Skip to content

Commit 1609fe8

Browse files
jasdeljasdel
authored
credentials/ssocreds: Add SSOTokenProvider for Bearer Token auth (#1818)
Adds a new credential provider, SSOTokenProvider for using Bearer token authentication with AWS services.
1 parent 8e755b4 commit 1609fe8

File tree

741 files changed

+2911
-1408
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

741 files changed

+2911
-1408
lines changed

‎Makefile

Lines changed: 20 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -72,22 +72,22 @@ all: generate unit
7272
# Code Generation #
7373
###################
7474
.PHONY: generate smithy-generate smithy-build smithy-build-% smithy-clean smithy-go-publish-local format \
75-
gen-config-asserts gen-repo-mod-replace gen-mod-replace-smithy gen-mod-dropreplace-smithy gen-aws-ptrs tidy-modules-% \
75+
gen-config-asserts gen-repo-mod-replace gen-mod-replace-smithy gen-mod-dropreplace-smithy-% gen-aws-ptrs tidy-modules-% \
7676
add-module-license-files sync-models sync-endpoints-model sync-endpoints.json clone-v1-models gen-internal-codegen \
7777
sync-api-models copy-attributevalue-feature min-go-version-% update-requires smithy-annotate-stable \
7878
update-module-metadata download-modules-%
7979

8080
generate: smithy-generate update-requires gen-repo-mod-replace update-module-metadata smithy-annotate-stable \
81-
gen-config-asserts gen-internal-codegen copy-attributevalue-feature gen-mod-dropreplace-smithy min-go-version-. \
81+
gen-config-asserts gen-internal-codegen copy-attributevalue-feature gen-mod-dropreplace-smithy-. min-go-version-. \
8282
tidy-modules-. add-module-license-files gen-aws-ptrs format
8383

8484
smithy-generate:
8585
cd codegen && ./gradlew clean build -Plog-tests && ./gradlew clean
8686

87-
smithy-build: gen-repo-mod-replace
87+
smithy-build:
8888
cd codegen && ./gradlew clean build -Plog-tests
8989

90-
smithy-build-%: gen-repo-mod-replace
90+
smithy-build-%:
9191
@# smithy-build- command that uses the pattern to define build filter that
9292
@# the smithy API model service id starts with. Strips off the
9393
@# "smithy-build-".
@@ -126,13 +126,25 @@ gen-repo-mod-replace:
126126
@echo "Generating go.mod replace for repo modules"
127127
go run ${REPOTOOLS_CMD_MAKE_RELATIVE}
128128

129-
gen-mod-replace-smithy:
129+
gen-mod-replace-smithy-%:
130+
@# gen-mod-replace-smithy- command that uses the pattern to define build filter that
131+
@# for modules to add replace to. Strips off the "gen-mod-replace-smithy-".
132+
@#
133+
@# SMITHY_GO_SRC environment variable is the path to add replace to
134+
@#
135+
@# e.g. gen-mod-replace-smithy-service_ssooidc
130136
cd ./internal/repotools/cmd/eachmodule \
131-
&& go run . "go mod edit -replace github.com/aws/smithy-go=${SMITHY_GO_SRC}"
137+
&& go run . -p $(subst _,/,$(subst gen-mod-replace-smithy-,,$@)) ${EACHMODULE_FLAGS} \
138+
"go mod edit -replace github.com/aws/smithy-go=${SMITHY_GO_SRC}"
132139

133-
gen-mod-dropreplace-smithy:
140+
gen-mod-dropreplace-smithy-%:
141+
@# gen-mod-dropreplace-smithy- command that uses the pattern to define build filter that
142+
@# for modules to add replace to. Strips off the "gen-mod-dropreplace-smithy-".
143+
@#
144+
@# e.g. gen-mod-dropreplace-smithy-service_ssooidc
134145
cd ./internal/repotools/cmd/eachmodule \
135-
&& go run . "go mod edit -dropreplace github.com/aws/smithy-go"
146+
&& go run . -p $(subst _,/,$(subst gen-mod-dropreplace-smithy-,,$@)) ${EACHMODULE_FLAGS} \
147+
"go mod edit -dropreplace github.com/aws/smithy-go"
136148

137149
gen-aws-ptrs:
138150
cd aws && go generate

‎aws/config.go

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,13 +3,14 @@ package aws
33
import (
44
"net/http"
55

