Skip to content

fix error displayed when entering invalid otp#120

Merged
slycoder merged 4 commits intophysera:masterfrom
chrono:fix-mfa-error-handling
Oct 28, 2018
Merged

fix error displayed when entering invalid otp#120
slycoder merged 4 commits intophysera:masterfrom
chrono:fix-mfa-error-handling

Conversation

@chrono
Copy link
Contributor

@chrono chrono commented Jun 1, 2018

Description

When fetching saml from onelogin after providing an OTP, no errors were handled. One of the expected errors is the OTP not being valid. Now handles error responses from Onelogin and prints them to the user.

Example message returned when entering an invalid OTP:
Exception: Onelogin Error: '401' 'Failed authentication with this factor'

Related Issue

when typing an invalid otp, the error message was:
AttributeError: 'NoneType' object has no attribute 'saml_response'

The stack trace associated with this exception:

Traceback (most recent call last):
  File "/usr/local/bin/onelogin-aws-login", line 11, in <module>
    load_entry_point('onelogin-aws-cli==0.1.11', 'console_scripts', 'onelogin-aws-login')()
  File "/usr/local/lib/python3.6/site-packages/onelogin_aws_cli/cli.py", line 65, in login
    raise e
  File "/usr/local/lib/python3.6/site-packages/onelogin_aws_cli/cli.py", line 61, in login
    api.save_credentials()
  File "/usr/local/lib/python3.6/site-packages/onelogin_aws_cli/__init__.py", line 139, in save_credentials
    self.assume_role()
  File "/usr/local/lib/python3.6/site-packages/onelogin_aws_cli/__init__.py", line 125, in assume_role
    self.get_role()
  File "/usr/local/lib/python3.6/site-packages/onelogin_aws_cli/__init__.py", line 108, in get_role
    self.get_arns()
  File "/usr/local/lib/python3.6/site-packages/onelogin_aws_cli/__init__.py", line 86, in get_arns
    base64.b64decode(self.saml.saml_response))
AttributeError: 'NoneType' object has no attribute 'saml_response'

How Has This Been Tested?

Applied patch locally and tested by entering valid/invalid otp

Copy link

@jakebolam jakebolam left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

No more 'NoneType' object has no attribute 'saml_response'

@codecov-io
Copy link

Codecov Report

Merging #120 into master will decrease coverage by 0.17%.
The diff coverage is 50%.

Impacted file tree graph

@@            Coverage Diff             @@
##           master     #120      +/-   ##
==========================================
- Coverage   78.54%   78.36%   -0.18%     
==========================================
  Files           6        6              
  Lines         317      319       +2     
==========================================
+ Hits          249      250       +1     
- Misses         68       69       +1
Impacted Files Coverage Δ
onelogin_aws_cli/__init__.py 70.32% <50%> (-0.46%) ⬇️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 4ab1d5e...99cf0c4. Read the comment docs.

saml_resp.mfa.state_token,
self.mfa.otp
)
if saml_resp is None:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Great catch! How would you feel about pulling this code out into a separate function so there's less duplication with the other None check?

Copy link
Contributor

@slycoder slycoder left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks lgtm. Could you resolve the conflicts and I'll merge =).

@drewsonne
Copy link
Contributor

Is it possible to mock out the get_saml_assertion function to add some test coverage for this?

chrono added 2 commits June 6, 2018 11:45
when typing an invalid otp, the error message was not helpful.

error now:
Exception: Onelogin Error: '401' 'Failed authentication with this factor'

error before:
```AttributeError: 'NoneType' object has no attribute 'saml_response'```

stack trace:
```
Traceback (most recent call last):
  File "/usr/local/bin/onelogin-aws-login", line 11, in <module>
    load_entry_point('onelogin-aws-cli==0.1.11', 'console_scripts', 'onelogin-aws-login')()
  File "/usr/local/lib/python3.6/site-packages/onelogin_aws_cli/cli.py", line 65, in login
    raise e
  File "/usr/local/lib/python3.6/site-packages/onelogin_aws_cli/cli.py", line 61, in login
    api.save_credentials()
  File "/usr/local/lib/python3.6/site-packages/onelogin_aws_cli/__init__.py", line 139, in save_credentials
    self.assume_role()
  File "/usr/local/lib/python3.6/site-packages/onelogin_aws_cli/__init__.py", line 125, in assume_role
    self.get_role()
  File "/usr/local/lib/python3.6/site-packages/onelogin_aws_cli/__init__.py", line 108, in get_role
    self.get_arns()
  File "/usr/local/lib/python3.6/site-packages/onelogin_aws_cli/__init__.py", line 86, in get_arns
    base64.b64decode(self.saml.saml_response))
AttributeError: 'NoneType' object has no attribute 'saml_response'
```
@chrono chrono force-pushed the fix-mfa-error-handling branch from c05323c to c6554f3 Compare June 6, 2018 15:46
chrono added 2 commits July 3, 2018 12:45
…ling

* physera/master:
  v0.1.13 version bump (physera#124)
  auto_determine_ip_address is not a required value (physera#123)
…ling

* physera/master:
  Make sts client region aware (physera#134)
  Fix inconsistent profile names with different AWS partitions (physera#133)
  fix company typo (physera#129)
  Version bump
  Update pipfile.lock
  Add region option to command line and configuration file. (physera#127)
@jakebolam
Copy link

jakebolam commented Oct 25, 2018

This keeps tripping developers up.

'NoneType' object has no attribute 'saml_response'. When your password is wrong

@chrono
Copy link
Contributor Author

chrono commented Oct 25, 2018

CI seems to be failing on flake8, complaining about files that haven't even been touched :/

@slycoder
Copy link
Contributor

I'm swamped and can't look into the flake8 issues right now but if anyone else wants to roll that patch into this PR or a separate PR, we'd be glad to have it =).

@slycoder
Copy link
Contributor

(Hopefully I can look at it some time next week)

@drewsonne drewsonne mentioned this pull request Oct 26, 2018
@slycoder
Copy link
Contributor

Ok, violations are fixed on master thanks to quick work by @drewsonne .

@slycoder
Copy link
Contributor

I think flake8 should be resolved on master; I agree that there should be more test coverage here but we can do that as a followup since there are so many people waiting on this.

@slycoder slycoder merged commit 48fc0a4 into physera:master Oct 28, 2018
@slycoder
Copy link
Contributor

Oops, this did in fact break some tests. I'll patch those up shortly.

@chrono chrono deleted the fix-mfa-error-handling branch November 8, 2018 03:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants