Encountering connection error while fetching IdentityStore after migrating from v1 to v2 #3747

c1ginly · 2023-02-06T17:49:05Z

c1ginly
Feb 6, 2023

The Bug
Using the SDK v1, we are able to establish connection with the STS Client.
With SDK v2, we ran into an issue establishing the same connection with this code snippet

StsClient stsClient = StsClient.builder()
                    .httpClient(getProxyConfig())
                    .region(Region.US_EAST_1)
                    .build(); 
			AssumeRoleRequest assumeRoleRequest = AssumeRoleRequest.builder()
                    .roleArn(roleArn)
                    .roleSessionName("AssumeRole")
                    .build();
AssumeRoleResponse assumeRoleResponse = stsClient.assumeRole(assumeRoleRequest);
AwsCredentials awsCredentials = AwsSessionCredentials.create(
					assumeRoleResponse.credentials().accessKeyId(),
					assumeRoleResponse.credentials().secretAccessKey(),
					assumeRoleResponse.credentials().sessionToken());		
System.out.println("accesskey id "+assumeRoleResponse.credentials().accessKeyId()+ " for role "+roleArn);
IdentitystoreClient awsSSOClient =  IdentitystoreClient.builder().
		    credentialsProvider(StaticCredentialsProvider.create(awsCredentials)).build();
return awsSSOClient;

private static SdkHttpClient getProxyConfig() {
    try {
	   return ApacheHttpClient.builder()
				        .proxyConfiguration(ProxyConfiguration.builder()
				        		.endpoint(new URI(<proxy-cloud>))
				        		.addNonProxyHost(<non-proxy-hosts>.replace("*",""))
				        		.useSystemPropertyValues(true)
				        		.build())
				        .build();
	} catch (Exception e) {
				// TODO Auto-generated catch block
				e.printStackTrace();
	}
	   return null;
    }