6+
smithybearer "github.com/aws/smithy-go/auth/bearer"
67
"github.com/aws/smithy-go/logging"
78
"github.com/aws/smithy-go/middleware"
89
)
910

1011
// HTTPClient provides the interface to provide custom HTTPClients. Generally
1112
// *http.Client is sufficient for most use cases. The HTTPClient should not
12-
// follow redirects.
13+
// follow 301 or 302 redirects.
1314
type HTTPClient interface {
1415
Do(*http.Request) (*http.Response, error)
1516
}
@@ -30,6 +31,18 @@ type Config struct {
3031
// variables, shared credential file, and EC2 Instance Roles.
3132
Credentials CredentialsProvider
3233

34+
// The Bearer Authentication token provider to use for authenticating API
35+
// operation calls with a Bearer Authentication token. The API clients and
36+
// operation must support Bearer Authentication scheme in order for the
37+
// token provider to be used. API clients created with NewFromConfig will
38+
// automatically be configured with this option, if the API client support
39+
// Bearer Authentication.
40+
//
41+
// The SDK's config.LoadDefaultConfig can automatically populate this
42+
// option for external configuration options such as SSO session.
43+
// https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-sso.html
44+
BearerAuthTokenProvider smithybearer.TokenProvider
45+
3346
// The HTTP Client the SDK's API clients will use to invoke HTTP requests.
3447
// The SDK defaults to a BuildableClient allowing API clients to create
3548
// copies of the HTTP Client for service specific customizations.

‎aws/protocol/eventstream/go.mod

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,6 @@ module github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream
22

33
go 1.15
44

5-
require github.com/aws/smithy-go v1.12.1
5+
require github.com/aws/smithy-go v1.12.2-0.20220825202034-eec4392b3806
66

77
replace github.com/aws/aws-sdk-go-v2 => ../../../

‎aws/protocol/eventstream/go.sum

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
1-
github.com/aws/smithy-go v1.12.1 h1:yQRC55aXN/y1W10HgwHle01DRuV9Dpf31iGkotjt3Ag=
2-
github.com/aws/smithy-go v1.12.1/go.mod h1:Tg+OJXh4MB2R/uN61Ko2f6hTZwB/ZYGOtib8J3gBHzA=
1+
github.com/aws/smithy-go v1.12.2-0.20220825202034-eec4392b3806 h1:txHpJGVo/VYIWocLOG23AI791W9xLhh4z9NrG51Xd8k=
2+
github.com/aws/smithy-go v1.12.2-0.20220825202034-eec4392b3806/go.mod h1:Tg+OJXh4MB2R/uN61Ko2f6hTZwB/ZYGOtib8J3gBHzA=
33
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
44
github.com/google/go-cmp v0.5.8 h1:e6P7q2lk1O+qJJb4BtCQXlK8vWEO8V1ZeuEdJNOqZyg=
55
github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=

‎aws/signer/v4/middleware.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,7 @@ func (m *dynamicPayloadSigningMiddleware) HandleBuild(
8282
}
8383

8484
// if TLS is enabled, use unsigned payload when supported
85-
if strings.EqualFold(req.URL.Scheme, "https") {
85+
if req.IsHTTPS() {
8686
return (&unsignedPayload{}).HandleBuild(ctx, in, next)
8787
}
8888

‎codegen/smithy-aws-go-codegen/src/main/java/software/amazon/smithy/aws/go/codegen/AddAwsConfigFields.java

Lines changed: 21 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -23,10 +23,8 @@
2323
import java.util.Set;
2424
import java.util.function.BiPredicate;
2525
import java.util.logging.Logger;
26-
2726
import software.amazon.smithy.codegen.core.Symbol;
2827
import software.amazon.smithy.codegen.core.SymbolProvider;
29-
import software.amazon.smithy.aws.go.codegen.ClientResolvedDefaultsMode;
3028
import software.amazon.smithy.go.codegen.GoDelegator;
3129
import software.amazon.smithy.go.codegen.GoSettings;
3230
import software.amazon.smithy.go.codegen.GoWriter;
@@ -36,6 +34,7 @@
3634
import software.amazon.smithy.go.codegen.integration.ConfigFieldResolver;
3735
import software.amazon.smithy.go.codegen.integration.GoIntegration;
3836
import software.amazon.smithy.go.codegen.integration.RuntimeClientPlugin;
37+
import software.amazon.smithy.go.codegen.integration.auth.HttpBearerAuth;
3938
import software.amazon.smithy.model.Model;
4039
import software.amazon.smithy.model.shapes.ServiceShape;
4140
import software.amazon.smithy.utils.ListUtils;
@@ -48,6 +47,7 @@ public class AddAwsConfigFields implements GoIntegration {
4847

