Yubikey support

[mtibben]

Support for Yubikey OATH-TOTP via ykman.

Thanks to @j0hnsmith for the initial PRs at #316, #514, #533

Could someone with a Yubikey please test this? @j0hnsmith @jtopper or anyone else?
Docs and binaries

[RiccardoBoettcher]

No Linux build yet available for testing ...

[mtibben]

No Linux build yet available for testing ...

uploading now

[asiragusa]

Hi @mtibben, thanks for this great PR!

I have a small issue getting the OATH code with my Yubikey that already contains multiple secrets with the current naming format:

 ./aws-vault exec --prompt ykman staging -- aws s3 ls
aws-vault: error: Failed to get credentials for staging: ykman: exit status 1:
Error: Multiple matches, please make the query more specific.

aws:arn:aws:iam::ID:mfa/alessandro
aws:arn:aws:iam::ID:mfa/alessandro-2

This is really strange as if I run manually ykman oath code -s aws:arn:aws:iam::ID:mfa/alessandro (like in https://github.com/99designs/aws-vault/pull/558/files#diff-1d1bf1de34ef664900cccdefd19fe78fR12) I can get correctly a OATH code.

For the record, my OS is Darwin 19.3.0 and I have 2 users because I use this Yubikey in 2 different computers.

As a side note #316 introduced also a very handy add-yubikey command, are you planning to add it back? If not I can help with a PR if needed!

[RiccardoBoettcher]

tested the linux build on fedora 31: worked for me as described. Just validaded, my existing profile which was previously used with a manually entered TOTP now can be used with yubikey touch.
testet command: aws-vault exec

[christophgysin]

Works for me on Arch. Two things I noted:

• There is no prompt. The current implementation hides the ykman prompt on stderr, and doesn't provide a prompt of its own.
• It would be nice if one could specify the prompt per profile.

[mtibben]

This is really strange as if I run manually....I can get correctly a OATH code.

Thanks @asiragusa, that is very strange. I've expanded the flag to --single. Does that help? ykman oath code does specify QUERY as the argument, but I can't find any documentation on the actual query syntax in the docs. Looking at the code it seems direct matches should hit. Any guidance here? What version of ykman are you using?

As a side note #316 introduced also a very handy add-yubikey command, are you planning to add it back?

As noted in #514 (comment), I'm not convinced a very specific command for managing yubikeys belong in aws-vault. As I assume this should be just a couple lines of shell script, perhaps you could create a contrib shell script using the aws cli to achieve the same thing?

[mtibben]

There is no prompt. The current implementation hides the ykman prompt on stderr, and doesn't provide a prompt of its own.

Good point @christophgysin. I've addressed this in 34e4756

It would be nice if one could specify the prompt per profile.

Great idea. Perhaps a aws_vault_prompt param for the aws config file? I'll leave this as an exercise for whoever may be motivated

[mtibben]

New binaries uploaded

[asiragusa]

This is really strange as if I run manually....I can get correctly a OATH code.

Thanks @asiragusa, that is very strange. I've expanded the flag to --single. Does that help? ykman oath code does specify QUERY as the argument, but I can't find any documentation on the actual query syntax in the docs. Looking at the code it seems direct matches should hit. Any guidance here? What version of ykman are you using?

Got it! The issue comes from the entries stored in my Yubikey, they are prefixed by aws:, so I can confirm that your PR is working correctly.

As a side note #316 introduced also a very handy add-yubikey command, are you planning to add it back?

As noted in #514 (comment), I'm not convinced a very specific command for managing yubikeys belong in aws-vault. As I assume this should be just a couple lines of shell script, perhaps you could create a contrib shell script using the aws cli to achieve the same thing?

Sure, here it is #559

[mtibben]

Amazing! Thanks @asiragusa

[ismailyenigul]

Thanks for this feature. I have written a basic article about configuring yubikey on MacOS at https://medium.com/@ismailyenigul/configuring-aws-vault-6-x-with-yubikey-on-macos-792c3ce8b6b5
I just made more clear ~/aws/config part for my own need :) I hope it will help someone else.