Add token refresh support to SSOCredentialProvider #1903

isaiahvita · 2022-11-02T22:34:15Z

This PR adds support for token refresh to the SSOCredentialProvider (by using the SSOTokenProvider) while maintaining support for legacy SSO configurations (i.e. SSO configurations that do not use an sso-session but specify sso fields directly in a profile section of a shared config file)

Testing procedure:
Followed testing instructions by SDKs feature owner @alextwoods which included:

running the sso login flow with the AWS CLI
using the access token, calling S3 List Buckets on the configured AWS account
when the access token expires, re-calling S3 List buckets and see it succeed with an updated expiration in the SSO cache

Additonally:
Fixes #1845
Fixes #1846

sbiscigl · 2022-11-03T13:59:08Z

config/resolve_credentials.go

@@ -3,6 +3,7 @@ package config
 import (
 	"context"
 	"fmt"
+	"github.com/aws/aws-sdk-go-v2/service/ssooidc"


nit pick: move sdk import with other sdk imports

goimports is a good tool to do this automatically for you. https://pkg.go.dev/golang.org/x/tools/cmd/goimports

syall

Minor notes about the PR, add:

More context in the description
How the changes was tested (commands, etc.)
How changes will impact customers (only due to the possible break/fix)

Also, try to keep the same style of checking for the empty string throughout the PR.

syall · 2022-11-03T04:51:08Z

config/shared_config.go

 		if err := c.validateCredentialsConfig(profile); err != nil {
 			return err
 		}
+


nit: remove newline

syall · 2022-11-03T05:26:12Z

config/shared_config.go

 	if len(missing) > 0 {
 		return fmt.Errorf("profile %q is configured to use SSO but is missing required configuration: %s",
 			c.Profile, strings.Join(missing, ", "))
 	}
-


nit: add back newline

syall · 2022-11-03T05:33:53Z

credentials/ssocreds/sso_credentials_provider.go

@@ -45,6 +45,8 @@ type Options struct {
 	// If custom cached token filepath is used, the Provider's startUrl
 	// parameter will be ignored.
 	CachedTokenFilepath string
+
+	TokenClient CreateTokenAPIClient


CreateTokenAPIClient needs documentation comment

syall · 2022-11-03T05:53:19Z

config/resolve_credentials.go

+		cachedPath, err := ssocreds.StandardCachedTokenFilepath(sharedConfig.SSOSession.Name)
+		if err != nil {
+			return err
+		}
+		oidcClient := ssooidc.NewFromConfig(cfgCopy)


nit: put oidcClient := ssooidc.NewFromConfig(cfgCopy) at the top of this comment block to keep with other validation done for TokenClient

Suggested change

cachedPath, err := ssocreds.StandardCachedTokenFilepath(sharedConfig.SSOSession.Name)

if err != nil {

return err

}

oidcClient := ssooidc.NewFromConfig(cfgCopy)

oidcClient := ssooidc.NewFromConfig(cfgCopy)

cachedPath, err := ssocreds.StandardCachedTokenFilepath(sharedConfig.SSOSession.Name)

if err != nil {

return err

}

hmm im a bit confused at this requested change.

this validation:

cachedPath, err := ssocreds.StandardCachedTokenFilepath(sharedConfig.SSOSession.Name) if err != nil { return err }

isnt operating on any input related to oidcClient := ssooidc.NewFromConfig(cfgCopy)

additionally, the cached path conditional checks to see if the existing token is valid before creating an oidc client. if the existing token is not valid, then there is not reason to create an oidc client, so it should happen after

syall · 2022-11-03T05:55:04Z

config/resolve_credentials.go

+		var optFns []func(*ssocreds.SSOTokenProviderOptions)
+		if found {
+			optFns = append(optFns, ssoTokenProviderOptionsFn)
+		}


optFns does not seem to be used anywhere in this function.

looks like this should of bee used as input for ssoidc.NewFromConfig?

I believe these are function options to be passed to the token provider constructor function actually.

This is a good catch. Because optFns are *ssocreds.SSOTokenProviderOptions, it cannot be passed into the ssooidc constructor and must be passed into the token provider constructor. This means that instead of adding a new field to the sso Options and passing the ssoidc client as an option into the sso constructor:

options = append(options, func(o *ssocreds.Options) { o.TokenClient = oidcClient o.CachedTokenFilepath = cachedPath })

I must make the added field a *SSOTokenProvider and pass that as an option into the sso constructor
Ill push a new commit to this PR with that change.

syall · 2022-11-03T05:59:31Z

credentials/ssocreds/sso_credentials_provider.go

-	if p.cachedTokenFilepath == "" {
-		cachedTokenFilepath, err := StandardCachedTokenFilepath(p.options.StartURL)
+	var accessToken *string
+	if p.options.TokenClient != nil {


nit: add a comment about the new TokenClient workflow.

syall · 2022-11-03T05:59:38Z

credentials/ssocreds/sso_credentials_provider.go

+		}
+		accessToken = &token.Value
+	} else {
+		if p.cachedTokenFilepath == "" {


nit: add a comment about cachedTokenFilepath workflow.

config/resolve_bearer_token.go

syall · 2022-11-03T16:35:37Z

config/shared_config.go

 	}

 	return nil
 }

-func getSSOSession(name string, sections ini.Sections, logger logging.Logger) (*SSOSession, error) {


Make sure this function that was removed is not referenced anywhere else.

