id       = "saml2aws"
name     = "saml2aws"
homepage = "https://github.com/Versent/saml2aws"
description = "A command-line tool that converts SAML assertions into AWS credentials."
executables   = ["saml2aws"]

[dotfiles]

# The official README's configuration examples state that named IdP accounts
# are saved in ~/.saml2aws. It is an INI-style account settings file; temporary
# AWS credentials are written to the AWS credentials file instead, covered by
# the aws entry.
# https://github.com/Versent/saml2aws/blob/master/README.md?plain=1
paths = ["~/.saml2aws"]

exclude = []

# Passwords are prompted for or retained by the OS keychain; the documented
# ~/.saml2aws example contains account settings only. AWS credentials generated
# by login belong to ~/.aws/credentials and are covered by aws.
secret = []

[commands]
format = 1
label = "saml2aws"
description = "Log in to a SAML identity provider for temporary AWS credentials, or run a command with them. Provider-specific login flags (Okta, OneLogin, F5 APM) are left out."
quality = "ai-draft"
parser = { end_of_options = "--", interleave = "permute", long_equals = true, short_attached = true, short_bundles = false }

[[commands.subcommand]]
path = ["login"]
label = "Log in and fetch credentials"
description = "Login to a SAML 2.0 IDP and convert the SAML assertion to an STS token."

[[commands.subcommand.source]]
id = "help"
kind = "help"
url = "https://github.com/Versent/saml2aws#usage"
revision = "2026-10-27"
evidence = """
  -a, --idp-account="default"  The name of the configured IDP account. (env: SAML2AWS_IDP_ACCOUNT)
  -s, --skip-verify            Skip verification of server certificate. (env: SAML2AWS_SKIP_VERIFY)
      --skip-prompt            Skip prompting for parameters during login.
      --session-duration=SESSION-DURATION
      --role=ROLE              The ARN of the role to assume. (env: SAML2AWS_ROLE)
  login [<flags>]
    Login to a SAML 2.0 IDP and convert the SAML assertion to an STS token.
    -p, --profile=PROFILE        The AWS profile to save the temporary credentials. (env: SAML2AWS_PROFILE)
        --force                  Refresh credentials even if not expired.
        --credential-process     Enables AWS Credential Process support by outputting credentials to STDOUT in a JSON message.
"""

[[commands.subcommand.field]]
id = "idp_account"
label = "IDP account"
type = "string"
option = ["--idp-account", "-a"]
sources = ["help"]

[[commands.subcommand.field]]
id = "profile"
label = "AWS profile"
description = "Profile that receives the temporary credentials."
type = "string"
option = ["--profile", "-p"]
sources = ["help"]

[[commands.subcommand.field]]
id = "role"
label = "Role ARN"
type = "string"
option = ["--role"]
sources = ["help"]

[[commands.subcommand.field]]
id = "session_duration"
label = "Session duration (seconds)"
type = "integer"
option = ["--session-duration"]
sources = ["help"]

[[commands.subcommand.field]]
id = "force"
label = "Force refresh"
description = "Refresh credentials even if not expired."
type = "boolean"
option = ["--force"]
sources = ["help"]

[[commands.subcommand.field]]
id = "skip_prompt"
label = "Skip prompts"
type = "boolean"
option = ["--skip-prompt"]
sources = ["help"]

[[commands.subcommand.field]]
id = "skip_verify"
label = "Skip certificate verification"
type = "boolean"
option = ["--skip-verify", "-s"]
sources = ["help"]

[[commands.subcommand.task]]
id = "login"
label = "Log in"
fields = ["idp_account", "profile", "role", "session_duration", "force"]

[[commands.subcommand.task]]
id = "refresh"
label = "Force a refresh"
set = { force = [true] }
lock = ["force"]
fields = ["idp_account", "profile", "force", "skip_prompt"]

[[commands.subcommand.group]]
id = "basic"
label = "Basic"
fields = ["idp_account", "profile", "role", "force"]

[[commands.subcommand.group]]
id = "advanced"
label = "Advanced"
fields = ["session_duration", "skip_prompt", "skip_verify"]

[[commands.subcommand]]
path = ["exec"]
label = "Run a command with credentials"
description = "Exec the supplied command with env vars from STS token."

[[commands.subcommand.source]]
id = "help"
kind = "help"
url = "https://github.com/Versent/saml2aws#usage"
revision = "2026-10-27"
evidence = """
  exec [<flags>] [<command>...]
    Exec the supplied command with env vars from STS token.
    -p, --profile=PROFILE      The AWS profile to save the temporary credentials. (env: SAML2AWS_PROFILE)
        --exec-profile=EXEC-PROFILE
"""

[[commands.subcommand.field]]
id = "profile"
label = "AWS profile"
type = "string"
option = ["--profile", "-p"]
sources = ["help"]

[[commands.subcommand.field]]
id = "exec_profile"
label = "Execution profile"
description = "Profile used for command execution, e.g. for secondary role assumption."
type = "string"
option = ["--exec-profile"]
sources = ["help"]

[[commands.subcommand.field]]
id = "command"
label = "Command"
type = "string"
position = 0
multiple = true
min = 1
sources = ["help"]

[[commands.subcommand.task]]
id = "exec"
label = "Run a command"
fields = ["profile", "exec_profile", "command"]
required = ["command"]

[[commands.subcommand.group]]
id = "basic"
label = "Basic"
fields = ["profile", "exec_profile", "command"]

[[commands.subcommand]]
path = ["console"]
label = "Open the AWS console"
description = "Console will open the aws console after logging in."

[[commands.subcommand.source]]
id = "help"
kind = "help"
url = "https://github.com/Versent/saml2aws#usage"
revision = "2026-10-27"
evidence = """
  console [<flags>]
    Console will open the aws console after logging in.
    -p, --profile=PROFILE      The AWS profile to save the temporary credentials. (env: SAML2AWS_PROFILE)
        --force                Refresh credentials even if not expired.
        --link                 Present link to AWS console instead of opening browser
"""

[[commands.subcommand.field]]
id = "profile"
label = "AWS profile"
type = "string"
option = ["--profile", "-p"]
sources = ["help"]

[[commands.subcommand.field]]
id = "force"
label = "Force refresh"
type = "boolean"
option = ["--force"]
sources = ["help"]

[[commands.subcommand.field]]
id = "link"
label = "Print link only"
description = "Present a link instead of opening the browser."
type = "boolean"
option = ["--link"]
sources = ["help"]

[[commands.subcommand.task]]
id = "console"
label = "Open console"
fields = ["profile", "force", "link"]

[[commands.subcommand.group]]
id = "basic"
label = "Basic"
fields = ["profile", "force", "link"]