feat: support GovCloud (#197)

lib/okta.go

@@ -212,7 +212,13 @@ func (o *OktaClient) AuthenticateProfile(profileARN string, duration time.Durati
 
 	// Step 4 : Assume Role with SAML
 	samlSess := session.Must(session.NewSession())
-	svc := sts.New(samlSess)
+	var svc *sts.STS
+	if assertion.Resp.Destination == "https://signin.amazonaws-us-gov.com/saml" {
+		svc = sts.New(samlSess, aws.NewConfig().WithRegion("us-gov-west-1"))
+	} else {
+		svc = sts.New(samlSess)
+	}
+	log.Debugf("SAML assertion has destination %s, STS client is configured with endpoint %s\n", assertion.Resp.Destination, svc.Client.ClientInfo.Endpoint)
 
 	samlParams := &sts.AssumeRoleWithSAMLInput{
 		PrincipalArn:    aws.String(principal),

lib/provider.go

@@ -187,7 +187,7 @@ func (p *Provider) getSamlURL() (string, error) {
 	if err != nil {
 		return "", errors.New("aws_saml_url missing from ~/.aws/config")
 	}
-	log.Debugf("Using aws_saml_url from profile: %s", profile)
+	log.Debugf("Using aws_saml_url from profile %s: %s", profile, oktaAwsSAMLUrl)
 	return oktaAwsSAMLUrl, nil
 }
 

lib/utils.go

@@ -7,6 +7,7 @@ import (
 	"strings"
 
 	"github.com/segmentio/aws-okta/lib/saml"
+	log "github.com/sirupsen/logrus"
 	"golang.org/x/net/html"
 )
 
@@ -16,6 +17,7 @@ func GetRoleFromSAML(resp *saml.Response, profileARN string) (string, string, er
 	for _, a := range resp.Assertion.AttributeStatement.Attributes {
 		if strings.HasSuffix(a.Name, "SAML/Attributes/Role") {
 			for _, v := range a.AttributeValues {
+				log.Debugf("Got SAML role attribute: %s", v.Value)
 				tokens := strings.Split(v.Value, ",")
 				if len(tokens) != 2 {
 					continue