Skip to content

feat: add Okta MFA challenge flow for okta_saml - #246

Closed
youngjinjung-linq wants to merge 3 commits into
DevopsArtFactory:mainfrom
youngjinjung-linq:feature/issue-87-okta-mfa-challenge
Closed

feat: add Okta MFA challenge flow for okta_saml#246
youngjinjung-linq wants to merge 3 commits into
DevopsArtFactory:mainfrom
youngjinjung-linq:feature/issue-87-okta-mfa-challenge

Conversation

@youngjinjung-linq

@youngjinjung-linq youngjinjung-linq commented Aug 13, 2026

Copy link
Copy Markdown

Summary

Implements #87 (Okta SAML track #26). Stacked on #245 — merge #244 → #245 → this.

  • v1 factor set (explicitly scoped per the issue): TOTP (token:software:totp) and Okta Verify push. TOTP is preferred when both are enrolled because it completes without waiting.
  • MFA_REQUIRED now enters a challenge flow instead of erroring: factor selection → verification via the factor's verify link with the state token.
  • TOTP: prompts for the code on stderr, verifies once, fails with the returned status on a wrong code.
  • Push: sends the notification and polls the verify link (3s interval, 60s deadline) with explicit handling for REJECTED, TIMEOUT, context cancellation, and the poll deadline.
  • Accounts with only unsupported factors get an error listing available vs. supported factor types; MFA_ENROLL is reported as "no enrolled MFA factor".
  • One-time codes and state tokens are never persisted; the session cache still stores only the exchanged AWS credentials.

Testing

  • go test ./... passes: TOTP success and wrong-code failure, push approved-after-polling, push rejected, unsupported-factor listing — all against httptest Okta servers with scripted verify responses.
  • make build passes.

Closes #87

Part of #26

YoungJin and others added 3 commits August 13, 2026 17:28
YoungJin @claude
feat: add okta_saml auth type and context schema
dbd5773 
Introduce the okta_saml auth type so Okta-backed contexts can be
defined ahead of runtime credential exchange (DevopsArtFactory#85). Config gains
okta_org_url and okta_app_id fields in both the flat and structured
auth forms, the context add wizard offers okta_saml with non-secret
fields only (passwords and MFA secrets never touch config.yaml), and
the repository/env flows reject okta_saml contexts with a clear
not-implemented-yet error instead of misbehaving.

Closes DevopsArtFactory#84

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BFhLrnpVxivu62cC3k9NZB
YoungJin @claude
feat: add Okta SAML credential exchange with session cache
5796a99 
Implement runtime credential resolution for okta_saml contexts:
`unic env` performs Okta primary authentication (prompting on stderr
with no-echo password input, or UNIC_OKTA_USERNAME/UNIC_OKTA_PASSWORD
for automation), fetches the SAML assertion from the app embed link,
parses the AWS role/principal pairs, and exchanges the assertion via
sts:AssumeRoleWithSAML. Role selection is deterministic: the context's
role_arn wins, a single role is auto-selected, and multiple roles
without a preference produce an explicit error listing the choices.

Session credentials are cached under ~/.config/unic/cache/okta-saml/
(0700/0600, keyed by org|app|role) until expiry; the Okta password and
session token are never persisted. The TUI passively reuses a valid
cached session and otherwise points at `unic env <context>`. Okta MFA
challenges are rejected with a clear error until DevopsArtFactory#87 lands.

Closes DevopsArtFactory#85
Closes DevopsArtFactory#86

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BFhLrnpVxivu62cC3k9NZB
YoungJin @claude
feat: add Okta MFA challenge flow for okta_saml
e1729ee 
Handle MFA_REQUIRED during Okta primary authentication with a v1
factor set of TOTP (token:software:totp) and Okta Verify push. TOTP is
preferred when both are enrolled because it completes without waiting;
push sends the notification and polls the verify link (3s interval,
60s timeout) with explicit rejected/timeout/cancel handling. Accounts
with only unsupported factors get an error listing what is available
versus supported, and MFA_ENROLL is reported as no-enrolled-factor.
One-time codes are read interactively and never persisted.

Closes DevopsArtFactory#87

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BFhLrnpVxivu62cC3k9NZB
@coderabbitai

coderabbitai Bot commented Aug 13, 2026

Copy link
Copy Markdown

Warning

Review limit reached

@youngjinjung-linq, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 14 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: deb1f7c0-219a-49c5-a87b-a57a4b6ddfff

📥 Commits

Reviewing files that changed from the base of the PR and between 744b139 and e1729ee.

⛔ Files ignored due to path filters (1)
  • go.sum is excluded by !**/*.sum
📒 Files selected for processing (12)
  • README.md
  • go.mod
  • internal/app/context_add.go
  • internal/app/context_add_test.go
  • internal/auth/env.go
  • internal/auth/okta.go
  • internal/auth/okta_test.go
  • internal/config/config.go
  • internal/config/config_test.go
  • internal/services/aws/okta_saml_cache.go
  • internal/services/aws/okta_saml_cache_test.go
  • internal/services/aws/repository.go

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@youngjinjung-linq youngjinjung-linq mentioned this pull request Aug 13, 2026
Closed
@YoungJinJung

YoungJinJung commented Aug 13, 2026

Copy link
Copy Markdown
Contributor

Recreated as #259 from an in-repo branch under the maintainer account; this PR is superseded.

@youngjinjung-linq
youngjinjung-linq deleted the feature/issue-87-okta-mfa-challenge branch August 13, 2026 23:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

feat: Add Okta MFA challenge flow for okta_saml

2 participants

@youngjinjung-linq @YoungJinJung