Allow me to make a single sign-on SAML request using the Azure CLI
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 3.5k
- Avg merge
- 3d 2h
- Merged PRs (30d)
- 60
Description
**Is your feature request related to a problem? Please describe.**
I want to make SAML requests to Azure Active Directory using the CLI.
**Describe the solution you'd like**
Ideally, a way to make an HTTP request as the logged-in user.
There’s already an `az rest` command that looked like it would be close:
```console
$ az rest --method=get --uri='https://login.microsoftonline.com/$TENANTID/saml2?SAMLRequest=$SAMLREQUEST' --skip-authorization-header
```
but it doesn't seem to work. If I try that, the response is a "Please sign into your account" page.
**Describe alternatives you've considered**
I’m familiar with [dtjohnson/aws-azure-login](https://github.com/dtjohnson/aws-azure-login), which is what I’m using, but spinning up a headless browser and scraping the AD login screen feels a bit icky – surely there should be a better way?
**Additional context**
At work, we use Azure Active Directory to manage users, and we’re trying to use SAML to authenticate an AD user with AWS.
As part of this workflow, I want to be able to run a command-line tool that logs me into AD, authenticates with AWS, then uses AWS STS to create some local AWS credentials.
These are the steps I'm doing:
1. Run `az login --allow-no-subscriptions` to log into the CLI.
2. Get my tenant ID by running `az account show`
3. Get the app ID URL by running `az ad app list --display-name 'AWS'` (typically something like https://signin.aws.amazon.com/saml#12)
4. Construct an AuthnRequest following the instructions in the [Single Sign-On SAML protocol docs](https://docs.microsoft.com/en-us/azure/active-directory/develop/single-sign-on-saml-protocol#authnrequest). That gives me a URL like
https://login.microsoftonline.com//saml2/?SAMLRequest=
5. Somehow open the contents of that URL as a signed-in user.
I’m struggling to do step 5 with the CLI – it knows I’m logged in, but I can’t see how to make an authenticated request.
Am I asking for a new feature, missing something that’s already there, or barking up the wrong tree?
Related: https://github.com/wellcometrust/platform/issues/3753
Contributor guide
Assessment
This issue has not been assessed yet.