4948
public static final String REGION_CONFIG_NAME = "Region";
5049
public static final String CREDENTIALS_CONFIG_NAME = "Credentials";
50+
public static final String BEARER_AUTH_TOKEN_CONFIG_NAME = "TokenProvider";
5151
public static final String ENDPOINT_RESOLVER_CONFIG_NAME = "EndpointResolver";
5252
public static final String AWS_ENDPOINT_RESOLVER_WITH_OPTIONS = "EndpointResolverWithOptions";
5353
public static final String HTTP_CLIENT_CONFIG_NAME = "HTTPClient";
@@ -120,20 +120,20 @@ public class AddAwsConfigFields implements GoIntegration {
120120
When creating a new API Clients this member will only be used if the
121121
Retryer Options member is nil. This value will be ignored if
122122
Retryer is not nil.
123-
123+
124124
If specified in an operation call's functional options with a value that
125125
is different than the constructed client's Options, the Client's Retryer
126126
will be wrapped to use the operation's specific RetryMaxAttempts value.
127127
""")
128128
.awsResolveFunction(SymbolUtils.createValueSymbolBuilder(RESOLVE_AWS_CONFIG_RETRY_MAX_ATTEMPTS)
129129
.build())
130-
.addConfigFieldResolvers(ConfigFieldResolver.builder()
131-
.location(ConfigFieldResolver.Location.OPERATION)
132-
.target(ConfigFieldResolver.Target.FINALIZATION)
133-
.withClientInput(true)
134-
.resolver(SymbolUtils.createValueSymbolBuilder(
135-
FINALIZE_RETRY_MAX_ATTEMPTS_OPTIONS).build())
136-
.build())
130+
.addConfigFieldResolvers(ConfigFieldResolver.builder()
131+
.location(ConfigFieldResolver.Location.OPERATION)
132+
.target(ConfigFieldResolver.Target.FINALIZATION)
133+
.withClientInput(true)
134+
.resolver(SymbolUtils.createValueSymbolBuilder(
135+
FINALIZE_RETRY_MAX_ATTEMPTS_OPTIONS).build())
136+
.build())
137137
.build(),
138138

139139
AwsConfigField.builder()
@@ -146,7 +146,7 @@ public class AddAwsConfigFields implements GoIntegration {
146146
When creating a new API Clients this member will only be used if the
147147
Retryer Options member is nil. This value will be ignored if
148148
Retryer is not nil.
149-
149+
150150
Currently does not support per operation call overrides, may in the future.
151151
""")
152152
.awsResolveFunction(SymbolUtils.createValueSymbolBuilder(RESOLVE_AWS_CONFIG_RETRY_MODE)
@@ -166,6 +166,16 @@ public class AddAwsConfigFields implements GoIntegration {
166166
.documentation("The credentials object to use when signing requests.")
167167
.servicePredicate(AwsSignatureVersion4::isSupportedAuthentication)
168168
.build(),
169+
AwsConfigField.builder()
170+
// TOKEN_PROVIDER_OPTION_NAME added API Client's Options by HttpBearerAuth. Only
171+
// need to add NewFromConfig resolver from aws#Config type.
172+
.name(HttpBearerAuth.TOKEN_PROVIDER_OPTION_NAME)
173+
.type(SymbolUtils.createValueSymbolBuilder("TokenProvider",
174+
SmithyGoDependency.SMITHY_AUTH_BEARER).build())
175+
.documentation("The bearer authentication token provider for authentication requests.")
176+
.servicePredicate(HttpBearerAuth::isSupportedAuthentication)
177+
.generatedOnClient(false)
178+
.build(),
169179
AwsConfigField.builder()
170180
.name(API_OPTIONS_CONFIG_NAME)
171181
.type(SymbolUtils.createValueSymbolBuilder("[]func(*middleware.Stack) error")

