SSO Cache filename should be based on sso_session in addition to sso_start_url

[schrobot]

Describe the bug

The SSO cache files in ~/.aws/sso/cache have filenames based only on the startUrl. Other SDKs, namely the Python SDK, and seemingly what the AWS CLI uses, actually use the sso_session if provided, and fallback to the sso_start_url otherwise. This leads to issues where if I login via the aws CLI, with a profile that has a sso_session_name configured, tools that use the go SDK, like https://github.com/awslabs/amazon-ecr-credential-helper, fail to correctly find my cached credentials and produce authentication errors.

See https://github.com/boto/botocore/blob/master/botocore/utils.py#L3354 and

aws-sdk-go/aws/credentials/ssocreds/provider.go

Line 121 in 1a86d22

tokenFile, err := loadTokenFile(p.CachedTokenFilepath)

Expected Behavior

The go SDK should generate the same filenames as the other SDKs and CLI.

Current Behavior

The go SDK computes the filename only based on the start URL, which makes it unable to find the right cached credential file produced by the CLI.

Reproduction Steps

1. Create an AWS profile in ~/.aws/config enabled for SSO, that has a session-name
2. Run aws sso login --profile <that profile>
3. Run retrieve

   aws-sdk-go/aws/credentials/ssocreds/provider.go

   Line 98 in 1a86d22

   func (p *Provider) Retrieve() (credentials.Value, error) {

Possible Solution

Replicate the logic in the botocore SDK

Additional Information/Context

No response

SDK version used

1.24.1

Environment details (Version of Go (go version)? OS name and version, etc.)

1.19

[RanVaknin]

Hi @schrobot ,

Can you please update your SDK version? we are in 1.5x, you are using 1.24.1 which is 5 years old.
Let me know if this helps.
Thanks,
Ran~

[schrobot]

Hi @schrobot ,

Can you please update your SDK version? we are in 1.5x, you are using 1.24.1 which is 5 years old. Let me know if this helps. Thanks, Ran~

Hi Ran, thanks for getting back. I don't own the code that is giving me this error -- I am trying to use https://github.com/awslabs/amazon-ecr-credential-helper and it seemed like the error described above is what's happening. I can file the issue against that repository if they just need to update the SDK version. That said, from reading the latest code in this repo, it seems like it would still be an issue?

Thanks,
Brian

[wty-Bryant]

Close the issue as the same issue has been solved for v2

[github-actions]

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.