug 6, 2018 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

echo "my_password" |

@mide that is what I'd like to avoid. To expert users, I expect reading from stdin is a consolidated concept, as is password leaks to shell history. I'd like to avoid a sample command that's a sort of "shooting yourself in the foot" for newcomers or people not so fond on avoiding common pitfalls when using the shell.

Anyway I'm ok whit that solution as is surely clear and explicit, if someone else approves.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree 100% regarding avoiding "shoot yourself in the foot" examples, but at some point, that isn't our job. I've gone back and forth on this issue quite a bit, and I'm okay either way it lands.

I think there is value in clarity, but there is also value in preventing silly mistakes. I'm fine using a placeholder for a password manager like you've done. I can go either way.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I stand down on my feedback. Let's leave as is.

Google Password: MFA token:
Assuming arn:aws:iam::123456789012:role/admin
Credentials Expiration: ...

**Note:** this feature is intended for password manager integration, not for passing passwords from command line.
Please use interactive prompt if you need to pass the password manually, as this provide enhanced security avoid
password leakage to shell history.

Storage of profile credentials
------------------------------
Expand Down