Skip to content

v1.1.38

Choose a tag to compare

View all tags
@github-actions github-actions released this 10 Jul 17:27
· 1 commit to master since this release
v1.1.38
ba98c32

kiro-rs v1.1.38

本版聚焦企业与外部身份提供方（IdP）账号接入：新增 Kiro SSO 浏览器登录、AWS IAM Identity Center 直连登录、外部 IdP（Azure AD）登录与刷新全链路，修复企业租户账号全线 403 的 profileArn 问题；同时新增凭据批量导出，并修复 Azure AD 凭据导入被误判重复的 bug。

This release focuses on enterprise & external Identity Provider (IdP) account onboarding: adds Kiro SSO browser login, direct AWS IAM Identity Center login, and the full external-IdP (Azure AD) login + refresh pipeline; fixes the profileArn issue that caused enterprise-tenant accounts to get blanket 403s; adds bulk credential export; and fixes Azure AD credentials being wrongly rejected as duplicates on import.

中文更新日志

新增 — 外部 IdP（Azure AD / 企业 Azure 租户）登录

  • 托管门户浏览器登录流程：经 app.kiro.dev/signin 门户以 PKCE 授权码流程联合登录；门户识别到外部 IdP 邮箱后重定向携带 IdP 描述符（issuer/client_id/scopes），本地再驱动第二段 OIDC 授权码 + PKCE 流程，在 IdP token 端点换取面向 CodeWhisperer 的 access token。这是企业 Azure 租户账号登录 Kiro 的唯一方式。
  • OIDC 端点发现：请求 /.well-known/openid-configuration 解析授权/令牌端点，发现请求禁止跟随重定向并做白名单校验。
  • SSRF / 开放重定向防护：IdP issuer 与端点必须为 https、非 IP，命中已知企业 IdP 域后缀（.microsoftonline.com/.us/.cn、.awsapps.com），前导点锚定子域边界。

新增 — 企业 IdC（AWS IAM Identity Center）登录

  • IdC 直连登录（不经门户）：RegisterClient 动态注册 public client → 浏览器授权 → /token 以授权码 + PKCE 换取。
  • 回环重定向固定 http://127.0.0.1:3128：AWS SSO OIDC 强制 public client 使用 loopback IP，三处 redirect_uri 完全一致。
  • 手动回调兜底：远程服务器无 SSH 隧道时，可把浏览器地址栏完整回调 URL 粘回，服务端解析 code+state 后完成换取。

新增 — SSO 登录会话管理与前端对话框

  • Start / Poll / Cancel 会话式登录 API（/auth/kiro-sso/*、/auth/kiro-idc/*）。
  • 前端登录对话框：社交/企业 Azure 与 IAM Identity Center 双模式、自动开浏览器 + 轮询、手动粘贴回调兜底、云部署 SSH 隧道命令提示。
  • 登录后自动验活：无可用 profile 或被拒则回滚删除，避免留下永久 403 死凭证。

新增 — 凭据批量导出

  • 新增 POST /api/admin/credentials/export，导出为可无损再导入的 KAM 嵌套 JSON（{"ids":[...]}，空则导出全部）。
  • Admin UI 工具栏新增「导出全部」「导出所选」，文件按 kiro-accounts-YYYY-MM-DD.json 命名。

修复 — Token 刷新增强

  • 新增外部 IdP token 刷新（走 IdP token 端点、public client、透传 scopes、端点白名单校验、兼容不返回新 refresh token）。
  • 刷新路由新增 external_idp 分支；新增标准 OAuth2 响应结构体。
  • 修复设备指纹漂移：缺失 machineId 时改为随机生成固定 UUID 并持久化（不再用每次刷新都变的 refreshToken 派生）。

修复 — profileArn 解析（企业/外部 IdP 账号 403）

  • 修复对所有 SSO OIDC 凭据无条件剥离 profileArn 导致企业账号全线 403。
  • 外部 IdP 请求必带 TokenType: EXTERNAL_IDP 头（否则 profile 列表为空）。
  • external_idp 账号 profileArn 惰性跨 region 解析（ListAvailableProfiles），可用 KIRO_PROFILE_REGIONS 覆盖，24h 冷却抑制反复探测。
  • IdC profileArn 三态判定（Resolved / NoProfile / Unavailable），不再套用会导致跨租户 403 的兜底 ARN。

