SSO Credentials support #1701

awschristou · 2020-09-10T22:56:16Z

Description

This change adds support for AWS SSO related Credentials Profiles to resolve credentials.

I implemented this in a similar manner to MFA credentials support.
In this change, SSO Support was not implemented for .NET Framework 3.5, or netstandard 1.3.

Motivation and Context

This change opens the door for applications being built with the AWS SDK for .NET to work with SSO based credentials.

Testing

Tests have been added with the code

I also did the following locally to verify the changes:

added an AWS SSO based profile to my shared credentials file
make a throwaway test locally that loads this profile, and resolves its credentials (both sync and async)
verified that the SSO login flow is followed, and credentials are returned
verified that cached SSO tokens are also honored

Screenshots (if appropriate)

Types of changes

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to change)

Checklist

My code follows the code style of this project
My change requires a change to the documentation
I have updated the documentation accordingly
I have read the README document
I have added tests to cover my changes
All new and existing tests passed

License

I confirm that this pull request can be released under the Apache 2 license

sdk/src/Services/SSOOIDC/Custom/Internal/_bcl45+netstandard/CoreAmazonSSOOIDC.cs

normj · 2020-09-21T18:52:42Z

sdk/src/Core/Amazon.Runtime/Credentials/Internal/_bcl45+netstandard/SsoToken.cs

@@ -0,0 +1,46 @@
+/*
+ * Copyright 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved.


Don't put a year on the copyrights. Otherwise it just gets very out of date. This should be removed in any of the new files added.

normj · 2020-09-21T19:03:02Z

sdk/src/Core/Amazon.Runtime/Credentials/Internal/_bcl45+netstandard/SsoTokenCache.cs

+            catch (Exception e)
+#pragma warning restore CA1031 // Do not catch general exception types
+            {
+                _logger.Error(e, "Error saving SSO Token Cache");


Instead of saying "Error" can we say "Warning" and they say what the consequences are for not having the token saved. I assume this means the credentials will not be reused by other processes.

I've added the consequences but left the log level as error so that the exception is logged

sdk/src/Core/Amazon.Runtime/Credentials/Internal/_bcl45+netstandard/SsoTokenCache.cs

normj · 2020-09-21T19:18:47Z

sdk/src/Core/Amazon.Runtime/Credentials/Internal/_bcl45+netstandard/SsoTokenCache.cs

+        /// <returns>SHA1 hash for <paramref name="text"/></returns>
+        private static string GenerateSha1Hash(string text)
+        {
+            using (var sha1 = new SHA1Managed())


Can you move the direct usage of SHA1Managed into Amazon.Util.CryptoUtil? In the past we have had to abstract which implementation of the crypto algorithms to use. Currently now that we just support .NET Framework and Standard they use the same implementation but I would like to maintain the abstraction.

sdk/src/Core/Amazon.Runtime/Credentials/Internal/_bcl45+netstandard/SsoTokenUtils.cs

sdk/src/Core/Amazon.Runtime/Credentials/Internal/_bcl45+netstandard/SsoTokenCache.cs

sdk/src/Services/SSOOIDC/Custom/Internal/_bcl45+netstandard/CoreAmazonSSOOIDC.cs

normj · 2020-09-21T23:10:29Z

sdk/src/Services/SSOOIDC/Custom/Internal/_bcl45+netstandard/CoreAmazonSSOOIDC.cs

+                catch (Exception e)
+                {
+                    logger.Error(e, "Unexpected exception while polling for SSO Token.");
+                    Console.WriteLine($"Poll Exception: {e.Message}");


Don't write to the Console

Thanks, I forgot to remove those

normj · 2020-09-22T00:13:44Z

sdk/src/Services/SSOOIDC/Custom/Internal/_bcl45+netstandard/CoreAmazonSSOOIDC.cs

+                catch (Exception e)
+                {
+                    logger.Error(e, "Unexpected exception while polling for SSO Token.");
+                    Console.WriteLine($"Poll Exception: {e.Message}");


Don't write to the console

sdk/src/Services/SSOOIDC/Custom/Internal/_bcl45+netstandard/CoreAmazonSSOOIDC.cs

normj · 2020-12-07T18:41:51Z

sdk/src/Core/Amazon.Runtime/Credentials/Internal/_bcl45+netstandard/SsoTokenCache.cs

+        /// <param name="startUrl">The configured sso_start_url for the profile that credentials are being resolved for.</param>
+        public SsoTokenCache(string startUrl)
+            : this(
+                Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.UserProfile), ".aws", "sso", "cache"),


Because we have sometimes had trouble with Environment.GetFolderPath(Environment.SpecialFolder.UserProfile) throwing an exception if running under a system user. Can we call a separate utility method that resolves the default cache path and it Environment.GetFolderPath(Environment.SpecialFolder.UserProfile) throws an exception return null. Then through the cache if the path is null either switched to not doing any caching or use an in memory cache.

