feat: add Okta MFA challenge flow for okta_saml

README.md

@@ -211,6 +211,7 @@ contexts:
 | `console_login` | Run `aws login` during `unic context setup`, then use the resulting profile-backed console credentials | `profile` |
 | `assume_role` | Assume a role from a base profile | `profile`, `role_arn` |
 | `sso` | Use AWS IAM Identity Center / SSO, reusing a valid AWS CLI SSO cache and prompting for login only when needed | `sso_start_url`, and for concrete contexts `sso_account_id`, `sso_role_name`; `profile` is optional |
+| `okta_saml` | Okta SAML federation: `unic env` signs in to Okta (prompt on stderr, password without echo; `UNIC_OKTA_USERNAME`/`UNIC_OKTA_PASSWORD` for automation), exchanges the SAML assertion via `sts:AssumeRoleWithSAML`, and caches the session under `~/.config/unic/cache/okta-saml/`. The TUI reuses a valid cached session passively. Okta MFA challenges support TOTP codes and Okta Verify push in v1 | `okta_org_url`, `okta_app_id`; `role_arn` required when the assertion carries multiple roles. Passwords and MFA secrets are never stored |
 
 The preferred context format separates `auth` from `resources`. `auth.sso_region` controls IAM Identity Center login and role-credential retrieval. `resources.default_region` is selected at startup, and `resources.regions` lists additional regions available from the global `R` region picker. Switching regions reuses the current credentials and recreates only the regional AWS clients.
 

go.mod

@@ -1,6 +1,6 @@
 module unic
 
-go 1.24.2
+go 1.25.0
 
 require (
 	github.com/aws/aws-sdk-go-v2 v1.41.6
@@ -70,6 +70,7 @@ require (
 	github.com/rivo/uniseg v0.4.7 // indirect
 	github.com/spf13/pflag v1.0.9 // indirect
 	github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
-	golang.org/x/sys v0.38.0 // indirect
+	golang.org/x/sys v0.47.0 // indirect
+	golang.org/x/term v0.45.0 // indirect
 	golang.org/x/text v0.3.8 // indirect
 )

go.sum

@@ -137,6 +137,10 @@ golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc=
 golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
+golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
+golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
 golang.org/x/text v0.3.8 h1:nAL+RVCQ9uMn3vJZbV+MRnydTJFPf8qqY42YiA6MrqY=
 golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=

internal/app/context_add.go

@@ -15,7 +15,7 @@ type fieldDef struct {
 	required bool
 }
 
-var authTypes = []string{"sso", "credential", "console_login", "assume_role"}
+var authTypes = []string{"sso", "credential", "console_login", "assume_role", "okta_saml"}
 
 var fieldsByAuthType = map[string][]fieldDef{
 	"sso": {
@@ -51,6 +51,17 @@ var fieldsByAuthType = map[string][]fieldDef{
 		{key: "role_arn", label: "Role ARN", required: true},
 		{key: "external_id", label: "External ID (optional)", required: false},
 	},
+	// okta_saml stores only non-secret metadata; passwords and MFA secrets
+	// never go into config.yaml. Runtime credential exchange is tracked in #85.
+	"okta_saml": {
+		{key: "name", label: "Name", required: true},
+		{key: "order", label: "Display Order (optional, lower first)", required: false},
+		{key: "region", label: "Region", required: true},
+		{key: "regions", label: "Other Resource Regions (optional, comma-separated)", required: false},
+		{key: "okta_org_url", label: "Okta Org URL (https://acme.okta.com)", required: true},
+		{key: "okta_app_id", label: "Okta AWS App ID (from the app embed link)", required: true},
+		{key: "role_arn", label: "Preferred Role ARN (optional)", required: false},
+	},
 }
 
 type contextAddedMsg struct{}
@@ -143,6 +154,8 @@ func (m Model) saveContext() tea.Cmd {
 				SSORegion:    m.addValues["sso_region"],
 				SSOAccountID: m.addValues["sso_account_id"],
 				SSORoleName:  m.addValues["sso_role_name"],
+				OktaOrgURL:   m.addValues["okta_org_url"],
+				OktaAppID:    m.addValues["okta_app_id"],
 			},
 			Resources: &config.ContextResources{
 				DefaultRegion: m.addValues["region"],

internal/app/context_add_test.go

@@ -65,3 +65,47 @@ func TestContextAddKeepsCurrentFieldVisibleOnShortTerminal(t *testing.T) {
 		t.Fatalf("expected windowing indicator on short terminal, got %q", view)
 	}
 }
+
+func TestContextAddSelectsOktaSAMLFields(t *testing.T) {
+	m := New(testConfig(), "", "dev")
+	m.screen = screenContextAdd
+	m.addStep = 0
+	m.addValues = map[string]string{}
+
+	for i, authType := range authTypes {
+		if authType == "okta_saml" {
+			m.addAuthIdx = i
+			break
+		}
+	}
+
+	updated, _ := m.Update(tea.KeyMsg{Type: tea.KeyEnter})
+	model := updated.(Model)
+	if model.addValues["auth_type"] != "okta_saml" {
+		t.Fatalf("expected okta_saml selection, got %q", model.addValues["auth_type"])
+	}
+
+	keys := make([]string, 0, len(model.addFields))
+	required := map[string]bool{}
+	for _, field := range model.addFields {
+		keys = append(keys, field.key)
+		required[field.key] = field.required
+	}
+	joined := strings.Join(keys, ",")
+	for _, want := range []string{"okta_org_url", "okta_app_id", "role_arn"} {
+		if !strings.Contains(joined, want) {
+			t.Fatalf("expected %s field for okta_saml, got %v", want, keys)
+		}
+	}
+	if !required["okta_org_url"] || !required["okta_app_id"] {
+		t.Fatal("expected okta org URL and app ID to be required")
+	}
+	if required["role_arn"] {
+		t.Fatal("expected preferred role ARN to be optional")
+	}
+	for _, key := range keys {
+		if strings.Contains(key, "password") || strings.Contains(key, "secret") || strings.Contains(key, "mfa") {
+			t.Fatalf("okta_saml wizard must not collect secrets, got field %q", key)
+		}
+	}
+}

internal/auth/env.go

@@ -16,6 +16,7 @@ import (
 
 var assumeRoleFn = assumeRoleEnv
 var resolveSSORoleFn = resolveSSORoleEnv
+var resolveOktaSAMLSessionFn = ResolveOktaSAMLSession
 
 const ContextEnvVar = "UNIC_CONTEXT"
 
@@ -53,6 +54,20 @@ func BuildEnvExports(ctx context.Context, cfg *config.Config) (string, error) {
 		values["AWS_DEFAULT_REGION"] = cfg.Region
 		values["AWS_PROFILE"] = ""
 
+	case config.AuthTypeOktaSAML:
+		session, err := resolveOktaSAMLSessionFn(ctx, cfg)
+		if err != nil {
+			return "", err
+		}
+		values = map[string]string{
+			"AWS_ACCESS_KEY_ID":     session.AccessKeyID,
+			"AWS_SECRET_ACCESS_KEY": session.SecretAccessKey,
+			"AWS_SESSION_TOKEN":     session.SessionToken,
+			"AWS_REGION":            cfg.Region,
+			"AWS_DEFAULT_REGION":    cfg.Region,
+			"AWS_PROFILE":           "",
+		}
+
 	case config.AuthTypeCredential, config.AuthTypeConsoleLogin, config.AuthTypeDefault:
 		if cfg.AuthType == config.AuthTypeConsoleLogin {
 			if err := awsservice.ValidateConsoleLoginContext(cfg); err != nil {