修复 — 凭据导入

  • 修复 Azure AD 凭据被误判「凭证已存在」：去重从「前 32 字符前缀」改为完整 refreshToken 比对（同租户 Azure AD refreshToken 有很长公共前缀）。
  • 多文件导入容错：单文件失败不再丢弃全部，跨文件按 refreshToken 去重，完成后汇总成功/失败。
  • 兼容 external_idp harvest bundle 导入（token 块内直接带 clientId/tokenEndpoint/issuerUrl/scopes、无 clientRegistration）。

English Changelog

Added — External IdP (Azure AD / enterprise Azure tenant) login

  • Hosted-portal browser login: federated PKCE authorization-code flow via the app.kiro.dev/signin portal; when the portal detects an external-IdP email it redirects with an IdP descriptor (issuer / client_id / scopes), then a second local OIDC auth-code + PKCE flow exchanges an access token for CodeWhisperer at the IdP token endpoint. This is the only way to log in enterprise Azure-tenant accounts.
  • OIDC endpoint discovery: fetches /.well-known/openid-configuration for the authorization/token endpoints; discovery requests never follow redirects and are allowlist-validated.
  • SSRF / open-redirect protection: IdP issuer and endpoints must be https, non-IP, and match known enterprise-IdP domain suffixes (.microsoftonline.com/.us/.cn, .awsapps.com), with a leading dot anchoring the subdomain boundary.

Added — Enterprise IdC (AWS IAM Identity Center) login

  • Direct IdC login (no portal): RegisterClient dynamically registers a public client → browser authorize → /token exchange with authorization code + PKCE.
  • Loopback redirect fixed at http://127.0.0.1:3128: AWS SSO OIDC forces public clients to use a loopback IP; the redirect_uri is identical across register / authorize / token.
  • Manual callback fallback: on a remote server without an SSH tunnel, paste the full callback URL from the browser address bar; the server parses code+state and completes the exchange.

Added — SSO login session management & frontend dialog

  • Session-based Start / Poll / Cancel login APIs (/auth/kiro-sso/*, /auth/kiro-idc/*).
  • Frontend login dialog: dual mode (Social/Enterprise Azure and IAM Identity Center), auto-open browser + polling, manual callback-paste fallback, and an SSH-tunnel command hint for cloud deployments.
  • Post-login liveness check: rolls back and deletes the credential if no usable profile / rejected, so no permanently-403 dead credentials are left behind.

Added — Bulk credential export

  • New POST /api/admin/credentials/export returns losslessly re-importable KAM nested JSON ({"ids":[...]}, empty = export all).
  • Admin UI toolbar gains "Export all" / "Export selected"; downloads are named kiro-accounts-YYYY-MM-DD.json.

Fixed — Token refresh

  • Added external-IdP token refresh (via the IdP token endpoint, public client, passing through scopes, endpoint allowlist-validated, tolerant of IdPs that don't return a new refresh token).
  • Refresh routing gains an external_idp branch; added a standard OAuth2 response struct.
  • Fixed device-fingerprint drift: when machineId is missing it now generates and persists a stable random UUID (instead of deriving from the refreshToken, which changes on every refresh).

Fixed — profileArn resolution (enterprise/external-IdP 403s)

  • Fixed blanket 403s for enterprise accounts caused by unconditionally stripping profileArn from all SSO OIDC credentials.
  • External-IdP requests now always carry the TokenType: EXTERNAL_IDP header (otherwise the profile list comes back empty).
  • Lazy cross-region profileArn resolution for external_idp accounts (ListAvailableProfiles), overridable via KIRO_PROFILE_REGIONS, with a 24h cooldown to suppress repeated probing.
  • Three-state IdC profileArn resolution (Resolved / NoProfile / Unavailable); no longer applies a fallback ARN that caused cross-tenant 403s.

Fixed — Credential import

  • Fixed Azure AD credentials wrongly rejected as "already exists": dedup changed from a 32-char prefix match to a full refreshToken comparison (same-tenant Azure AD refreshTokens share a long common prefix).
  • Multi-file import tolerance: one bad file no longer discards all; cross-file dedup by refreshToken; success/failure summarized on completion.
  • Compatible with external_idp harvest-bundle import (clientId/tokenEndpoint/issuerUrl/scopes directly inside the token block, no clientRegistration).
Assets 6
Loading