Handle Okta authentication failures more gracefully #256
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Introduce detailed error handling for Okta authentication failures, providing specific messages when an "invalid_grant" error occurs. Offer user guidance to resolve the issue by logging out and back into Okta if multiple attempts fail. Closes #241
laura-rodriguez
approved these changes
Jan 3, 2025
Merged
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Bringing in @Eitol's #241
This pull request addresses an issue where users with expired sessions in their browsers encounter repeated authentication failures when running the okta-aws-cli web command. Previously, the tool would attempt to authenticate twice and display an error message: "Cached access token appears to be stale...". However, it did not provide clear guidance on how to resolve the issue.
Changes Made:
Updated the NewWebCommand function to check after two failed authentication attempts.
If the authentication fails due to an invalid_grant error after retries, the tool now informs the user to log out of Okta in their
browser and log back in.
Added user-friendly messaging to guide users through resolving the expired session issue.
Impact:
see: #153 (comment)