‎config/codegen/main.go

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,9 @@ var implAsserts = map[string][]string{
2727
"credentialsProviderProvider": {loadOptionsType},
2828
"defaultRegionProvider": {loadOptionsType},
2929
"credentialsCacheOptionsProvider": {loadOptionsType},
30+
"bearerAuthTokenProviderProvider": {loadOptionsType},
31+
"bearerAuthTokenCacheOptionsProvider": {loadOptionsType},
32+
"ssoTokenProviderOptionsProvider": {loadOptionsType},
3033
"processCredentialOptions": {loadOptionsType},
3134
"ec2RoleCredentialOptionsProvider": {loadOptionsType},
3235
"endpointCredentialOptionsProvider": {loadOptionsType},

‎config/config.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,10 @@ var defaultAWSConfigResolvers = []awsConfigResolver{
7272
// implementations depend on or can be configured with earlier resolved
7373
// configuration options.
7474
resolveCredentials,
75+
76+
// Sets the resolved bearer authentication token API clients will use for
77+
// httpBearerAuth authentication scheme.
78+
resolveBearerAuthToken,
7579
}
7680

7781
// A Config represents a generic configuration value or set of values. This type

‎config/go.mod

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,9 @@ require (
88
github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.12.12
99
github.com/aws/aws-sdk-go-v2/internal/ini v1.3.19
1010
github.com/aws/aws-sdk-go-v2/service/sso v1.11.17
11+
github.com/aws/aws-sdk-go-v2/service/ssooidc v1.13.0
1112
github.com/aws/aws-sdk-go-v2/service/sts v1.16.13
12-
github.com/aws/smithy-go v1.12.1
13+
github.com/aws/smithy-go v1.12.2-0.20220825202034-eec4392b3806
1314
github.com/google/go-cmp v0.5.8
1415
)
1516

@@ -29,4 +30,6 @@ replace github.com/aws/aws-sdk-go-v2/service/internal/presigned-url => ../servic
2930

3031
replace github.com/aws/aws-sdk-go-v2/service/sso => ../service/sso/
3132

33+
replace github.com/aws/aws-sdk-go-v2/service/ssooidc => ../service/ssooidc/
34+
3235
replace github.com/aws/aws-sdk-go-v2/service/sts => ../service/sts/

‎config/go.sum

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
1-
github.com/aws/smithy-go v1.12.1 h1:yQRC55aXN/y1W10HgwHle01DRuV9Dpf31iGkotjt3Ag=
2-
github.com/aws/smithy-go v1.12.1/go.mod h1:Tg+OJXh4MB2R/uN61Ko2f6hTZwB/ZYGOtib8J3gBHzA=
1+
github.com/aws/smithy-go v1.12.2-0.20220825202034-eec4392b3806 h1:txHpJGVo/VYIWocLOG23AI791W9xLhh4z9NrG51Xd8k=
2+
github.com/aws/smithy-go v1.12.2-0.20220825202034-eec4392b3806/go.mod h1:Tg+OJXh4MB2R/uN61Ko2f6hTZwB/ZYGOtib8J3gBHzA=
33
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
44
github.com/google/go-cmp v0.5.8 h1:e6P7q2lk1O+qJJb4BtCQXlK8vWEO8V1ZeuEdJNOqZyg=
55
github.com/google/go-cmp v0.5.8/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=

‎config/load_options.go

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ import (
1111
"github.com/aws/aws-sdk-go-v2/credentials/ssocreds"
1212
"github.com/aws/aws-sdk-go-v2/credentials/stscreds"
1313
"github.com/aws/aws-sdk-go-v2/feature/ec2/imds"
14+
smithybearer "github.com/aws/smithy-go/auth/bearer"
1415
"github.com/aws/smithy-go/logging"
1516
"github.com/aws/smithy-go/middleware"
1617
)
@@ -28,6 +29,9 @@ type LoadOptions struct {
2829
// Credentials object to use when signing requests.
2930
Credentials aws.CredentialsProvider
3031

32+
// Token provider for authentication operations with bearer authentication.
33+
BearerAuthTokenProvider smithybearer.TokenProvider
34+
3135
// HTTPClient the SDK's API clients will use to invoke HTTP requests.
3236
HTTPClient HTTPClient
3337

@@ -128,6 +132,14 @@ type LoadOptions struct {
128132
// aws.CredentialsCacheOptions
129133
CredentialsCacheOptions func(*aws.CredentialsCacheOptions)
130134