Since this is package private there is no concern for this being removed. If something else requires it within the package, then it wouldn't compile or pass tests.

syall · 2022-11-03T16:36:00Z

config/shared_config.go

@@ -1088,17 +1069,66 @@ func (c *SharedConfig) validateCredentialType() error {
 		len(c.CredentialProcess) != 0,
 		len(c.WebIdentityTokenFile) != 0,
 	) {
-		return fmt.Errorf("only one credential type may be specified per profile: source profile, credential source, credential process, web identity token, or sso")
+		return fmt.Errorf("only one credential type may be specified per profile: source profile, credential source, credential process, web identity token")
 	}

 	return nil
 }

 func (c *SharedConfig) validateSSOConfiguration() error {


note: validation in general has become stricter for both the legacy and current format.

jasdel · 2022-11-03T17:05:03Z

config/resolve_credentials.go

@@ -3,6 +3,7 @@ package config
 import (
 	"context"
 	"fmt"
+	"github.com/aws/aws-sdk-go-v2/service/ssooidc"


goimports is a good tool to do this automatically for you. https://pkg.go.dev/golang.org/x/tools/cmd/goimports

config/resolve_bearer_token.go

jasdel · 2022-11-07T17:00:28Z

config/resolve_credentials.go

+		var optFns []func(*ssocreds.SSOTokenProviderOptions)
+		if found {
+			optFns = append(optFns, ssoTokenProviderOptionsFn)
+		}


looks like this should of bee used as input for ssoidc.NewFromConfig?

jasdel · 2022-11-07T17:05:28Z

config/shared_config.go

+			missing = append(missing, fmt.Sprintf("%s", ssoRegionKey))
+		}
+
+		if len(c.SSOSession.SSOStartURL) == 0 {
+			missing = append(missing, fmt.Sprintf("%s", ssoStartURLKey))


are the fmt.Sprintf needed here?

ah right, its not. will remove

skmcgrail · 2022-11-07T17:42:06Z

config/resolve_credentials.go

+		var optFns []func(*ssocreds.SSOTokenProviderOptions)
+		if found {
+			optFns = append(optFns, ssoTokenProviderOptionsFn)
+		}


I believe these are function options to be passed to the token provider constructor function actually.

skmcgrail · 2022-11-07T17:43:42Z

config/shared_config.go

 	}

 	return nil
 }

-func getSSOSession(name string, sections ini.Sections, logger logging.Logger) (*SSOSession, error) {


Since this is package private there is no concern for this being removed. If something else requires it within the package, then it wouldn't compile or pass tests.

skmcgrail · 2022-11-07T17:45:32Z

config/shared_config.go

+	if c.hasSSOTokenProviderConfiguration() {
+		err := c.validateSSOTokenProviderConfiguration()
+		if err != nil {
+			return err
+		}
 		return nil
 	}

+	if c.hasLegacySSOConfiguration() {
+		err := c.validateLegacySSOConfiguration()
+		if err != nil {
+			return err
+		}
+	}
+	return nil


Can both exist within the same profile, and if so is there precedence? As that would change how you would want this validation to work.

Yes - both could exist in one profile (its unlikely, but someone who is migrating from legacy to new could have such a setup). If so - the new format should be used, and the sso_start_url and sso_region MUST match (ie, if there is a mismatch between the profile's sso_region and the sso-session's, then we should raise an error).

@skmcgrail yes both can exist in the same profile. i intentionally check to see if the new configuration is present and valid. if it is valid, then it should be used and if it is not valid, then it should error (even if the legacy configuration is present and valid). is there another scenario in mind you might be thinking about thats not covered here?

also, regarding @alextwoods comment about matching sso_start_url and sso_region, i do that additional check here https://github.com/aws/aws-sdk-go-v2/pull/1903/files#diff-ad732dd8295a0ce04a495056007062e13a140b7f97f173004d0d6523545805d2R1120

jasdel · 2022-11-09T21:32:42Z

credentials/ssocreds/sso_credentials_provider.go

+
+	// Used by the SSOCredentialProvider if a token configuration
+	// profile is used in the shared config
+	TokenProvider *SSOTokenProvider


Probably should prefix this member with SSO in case there are other kinds of TokenProvider in the future. CachedTokenFilepath probably should of been prefixed with SSO as well, but that ship has passed.

yah i was debating with myself on this and then just defaulted to the existing style in that file. but i agree adding SSO makes sense and i just made the change with a new commit

