AWS scripted authN via IdP with Duo 2FA

[Cantor, Scott]

> My colleague needs to leverage our existing IdP-AWS integration for scripted
> logins to use AWS APIs.  The script provided by AWS at
> https://aws.amazon.com/blogs/security/how-to-implement-a-general-
> solution-for-federated-apicli-access-using-saml-2-0/
> works for users who do *not* use Duo in the IdP, but it does not extend to
> those with Duo enabled because it does not know to consume and provide
> appropriate responses as user agent to the Duo prompts for choice of 2nd
> factor (push, phone, key, etc.).

That "solution" is screen scraping. Do NOT do that, certainly not in anything you give to other people.

ECP is the only supported way to script a login from a client that's not a browser (notwithstanding your Duo question, but that's just an additional complication).

-- Scott