Skip to content

Commit e9ec9c4

Browse files
teo-tsirpanisteo-tsirpanis
authored
Support passing ClientConfiguration to SSOCredentialsProvider. (#2860)
Support passing ClientConfiguration to SSOCredentialsProvider
1 parent b6a11e4 commit e9ec9c4

File tree

6 files changed

+56
-36
lines changed

6 files changed

+56
-36
lines changed

‎src/aws-cpp-sdk-core/include/aws/core/auth/SSOCredentialsProvider.h

+3
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ namespace Aws {
2121
public:
2222
SSOCredentialsProvider();
2323
explicit SSOCredentialsProvider(const Aws::String& profile);
24+
explicit SSOCredentialsProvider(const Aws::String& profile, std::shared_ptr<const Aws::Client::ClientConfiguration> config);
2425
/**
2526
* Retrieves the credentials if found, otherwise returns empty credential set.
2627
*/
@@ -42,6 +43,8 @@ namespace Aws {
4243
Aws::Utils::DateTime m_expiresAt;
4344
// The SSO Token Provider
4445
Aws::Auth::SSOBearerTokenProvider m_bearerTokenProvider;
46+
// The client configuration to use
47+
std::shared_ptr<const Aws::Client::ClientConfiguration> m_config;
4548

4649
void Reload() override;
4750
void RefreshIfExpired();

‎src/aws-cpp-sdk-core/include/aws/core/auth/bearer-token-provider/SSOBearerTokenProvider.h

+2
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ namespace Aws
2424
public:
2525
SSOBearerTokenProvider();
2626
explicit SSOBearerTokenProvider(const Aws::String& awsProfile);
27+
explicit SSOBearerTokenProvider(const Aws::String& awsProfile, std::shared_ptr<const Aws::Client::ClientConfiguration> config);
2728
/**
2829
* Retrieves the bearerToken if found, otherwise returns empty credential set.
2930
*/
@@ -48,6 +49,7 @@ namespace Aws
4849
// Profile description variables
4950
Aws::UniquePtr<Aws::Internal::SSOCredentialsClient> m_client;
5051
Aws::String m_profileToUse;
52+
std::shared_ptr<const Aws::Client::ClientConfiguration> m_config;
5153

5254
mutable Aws::Auth::AWSBearerToken m_token;
5355
mutable Aws::Utils::DateTime m_lastUpdateAttempt;

‎src/aws-cpp-sdk-core/include/aws/core/internal/AWSHttpResourceClient.h

+3-1
Original file line numberDiff line numberDiff line change
@@ -250,6 +250,7 @@ namespace Aws
250250
{
251251
public:
252252
SSOCredentialsClient(const Client::ClientConfiguration& clientConfiguration);
253+
SSOCredentialsClient(const Client::ClientConfiguration& clientConfiguration, Aws::Http::Scheme scheme, const Aws::String& region);
253254

254255
SSOCredentialsClient& operator =(SSOCredentialsClient& rhs) = delete;
255256
SSOCredentialsClient(const SSOCredentialsClient& rhs) = delete;
@@ -290,7 +291,8 @@ namespace Aws
290291

291292
SSOCreateTokenResult CreateToken(const SSOCreateTokenRequest& request);
292293
private:
293-
Aws::String buildEndpoint(const Aws::Client::ClientConfiguration& clientConfiguration,
294+
Aws::String buildEndpoint(Aws::Http::Scheme scheme,
295+
const Aws::String& region,
294296
const Aws::String& domain,
295297
const Aws::String& endpoint);
296298
Aws::String m_endpoint;

‎src/aws-cpp-sdk-core/source/auth/SSOCredentialsProvider.cpp

+20-15
Original file line numberDiff line numberDiff line change
@@ -28,15 +28,29 @@ using Aws::Utils::Threading::ReaderLockGuard;
2828

2929
static const char SSO_CREDENTIALS_PROVIDER_LOG_TAG[] = "SSOCredentialsProvider";
3030

31-
SSOCredentialsProvider::SSOCredentialsProvider() : m_profileToUse(GetConfigProfileName())
31+
SSOCredentialsProvider::SSOCredentialsProvider() : SSOCredentialsProvider(GetConfigProfileName(), nullptr)
3232
{
33-
AWS_LOGSTREAM_INFO(SSO_CREDENTIALS_PROVIDER_LOG_TAG, "Setting sso credentials provider to read config from " << m_profileToUse);
3433
}
3534

36-
SSOCredentialsProvider::SSOCredentialsProvider(const Aws::String& profile) : m_profileToUse(profile),
37-
m_bearerTokenProvider(profile)
35+
SSOCredentialsProvider::SSOCredentialsProvider(const Aws::String& profile) : SSOCredentialsProvider(profile, nullptr)
3836
{
39-
AWS_LOGSTREAM_INFO(SSO_CREDENTIALS_PROVIDER_LOG_TAG, "Setting sso credentials provider to read config from " << m_profileToUse);
37+
}
38+
39+
SSOCredentialsProvider::SSOCredentialsProvider(const Aws::String& profile, std::shared_ptr<const Aws::Client::ClientConfiguration> config) :
40+
m_profileToUse(profile),
41+
m_bearerTokenProvider(profile),
42+
m_config(std::move(config))
43+
{
44+
AWS_LOGSTREAM_INFO(SSO_CREDENTIALS_PROVIDER_LOG_TAG, "Setting sso credentials provider to read config from " << m_profileToUse);
45+
if (!m_config)
46+
{
47+
auto defaultConfig = Aws::MakeShared<Client::ClientConfiguration>(SSO_CREDENTIALS_PROVIDER_LOG_TAG);
48+
defaultConfig->scheme = Aws::Http::Scheme::HTTPS;
49+
// We cannot set region to m_ssoRegion because it is not yet known at this point. But it's not obtained from the client config either way.
50+
Aws::Vector<Aws::String> retryableErrors{ "TooManyRequestsException" };
51+
defaultConfig->retryStrategy = Aws::MakeShared<SpecifiedRetryableErrorsRetryStrategy>(SSO_CREDENTIALS_PROVIDER_LOG_TAG, std::move(retryableErrors), 3/*maxRetries*/);
52+
m_config = std::move(defaultConfig);
53+
}
4054
}
4155

4256
AWSCredentials SSOCredentialsProvider::GetAWSCredentials()
@@ -80,16 +94,7 @@ void SSOCredentialsProvider::Reload()
8094
request.m_ssoRoleName = profile.GetSsoRoleName();
8195
request.m_accessToken = accessToken;
8296

83-
Aws::Client::ClientConfiguration config;
84-
config.scheme = Aws::Http::Scheme::HTTPS;
85-
config.region = m_ssoRegion;
86-
AWS_LOGSTREAM_DEBUG(SSO_CREDENTIALS_PROVIDER_LOG_TAG, "Passing config to client for region: " << m_ssoRegion);
87-
88-
Aws::Vector<Aws::String> retryableErrors;
89-
retryableErrors.push_back("TooManyRequestsException");
90-
91-
config.retryStrategy = Aws::MakeShared<SpecifiedRetryableErrorsRetryStrategy>(SSO_CREDENTIALS_PROVIDER_LOG_TAG, retryableErrors, 3/*maxRetries*/);
92-
m_client = Aws::MakeUnique<Aws::Internal::SSOCredentialsClient>(SSO_CREDENTIALS_PROVIDER_LOG_TAG, config);
97+
m_client = Aws::MakeUnique<Aws::Internal::SSOCredentialsClient>(SSO_CREDENTIALS_PROVIDER_LOG_TAG, *m_config, Aws::Http::Scheme::HTTPS, m_ssoRegion);
9398

