Skip to content

Commit 932c12c

Browse files
gtclaancomgtclaancom
committed
No need to specify PrincipalArn and RoleArn in options panel anymore. Removed these options from the options panel. PrincipalArn and RoleArn is now parsed from the SAML Assertion itself.
1 parent 4b310ba commit 932c12c

File tree

4 files changed

+37
-28
lines changed

4 files changed

+37
-28
lines changed

‎background/script.js

+37-10
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,7 @@
11
// Global variables
2-
var PrincipalArn = '';
3-
var RoleArn = '';
42
var FileName = 'credentials.txt';
53

6-
// When this background process starts; Load Principal ARN, Role ARN, and output FileName
4+
// When this background process starts, load variables from chrome storage
75
// from saved Extension Options
86
loadItemsFromStorage();
97
// Additionaly on start of the background process it is checked if this extension can be activated
@@ -43,13 +41,47 @@ function removeOnBeforeRequestEventListener() {
4341
// Callback function for the webRequest OnBeforeRequest EventListener
4442
// This function runs on each request to https://signin.aws.amazon.com/saml
4543
function onBeforeRequestEvent(details) {
44+
// Decode base64 SAML assertion in the request
45+
var samlXmlDoc = decodeURIComponent(unescape(window.atob(details.requestBody.formData.SAMLResponse[0])));
46+
// Convert XML String to DOM
47+
parser = new DOMParser()
48+
domDoc = parser.parseFromString(samlXmlDoc, "text/xml");
49+
// Get a list of claims (= AWS roles) from the SAML assertion
50+
var roleDomNodes = domDoc.querySelectorAll('[Name="https://aws.amazon.com/SAML/Attributes/Role"]')[0].childNodes
51+
// Parse the PrincipalArn and the RoleArn from the SAML Assertion.
52+
var PrincipalArn = '';
53+
var RoleArn = '';
54+
var SAMLAssertion = details.requestBody.formData.SAMLResponse[0];
55+
// If there is more than 1 role in the claim, look at the 'roleIndex' HTTP Form data parameter to determine the role to assume
56+
if (roleDomNodes.length > 1 && "roleIndex" in details.requestBody.formData) {
57+
for (i = 0; i < roleDomNodes.length; i++) {
58+
var nodeValue = roleDomNodes[i].innerHTML;
59+
if (nodeValue.indexOf(details.requestBody.formData.roleIndex[0]) > -1) {
60+
// This DomNode holdes the data for the role to assume. Use these details for the assumeRoleWithSAML API call
61+
PrincipalArn = nodeValue.substring(0, nodeValue.indexOf(','));
62+
RoleArn = nodeValue.substring(nodeValue.indexOf(',') + 1);
63+
assumeRoleWithSAML(PrincipalArn, RoleArn, SAMLAssertion);
64+
}
65+
}
66+
}
67+
// If there is just 1 role in the claim there will be no 'roleIndex' in the form data.
68+
else if (roleDomNodes.length == 1) {
69+
// When there is just 1 role in the claim, use these details for the assumeRoleWithSAML API call
70+
PrincipalArn = roleDomNodes[0].substring(0, roleDomNodes[0].indexOf(','));
71+
RoleArn = roleDomNodes[0].substring(roleDomNodes[0].indexOf(',') + 1);
72+
assumeRoleWithSAML(PrincipalArn, RoleArn, SAMLAssertion);
73+
}
74+
}
75+
76+
77+
// Function called from onBeforeRequestEvent when SAMLProvider, Role and SAMLAssertion is available
78+
function assumeRoleWithSAML(PrincipalArn, RoleArn, SAMLAssertion) {
4679
// Set parameters needed for assumeRoleWithSAML method
4780
var params = {
4881
PrincipalArn: PrincipalArn,
4982
RoleArn: RoleArn,
50-
SAMLAssertion: details.requestBody.formData.SAMLResponse[0],
83+
SAMLAssertion: SAMLAssertion,
5184
};
52-
5385
// Call STS API from AWS
5486
var sts = new AWS.STS();
5587
sts.assumeRoleWithSAML(params, function(err, data) {
@@ -65,7 +97,6 @@ function onBeforeRequestEvent(details) {
6597
chrome.downloads.download({ url: doc, filename: FileName, conflictAction: 'overwrite', saveAs: false });
6698
}
6799
});
68-
69100
}
70101

71102

@@ -96,12 +127,8 @@ chrome.runtime.onMessage.addListener(
96127

97128
function loadItemsFromStorage() {
98129
chrome.storage.sync.get({
99-
PrincipalArn: '',
100-
RoleArn: '',
101130
FileName: 'credentials.txt'
102131
}, function(items) {
103-
PrincipalArn = items.PrincipalArn;
104-
RoleArn = items.RoleArn;
105132
FileName = items.FileName;
106133
});
107134
}

‎icons/icon.png

-1001 Bytes
Binary file not shown.

‎options/options.html

-10
Original file line numberDiff line numberDiff line change
@@ -6,16 +6,6 @@
66
<body>
77
<h2>Options page for 'SAML to AWS STS Keys Converter'</h2>
88

9-
<p><label>Specify the Principal ARN. This is the ARN of the SAML provider. For example: <b>arn:aws:iam::123456789123:saml-provider/my-adfs</b></label>
10-
<br />
11-
<input type="text" name="PrincipalArn" id="PrincipalArn" size="70">
12-
</p>
13-
14-
<p><label>Specify the Role ARN. This is the ARN of the role you would like to assume. For example: <b>arn:aws:iam::123456789123:role/EC2Admin</b></label>
15-
<br />
16-
<input type="text" name="RoleArn" id="RoleArn" size="70">
17-
</p>
18-
199
<p><label>Filename for writing the fetched AWS STS keys. File will be written to Chrome's download directory. Example filename: <b>credentials.txt</b></label>
2010
<br />
2111
<input type="text" name="FileName" id="FileName" size="70">

‎options/options.js

-8
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,8 @@
11
// Saves options to chrome.storage
22
function save_options() {
3-
var PrincipalArn = document.getElementById('PrincipalArn').value;
4-
var RoleArn = document.getElementById('RoleArn').value;
53
var FileName = document.getElementById('FileName').value;
64

75
chrome.storage.sync.set({
8-
PrincipalArn: PrincipalArn,
9-
RoleArn: RoleArn,
106
FileName: FileName
117
}, function() {
128
// Update status to let user know options were saved.
@@ -27,12 +23,8 @@ function save_options() {
2723
function restore_options() {
2824
// Default values
2925
chrome.storage.sync.get({
30-
PrincipalArn: 'arn:aws:iam::123456789123:saml-provider/my-adfs',
31-
RoleArn: 'arn:aws:iam::123456789123:role/EC2Admin',
3226
FileName: 'credentials.txt'
3327
}, function(items) {
34-
document.getElementById('PrincipalArn').value = items.PrincipalArn;
35-
document.getElementById('RoleArn').value = items.RoleArn;
3628
document.getElementById('FileName').value = items.FileName;
3729
});
3830
}

0 commit comments

Comments
 (0)