…own sso unit tests

…on only

Closes #954 This pulls in this fix to the config module: aws/aws-sdk-go-v2#1903

isaiahvita requested a review from a team as a code owner November 2, 2022 22:34

isaiahvita assigned isaiahvita and sbiscigl and unassigned isaiahvita Nov 2, 2022

sbiscigl approved these changes Nov 3, 2022

View reviewed changes

syall requested changes Nov 3, 2022

View reviewed changes

jasdel reviewed Nov 7, 2022

View reviewed changes

skmcgrail reviewed Nov 7, 2022

View reviewed changes

jasdel reviewed Nov 9, 2022

View reviewed changes

isaiahvita added 21 commits November 10, 2022 18:45

first pass of code written, untested

8d09ba9

fix tokenprovider check on sharedconfig #1846

fce3a5f

sep says only sso session section required

5eb9d79

get naem from session instead of profile per the TP SEP

edb4d43

add potential todos

db6bfac

check if sso-session section is present, fixes #1845

6118eb4

remove comment

ca45169

fix shared config sso validations

fe74417

200 from sso, shared config and resolver logic wrong tho

02d654c

200 from sso, but unit tests failing

6d34685

fixed issues with existing failing sso test cases, still need to add …

cf28002

…own sso unit tests

add token provider options to sso creds provider

c210422

added happy path test case

7607b30

added error unit test, failing on prior unit test

a6d628f

added missing region unit test, moved sso validation to cred resoluti…

ef79153

…on only

add region mismatch unit test

f374d28

remove dev comments

54f2645

fix validation for token provider config

a4c2dd8

remove dev comment

f4fb486

fix style issues, replaced tokenclient with tokenprovider as option

2ae06ad

change name of token provider option

3a82c79

add changelog files for feature and announcement

2f0c3b1

isaiahvita force-pushed the isvita/token-refresh branch from 2f6a7aa to 2f0c3b1 Compare November 10, 2022 18:53

isaiahvita merged commit 3d79564 into main Nov 11, 2022

isaiahvita deleted the isvita/token-refresh branch November 15, 2022 17:30

kurtismash mentioned this pull request Dec 8, 2022

[Bug]: Lack of support for sso-session in .aws/config hashicorp/terraform-provider-aws#28263

Closed

This was referenced Dec 13, 2022

aws-sdk-go doens't support new sso-session in a shared config aws/aws-sdk-go#4649

Closed

Support sso-session in a shared config aws/session-manager-plugin#58

Open

paxan mentioned this pull request Apr 26, 2023

SSOProviderInvalidToken: the SSO session has expired or is invalid aws/lightsailctl#26

Closed

kruczjak mentioned this pull request Jun 20, 2023

AWS SSO is badly broken in SOPS getsops/sops#1197

Closed

danielrbradley added a commit to pulumi/pulumi-aws-native that referenced this pull request Jul 3, 2023

Upgrade AWS Go SDKs

bc0112b

Closes #954 This pulls in this fix to the config module: aws/aws-sdk-go-v2#1903

danielrbradley mentioned this pull request Jul 3, 2023

Upgrade AWS Go SDKs pulumi/pulumi-aws-native#957

Merged

danielrbradley added a commit to pulumi/pulumi-aws-native that referenced this pull request Jul 6, 2023

Upgrade AWS Go SDKs (#957)

8d0c761

Closes #954 This pulls in this fix to the config module: aws/aws-sdk-go-v2#1903

ekini mentioned this pull request Aug 4, 2023

AWS session-based SSO does not work with s3 backend pulumi/pulumi#13142

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add token refresh support to SSOCredentialProvider #1903

Add token refresh support to SSOCredentialProvider #1903

isaiahvita commented Nov 2, 2022 •

edited

sbiscigl Nov 3, 2022

jasdel Nov 3, 2022

syall left a comment •

edited

syall Nov 3, 2022

syall Nov 3, 2022

syall Nov 3, 2022

syall Nov 3, 2022

isaiahvita Nov 8, 2022

syall Nov 3, 2022

jasdel Nov 7, 2022

skmcgrail Nov 7, 2022

isaiahvita Nov 8, 2022

syall Nov 3, 2022

syall Nov 3, 2022

syall Nov 3, 2022

skmcgrail Nov 7, 2022

syall Nov 3, 2022

jasdel Nov 3, 2022

jasdel Nov 7, 2022

jasdel Nov 7, 2022

isaiahvita Nov 8, 2022

skmcgrail Nov 7, 2022

skmcgrail Nov 7, 2022

skmcgrail Nov 7, 2022

alextwoods Nov 7, 2022

isaiahvita Nov 8, 2022

jasdel Nov 9, 2022

isaiahvita Nov 10, 2022 •

edited

Add token refresh support to SSOCredentialProvider #1903

Add token refresh support to SSOCredentialProvider #1903

Conversation

isaiahvita commented Nov 2, 2022 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

syall left a comment • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

isaiahvita Nov 10, 2022 • edited

Choose a reason for hiding this comment

isaiahvita commented Nov 2, 2022 •

edited

syall left a comment •

edited

isaiahvita Nov 10, 2022 •

edited