9499
AWS_LOGSTREAM_TRACE(SSO_CREDENTIALS_PROVIDER_LOG_TAG, "Requesting credentials with AWS_ACCESS_KEY: " << m_ssoAccountId);
95100
auto result = m_client->GetSSOCredentials(request);

‎src/aws-cpp-sdk-core/source/auth/bearer-token-provider/SSOBearerTokenProvider.cpp

+15-13
Original file line numberDiff line numberDiff line change
@@ -27,18 +27,20 @@ static const char SSO_GRANT_TYPE[] = "refresh_token";
2727
const size_t SSOBearerTokenProvider::REFRESH_WINDOW_BEFORE_EXPIRATION_S = 600;
2828
const size_t SSOBearerTokenProvider::REFRESH_ATTEMPT_INTERVAL_S = 30;
2929

30-
SSOBearerTokenProvider::SSOBearerTokenProvider()
31-
: m_profileToUse(Aws::Auth::GetConfigProfileName()),
32-
m_lastUpdateAttempt((int64_t) 0)
30+
SSOBearerTokenProvider::SSOBearerTokenProvider() : SSOBearerTokenProvider(Aws::Auth::GetConfigProfileName(), nullptr)
3331
{
34-
AWS_LOGSTREAM_INFO(SSO_BEARER_TOKEN_PROVIDER_LOG_TAG, "Setting sso bearerToken provider to read config from " << m_profileToUse);
3532
}
3633

37-
SSOBearerTokenProvider::SSOBearerTokenProvider(const Aws::String& awsProfile)
38-
: m_profileToUse(awsProfile),
39-
m_lastUpdateAttempt((int64_t) 0)
34+
SSOBearerTokenProvider::SSOBearerTokenProvider(const Aws::String& awsProfile) : SSOBearerTokenProvider(awsProfile, nullptr)
4035
{
41-
AWS_LOGSTREAM_INFO(SSO_BEARER_TOKEN_PROVIDER_LOG_TAG, "Setting sso bearerToken provider to read config from " << m_profileToUse);
36+
}
37+
38+
SSOBearerTokenProvider::SSOBearerTokenProvider(const Aws::String& awsProfile, std::shared_ptr<const Aws::Client::ClientConfiguration> config)
39+
: m_profileToUse(awsProfile),
40+
m_config(config ? std::move(config) : Aws::MakeShared<Client::ClientConfiguration>(SSO_BEARER_TOKEN_PROVIDER_LOG_TAG)),
41+
m_lastUpdateAttempt((int64_t)0)
42+
{
43+
AWS_LOGSTREAM_INFO(SSO_BEARER_TOKEN_PROVIDER_LOG_TAG, "Setting sso bearerToken provider to read config from " << m_profileToUse);
4244
}
4345

4446
AWSBearerToken SSOBearerTokenProvider::GetAWSBearerToken()
@@ -93,14 +95,14 @@ void SSOBearerTokenProvider::RefreshFromSso()
9395

9496
if(!m_client)
9597
{
96-
Aws::Client::ClientConfiguration config;
97-
config.scheme = Aws::Http::Scheme::HTTPS;
98+
auto scheme = Aws::Http::Scheme::HTTPS;
9899
/* The SSO token provider must not resolve if any SSO configuration values are present directly on the profile
99100
* instead of an `sso-session` section. The SSO token provider must ignore these configuration values if these
100101
* values are present directly on the profile instead of an `sso-session` section. */
101-
// config.region = m_profile.GetSsoRegion(); // <- intentionally not used per comment above
102-
config.region = cachedSsoToken.region;
103-
m_client = Aws::MakeUnique<Aws::Internal::SSOCredentialsClient>(SSO_BEARER_TOKEN_PROVIDER_LOG_TAG, config);
102+
// auto& region = m_profile.GetSsoRegion(); // <- intentionally not used per comment above
103+
auto& region = cachedSsoToken.region;
104+
// m_config->region might not be the same as the SSO region, but the former is not used by the SSO client.
105+
m_client = Aws::MakeUnique<Aws::Internal::SSOCredentialsClient>(SSO_BEARER_TOKEN_PROVIDER_LOG_TAG, *m_config, scheme, region);
104106
}
105107

