Use Java 2.x Auth SDK for credential provider

[gautam-nutalapati]

We are using Java 2.16.31 AWS SDK , that has inbuilt support for AWS SSO in credential provider chain. It was added in 2.15.33 as per.
But aws-encryption-sdk-java is using 1.x Java SDK.
This results in java.lang.NoClassDefFoundError: com/amazonaws/auth/AWSCredentialsProvider

If we switch back to 1.x Java SDK, we cannot use SSO credentials.
Can we support the use of software.amazon.awssdk:auth:2.16.XX for credential provider?
Or even better, use 2.X Java SDK?

[texastony]

Howdy guatum,
Thank you for bringing this to our attention, it is an excellent question.
The AWS SDK for Java fortunately provides the tools needed to resolve this matter. The V1 SDK and the V2 SDK use distinct namespaces (com.amazonaws vs software.amazon.awssdk).

As such, we can pull in the useful portions of the newer SDK without breaking the Encryption SDK. In this case, the 2.x auth library, which should allow your application to use SSO.

Assuming you are using Maven as your package manager, adding the following to the dependencies section in the pom.xml should bring in the needed classes:

        <dependency>
            <groupId>software.amazon.awssdk</groupId>
            <artifactId>auth</artifactId>
            <version>2.16.31</version>
        </dependency>

We cannot, at this time, move the Encryption SDK off of AWS SDK 1.x. But if there are other features from 2.x that are needed by your project, you can bring them in to your project much like the auth module above. You can follow this guide on importing specific modules, and this guide on using the two SDKs at the same time.

Let us know if we can be any help or if any of this is unclear by re-opening this issue.

[gautam-nutalapati]

@texastony Thanks for the response. Sounds like your suggestion allows our app to use SSO.
But Encryption SDK's features will still not work when app is run via SSO, because Encryption SDK is internally using 1.x.

Its not a major blocker, as we will use IAM role based access when running in PROD, but when running locally, use of SSO (which is better than using credentials in* terms* of* security*) is not possible.

[texastony]

Guatum,

We have taken migrating to the 2.x Java SDK into our roadmap, but we do not currently have a timeline for when it might be available.

A team member has already created an issue to track this in 2018. We will close this issue #245 in favor of #58.

Much Obliged,
AWS Crypto Tools