Showing correct answer for Okta Verify during unusual login attempts (#…

…369)

* added showing correct answer for Okta Verify

* stopping spinner before displaying correct answer

okta/client.go

@@ -105,6 +105,15 @@ type VerifyFactorResponse struct {
 	SessionToken string    `json:"sessionToken"`
 	Status       string    `json:"status"`
 	FactorResult string    `json:"factorResult,omitempty"`
+	Embedded     struct {
+		Factor struct {
+			Embedded struct {
+				Challenge struct {
+					CorrectAnswer int `json:"correctAnswer"`
+				} `json:"challenge"`
+			} `json:"_embedded"`
+		} `json:"factor"`
+	} `json:"_embedded"`
 }
 
 // VerifyFactor performs MFA verification.

okta/get.go

@@ -124,11 +124,20 @@ func Get(app, provider, pArn, awsRegion string, duration int32) (*aws.Credential
 				return nil, fmt.Errorf("verifying MFA: %v", err)
 			}
 
+			// true if correct answer for Okta Verify has already been shown in CLI
+			// to avoid spamming the user
+			var answerShown bool
+
 			for vfResp.FactorResult == VerifyFactorStatusWaiting {
 				vfResp, err = c.VerifyFactor(&VerifyFactorParams{
 					FactorID:   factor.ID,
 					StateToken: stateToken,
 				})
+				if answer := vfResp.Embedded.Factor.Embedded.Challenge.CorrectAnswer; answer != 0 && !answerShown {
+					s.Stop()
+					fmt.Printf("Okta marked the attempt as unusual, select number '%d' in Okta Verify\n", answer)
+					answerShown = true
+				}
 				time.Sleep(2 * time.Second)
 			}
 			s.Stop()