106108
Aws::Internal::SSOCredentialsClient::SSOCreateTokenRequest ssoCreateTokenRequest;

‎src/aws-cpp-sdk-core/source/internal/AWSHttpResourceClient.cpp

+13-7
Original file line numberDiff line numberDiff line change
@@ -595,23 +595,29 @@ namespace Aws
595595

596596
static const char SSO_RESOURCE_CLIENT_LOG_TAG[] = "SSOResourceClient";
597597
SSOCredentialsClient::SSOCredentialsClient(const Aws::Client::ClientConfiguration& clientConfiguration)
598+
: SSOCredentialsClient(clientConfiguration, clientConfiguration.scheme, clientConfiguration.region)
599+
{
600+
}
601+
602+
SSOCredentialsClient::SSOCredentialsClient(const Aws::Client::ClientConfiguration& clientConfiguration, Aws::Http::Scheme scheme, const Aws::String& region)
598603
: AWSHttpResourceClient(clientConfiguration, SSO_RESOURCE_CLIENT_LOG_TAG)
599604
{
600605
SetErrorMarshaller(Aws::MakeUnique<Aws::Client::JsonErrorMarshaller>(SSO_RESOURCE_CLIENT_LOG_TAG));
601606

602-
m_endpoint = buildEndpoint(clientConfiguration, "portal.sso.", "federation/credentials");
603-
m_oidcEndpoint = buildEndpoint(clientConfiguration, "oidc.", "token");
607+
m_endpoint = buildEndpoint(scheme, region, "portal.sso.", "federation/credentials");
608+
m_oidcEndpoint = buildEndpoint(scheme, region, "oidc.", "token");
604609

605610
AWS_LOGSTREAM_INFO(SSO_RESOURCE_CLIENT_LOG_TAG, "Creating SSO ResourceClient with endpoint: " << m_endpoint);
606611
}
607612

608613
Aws::String SSOCredentialsClient::buildEndpoint(
609-
const Aws::Client::ClientConfiguration& clientConfiguration,
614+
Aws::Http::Scheme scheme,
615+
const Aws::String& region,
610616
const Aws::String& domain,
611617
const Aws::String& endpoint)
612618
{
613619
Aws::StringStream ss;
614-
if (clientConfiguration.scheme == Aws::Http::Scheme::HTTP)
620+
if (scheme == Aws::Http::Scheme::HTTP)
615621
{
616622
ss << "http://";
617623
}
@@ -622,10 +628,10 @@ namespace Aws
622628

623629
static const int CN_NORTH_1_HASH = Aws::Utils::HashingUtils::HashString(Aws::Region::CN_NORTH_1);
624630
static const int CN_NORTHWEST_1_HASH = Aws::Utils::HashingUtils::HashString(Aws::Region::CN_NORTHWEST_1);
625-
auto hash = Aws::Utils::HashingUtils::HashString(clientConfiguration.region.c_str());
631+
auto hash = Aws::Utils::HashingUtils::HashString(region.c_str());
626632

627-
AWS_LOGSTREAM_DEBUG(SSO_RESOURCE_CLIENT_LOG_TAG, "Preparing SSO client for region: " << clientConfiguration.region);
628-
ss << domain << clientConfiguration.region << ".amazonaws.com/" << endpoint;
633+
AWS_LOGSTREAM_DEBUG(SSO_RESOURCE_CLIENT_LOG_TAG, "Preparing SSO client for region: " << region);
634+
ss << domain << region << ".amazonaws.com/" << endpoint;
629635
if (hash == CN_NORTH_1_HASH || hash == CN_NORTHWEST_1_HASH)
630636
{
631637
ss << ".cn";

0 commit comments

Comments
 (0)