Azure / Azure/azure-cli

Allow me to make a single sign-on SAML request using the Azure CLI

Open
#10,012 3 comments 0 reactions 1 assignee Claimed by @jiasli View on GitHub
Account act-identity-squad customer-reported feature-request OKR3.4 Candidate
Dominant language
Python
Stars
4.6k
Forks
3.5k
Avg merge
3d 2h
Merged PRs (30d)
60

Description

**Is your feature request related to a problem? Please describe.**
I want to make SAML requests to Azure Active Directory using the CLI.

**Describe the solution you'd like**
Ideally, a way to make an HTTP request as the logged-in user.

There’s already an `az rest` command that looked like it would be close:

```console
$ az rest --method=get --uri='https://login.microsoftonline.com/$TENANTID/saml2?SAMLRequest=$SAMLREQUEST' --skip-authorization-header
```

but it doesn't seem to work. If I try that, the response is a "Please sign into your account" page.

**Describe alternatives you've considered**
I’m familiar with [dtjohnson/aws-azure-login](https://github.com/dtjohnson/aws-azure-login), which is what I’m using, but spinning up a headless browser and scraping the AD login screen feels a bit icky – surely there should be a better way?

**Additional context**
At work, we use Azure Active Directory to manage users, and we’re trying to use SAML to authenticate an AD user with AWS.

As part of this workflow, I want to be able to run a command-line tool that logs me into AD, authenticates with AWS, then uses AWS STS to create some local AWS credentials.

These are the steps I'm doing:

1. Run `az login --allow-no-subscriptions` to log into the CLI.
2. Get my tenant ID by running `az account show`
3. Get the app ID URL by running `az ad app list --display-name 'AWS'` (typically something like https://signin.aws.amazon.com/saml#12)
4. Construct an AuthnRequest following the instructions in the [Single Sign-On SAML protocol docs](https://docs.microsoft.com/en-us/azure/active-directory/develop/single-sign-on-saml-protocol#authnrequest). That gives me a URL like

https://login.microsoftonline.com//saml2/?SAMLRequest=

5. Somehow open the contents of that URL as a signed-in user.

I’m struggling to do step 5 with the CLI – it knows I’m logged in, but I can’t see how to make an authenticated request.

Am I asking for a new feature, missing something that’s already there, or barking up the wrong tree?

Related: https://github.com/wellcometrust/platform/issues/3753

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.