135+
// BearerAuthTokenCacheOptions is a function for setting the smithy-go
136+
// auth/bearer#TokenCacheOptions
137+
BearerAuthTokenCacheOptions func(*smithybearer.TokenCacheOptions)
138+
139+
// SSOTokenProviderOptions is a function for setting the
140+
// credentials/ssocreds.SSOTokenProviderOptions
141+
SSOTokenProviderOptions func(*ssocreds.SSOTokenProviderOptions)
142+
131143
// ProcessCredentialOptions is a function for setting
132144
// the processcreds.Options
133145
ProcessCredentialOptions func(*processcreds.Options)
@@ -451,6 +463,73 @@ func WithCredentialsCacheOptions(v func(*aws.CredentialsCacheOptions)) LoadOptio
451463
}
452464
}
453465

466+
// getBearerAuthTokenProvider returns the credentials value
467+
func (o LoadOptions) getBearerAuthTokenProvider(ctx context.Context) (smithybearer.TokenProvider, bool, error) {
468+
if o.BearerAuthTokenProvider == nil {
469+
return nil, false, nil
470+
}
471+
472+
return o.BearerAuthTokenProvider, true, nil
473+
}
474+
475+
// WithBearerAuthTokenProvider is a helper function to construct functional options
476+
// that sets Credential provider value on config's LoadOptions. If credentials
477+
// provider is set to nil, the credentials provider value will be ignored.
478+
// If multiple WithBearerAuthTokenProvider calls are made, the last call overrides
479+
// the previous call values.
480+
func WithBearerAuthTokenProvider(v smithybearer.TokenProvider) LoadOptionsFunc {
481+
return func(o *LoadOptions) error {
482+
o.BearerAuthTokenProvider = v
483+
return nil
484+
}
485+
}
486+
487+
// getBearerAuthTokenCacheOptionsProvider returns the wrapped function to set smithybearer.TokenCacheOptions
488+
func (o LoadOptions) getBearerAuthTokenCacheOptions(ctx context.Context) (func(*smithybearer.TokenCacheOptions), bool, error) {
489+
if o.BearerAuthTokenCacheOptions == nil {
490+
return nil, false, nil
491+
}
492+
493+
return o.BearerAuthTokenCacheOptions, true, nil
494+
}
495+
496+
// WithBearerAuthTokenCacheOptions is a helper function to construct functional options
497+
// that sets a function to modify the TokenCacheOptions the smithy-go
498+
// auth/bearer#TokenCache will be configured with, if the TokenCache is used by
499+
// the configuration loader.
500+
//
501+
// If multiple WithBearerAuthTokenCacheOptions calls are made, the last call overrides
502+
// the previous call values.
503+
func WithBearerAuthTokenCacheOptions(v func(*smithybearer.TokenCacheOptions)) LoadOptionsFunc {
504+
return func(o *LoadOptions) error {
505+
o.BearerAuthTokenCacheOptions = v
506+
return nil
507+
}
508+
}
509+
510+
// getSSOTokenProviderOptionsProvider returns the wrapped function to set smithybearer.TokenCacheOptions
511+
func (o LoadOptions) getSSOTokenProviderOptions(ctx context.Context) (func(*ssocreds.SSOTokenProviderOptions), bool, error) {
512+
if o.SSOTokenProviderOptions == nil {
513+
return nil, false, nil
514+
}
515+
516+
return o.SSOTokenProviderOptions, true, nil
517+
}
518+
519+
// WithSSOTokenProviderOptions is a helper function to construct functional
520+
// options that sets a function to modify the SSOtokenProviderOptions the SDK's
521+
// credentials/ssocreds#SSOProvider will be configured with, if the
522+
// SSOTokenProvider is used by the configuration loader.
523+
//
524+
// If multiple WithSSOTokenProviderOptions calls are made, the last call overrides
525+
// the previous call values.
526+
func WithSSOTokenProviderOptions(v func(*ssocreds.SSOTokenProviderOptions)) LoadOptionsFunc {
527+
return func(o *LoadOptions) error {
528+
o.SSOTokenProviderOptions = v
529+
return nil
530+
}
531+
}
532+
454533
// getProcessCredentialOptions returns the wrapped function to set processcreds.Options
455534
func (o LoadOptions) getProcessCredentialOptions(ctx context.Context) (func(*processcreds.Options), bool, error) {
456535
if o.ProcessCredentialOptions == nil {

0 commit comments

Comments
 (0)