Why is SSPI enabled per default?

[mjernsell]

The login flow in _azure_cloud_mfa_authenticator is broken unless the --no-sspi is given.

I'm not sure if this was the intended behaviour or not, but previously in html_roles_fetcher the User-Agent was not set since the import from requets_negotiate_sspi import HttpNegotiateAuth failed. The new behaviour now sets the header since sspi is set to True in the fetch_html_encoded_roles which (by some reason unknown to me) breaks the login - after password is given, "This account does not have access to any roles" is received instead of having a prompt for MFA.

Was the intention to have sspi enabled per default (it seems to be set in the get_prepared_config function in prepare.py)?

[kfattig]

I broke this - and I'm sort of stuck on how to best fix it. My thoughts here:
#126 (comment)

I don't actually have an SSPI environment, so I can't say when the header is required. I know that in my case (and, according to the comments here, others) the header causes issues. I just trusted the comment & documentation which says that SSPI should be on by default and the header is required when using it.

[lmayorga1980]

I am having a related issue when using AzureMFA Authentication.

aws-adfs login --adfs-host my.adfs.host --authfile auth.txt --profile test-account

I was getting this response.

This account does not have access to any roles

I went and updated this file to print the response vim ./venv/Lib/site-packages/aws_adfs/html_roles_fetcher.py and I got this response.

https://gist.github.com/lmayorga1980/ff6adfe00052a8b462b43723b836e77e

Maybe there needs to be another property to be set?

At this time, the best I can do is use an HTTP Packet Trace on my browser to see if it's sending some extra headers
https://github.com/venth/aws-adfs/blob/master/aws_adfs/html_roles_fetcher.py#L92

[kfattig]

@lmayorga1980 Did you try with '--no-sspi' ?

[lmayorga1980]

aws-adfs: 1.18.1

Maybe an older version?

$ aws-adfs login --adfs-host myadfshost --authfile auth.txt --profile test-account --no-sspi

2019-10-08 16:55:36,282 [authenticator authenticator.py:authenticate] [18580-MainProcess] [5996-MainThread] - ERROR: Cannot extract saml assertion. Re-authentication needed?
2019-10-08 16:55:36,431 [authenticator authenticator.py:authenticate] [18580-MainProcess] [5996-MainThread] - ERROR: Cannot extract saml assertion. Re-authentication needed?
This account does not have access to any roles

I tried 1.17.0 and also the same error.

[lmayorga1980]

any 📰 @kfattig ??