The spec prohibits keeping the token in cache, so I will set this class to do no caching when it is unable to resolve a UserProfile

normj · 2020-12-07T18:44:48Z

sdk/src/Core/Amazon.Runtime/Credentials/Internal/_bcl45+netstandard/SsoToken.cs

+    public class SsoToken
+    {
+        /// <summary>
+        /// A base64 encoded string returned by the SSOOIDC service (IAmazonSSOOIDC).


I assume the caller doesn't have to do the base64 encoding, just take the value from IAmazonSSOOIDC and use that. If that is true can we not talk about base64 encoding here as that is SSO implementation detail that is transparent to the user and the SDK.

I call this out because we have had issues with users misreading our docs and thinking they have to base64 a string that is already base 64 encoded. I recognize this is not likely to be called by users since it is in an internal namespace but it could get copied and pasted somewhere.

sdk/src/Core/Amazon.Runtime/Credentials/Internal/_bcl45+netstandard/SsoTokenCache.cs

sdk/src/Core/Amazon.Runtime/Credentials/_bcl45+netstandard/SSOAWSCredentials.cs

normj · 2020-12-14T06:59:08Z

I just have the one last question about multiple requests triggering the SSO flow as the same time. Lets ask the Python team what they are doing so we are consistent with them.

ashovlin

Overall question - why the .NET Framework 3.5 restriction? Fine with .NET Standard 1.3 given https://aws.amazon.com/blogs/developer/net-standard-1-3-in-aws-sdk-for-net-is-now-in-maintenance-mode/, but we don't have any current plans to deprecate net35. Discussed briefly with Norm and we're ultimately okay with it, but just curious.

sdk/src/Core/Amazon.Runtime/CredentialManagement/CredentialProfileOptions.cs

awschristou · 2020-12-17T17:03:08Z

why the .NET Framework 3.5 restriction

Some necessary SDK or Crypto calls were not available (I can't recall what it was, but I'll remember to document why next time)

Refresh fork

- support not implemented for .NET Framework 3.5.

normj · 2021-01-20T01:48:38Z

This has been squashed merged and released in version 3.5.2 of AWSSDK.Core

gsweetwood reviewed Sep 11, 2020

View reviewed changes

sdk/src/Services/SSOOIDC/Custom/Internal/_bcl45+netstandard/CoreAmazonSSOOIDC.cs Show resolved Hide resolved

normj requested changes Sep 22, 2020

View reviewed changes

derwasp mentioned this pull request Sep 28, 2020

Is there support for SSO authentication in CredentialProfileStoreChain? #1676

Closed

ashovlin self-requested a review December 3, 2020 18:30

normj requested changes Dec 7, 2020

View reviewed changes

ashovlin reviewed Dec 17, 2020

View reviewed changes

sdk/src/Core/Amazon.Runtime/CredentialManagement/CredentialProfileOptions.cs Show resolved Hide resolved

ashishdhingra mentioned this pull request Jan 8, 2021

dotnet lambda unable to use AWS SSO profile credentials setup via aws configure sso aws/aws-extensions-for-dotnet-cli#154

Closed

Merge pull request #1 from aws/master

481cb1f

Refresh fork

ashovlin approved these changes Jan 13, 2021

View reviewed changes

normj approved these changes Jan 14, 2021

View reviewed changes

Add support for AWS SSO based credentials

6cb59b2

- support not implemented for .NET Framework 3.5.

normj closed this Jan 20, 2021

awschristou mentioned this pull request Jan 25, 2021

Add support for SSO / SAML aws/aws-toolkit-visual-studio#98

Closed

McDoit mentioned this pull request Apr 13, 2021

AWSCredentialsFactory.TryGetAWSCredentials() returns invalid SSOAWSCredentials #1821

Closed

		@@ -0,0 +1,46 @@
		/*
		* Copyright 2020 Amazon.com, Inc. or its affiliates. All Rights Reserved.

SSO Credentials support #1701

SSO Credentials support #1701

Uh oh!

Conversation

awschristou commented Sep 10, 2020

Description

Motivation and Context

Testing

Screenshots (if appropriate)

Types of changes

Checklist

License

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

awschristou Dec 10, 2020 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

normj commented Dec 14, 2020

Uh oh!

ashovlin left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

awschristou commented Dec 17, 2020

Uh oh!

normj commented Jan 20, 2021

Uh oh!

Uh oh!

awschristou Dec 10, 2020 •

edited

Loading