The exception encountered

Exception in thread "main" software.amazon.awssdk.core.exception.SdkClientException: Unable to execute HTTP request: Connect to identitystore.us-east-1.amazonaws.com:443 [identitystore.us-east-1.amazonaws.com/34.192.171.222, identitystore.us-east-1.amazonaws.com/52.0.239.247, identitystore.us-east-1.amazonaws.com/44.205.142.245, identitystore.us-east-1.amazonaws.com/3.223.199.237, identitystore.us-east-1.amazonaws.com/52.72.105.231, identitystore.us-east-1.amazonaws.com/44.205.45.58] failed: connect timed out
	at software.amazon.awssdk.core.exception.SdkClientException$BuilderImpl.build(SdkClientException.java:111)
	at software.amazon.awssdk.core.exception.SdkClientException.create(SdkClientException.java:47)
	at software.amazon.awssdk.core.internal.http.pipeline.stages.utils.RetryableStageHelper.setLastException(RetryableStageHelper.java:223)
	at software.amazon.awssdk.core.internal.http.pipeline.stages.RetryableStage.execute(RetryableStage.java:83)
	at software.amazon.awssdk.core.internal.http.pipeline.stages.RetryableStage.execute(RetryableStage.java:36)
	at software.amazon.awssdk.core.internal.http.pipeline.RequestPipelineBuilder$ComposingRequestPipelineStage.execute(RequestPipelineBuilder.java:206)
	at software.amazon.awssdk.core.internal.http.StreamManagingStage.execute(StreamManagingStage.java:56)
	at software.amazon.awssdk.core.internal.http.StreamManagingStage.execute(StreamManagingStage.java:36)
	at software.amazon.awssdk.core.internal.http.pipeline.stages.ApiCallTimeoutTrackingStage.executeWithTimer(ApiCallTimeoutTrackingStage.java:80)
	at software.amazon.awssdk.core.internal.http.pipeline.stages.ApiCallTimeoutTrackingStage.execute(ApiCallTimeoutTrackingStage.java:60)
	at software.amazon.awssdk.core.internal.http.pipeline.stages.ApiCallTimeoutTrackingStage.execute(ApiCallTimeoutTrackingStage.java:42)
	at software.amazon.awssdk.core.internal.http.pipeline.stages.ApiCallMetricCollectionStage.execute(ApiCallMetricCollectionStage.java:48)
	at software.amazon.awssdk.core.internal.http.pipeline.stages.ApiCallMetricCollectionStage.execute(ApiCallMetricCollectionStage.java:31)
	at software.amazon.awssdk.core.internal.http.pipeline.RequestPipelineBuilder$ComposingRequestPipelineStage.execute(RequestPipelineBuilder.java:206)
	at software.amazon.awssdk.core.internal.http.pipeline.RequestPipelineBuilder$ComposingRequestPipelineStage.execute(RequestPipelineBuilder.java:206)
	at software.amazon.awssdk.core.internal.http.pipeline.stages.ExecutionFailureExceptionReportingStage.execute(ExecutionFailureExceptionReportingStage.java:37)
	at software.amazon.awssdk.core.internal.http.pipeline.stages.ExecutionFailureExceptionReportingStage.execute(ExecutionFailureExceptionReportingStage.java:26)
	at software.amazon.awssdk.core.internal.http.AmazonSyncHttpClient$RequestExecutionBuilderImpl.execute(AmazonSyncHttpClient.java:193)
	at software.amazon.awssdk.core.internal.handler.BaseSyncClientHandler.invoke(BaseSyncClientHandler.java:103)
	at software.amazon.awssdk.core.internal.handler.BaseSyncClientHandler.doExecute(BaseSyncClientHandler.java:171)
	at software.amazon.awssdk.core.internal.handler.BaseSyncClientHandler.lambda$execute$1(BaseSyncClientHandler.java:82)
	at software.amazon.awssdk.core.internal.handler.BaseSyncClientHandler.measureApiCallSuccess(BaseSyncClientHandler.java:179)
	at software.amazon.awssdk.core.internal.handler.BaseSyncClientHandler.execute(BaseSyncClientHandler.java:76)
	at software.amazon.awssdk.core.client.handler.SdkSyncClientHandler.execute(SdkSyncClientHandler.java:45)
	at software.amazon.awssdk.awscore.client.handler.AwsSyncClientHandler.execute(AwsSyncClientHandler.java:56)
	at software.amazon.awssdk.services.identitystore.DefaultIdentitystoreClient.describeUser(DefaultIdentitystoreClient.java:758)
	at com.capitalone.iam.AWSSSOClient1.describeUser(AWSSSOClient1.java:100)
	at com.capitalone.iam.AWSSSOClient1.main(AWSSSOClient1.java:39)
	Suppressed: software.amazon.awssdk.core.exception.SdkClientException: Request attempt 1 failure: Unable to execute HTTP request: Connect to identitystore.us-east-1.amazonaws.com:443 [identitystore.us-east-1.amazonaws.com/44.205.45.58, identitystore.us-east-1.amazonaws.com/52.72.105.231, identitystore.us-east-1.amazonaws.com/3.223.199.237, identitystore.us-east-1.amazonaws.com/44.205.142.245, identitystore.us-east-1.amazonaws.com/52.0.239.247, identitystore.us-east-1.amazonaws.com/34.192.171.222] failed: connect timed out
	Suppressed: software.amazon.awssdk.core.exception.SdkClientException: Request attempt 2 failure: Unable to execute HTTP request: Connect to identitystore.us-east-1.amazonaws.com:443 [identitystore.us-east-1.amazonaws.com/44.205.45.58, identitystore.us-east-1.amazonaws.com/52.72.105.231, identitystore.us-east-1.amazonaws.com/3.223.199.237, identitystore.us-east-1.amazonaws.com/44.205.142.245, identitystore.us-east-1.amazonaws.com/52.0.239.247, identitystore.us-east-1.amazonaws.com/34.192.171.222] failed: connect timed out
	Suppressed: software.amazon.awssdk.core.exception.SdkClientException: Request attempt 3 failure: Unable to execute HTTP request: Connect to identitystore.us-east-1.amazonaws.com:443 [identitystore.us-east-1.amazonaws.com/44.205.45.58, identitystore.us-east-1.amazonaws.com/52.72.105.231, identitystore.us-east-1.amazonaws.com/3.223.199.237, identitystore.us-east-1.amazonaws.com/44.205.142.245, identitystore.us-east-1.amazonaws.com/52.0.239.247, identitystore.us-east-1.amazonaws.com/34.192.171.222] failed: connect timed out
Caused by: org.apache.http.conn.ConnectTimeoutException: Connect to identitystore.us-east-1.amazonaws.com:443 [identitystore.us-east-1.amazonaws.com/34.192.171.222, identitystore.us-east-1.amazonaws.com/52.0.239.247, identitystore.us-east-1.amazonaws.com/44.205.142.245, identitystore.us-east-1.amazonaws.com/3.223.199.237, identitystore.us-east-1.amazonaws.com/52.72.105.231, identitystore.us-east-1.amazonaws.com/44.205.45.58] failed: connect timed out
	at org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:151)
	at org.apache.http.impl.conn.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:376)
	at software.amazon.awssdk.http.apache.internal.conn.ClientConnectionManagerFactory$DelegatingHttpClientConnectionManager.connect(ClientConnectionManagerFactory.java:86)
	at org.apache.http.impl.execchain.MainClientExec.establishRoute(MainClientExec.java:393)
	at org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:236)
	at org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:186)
	at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:185)
	at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:83)
	at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:56)
	at software.amazon.awssdk.http.apache.internal.impl.ApacheSdkHttpClient.execute(ApacheSdkHttpClient.java:72)
	at software.amazon.awssdk.http.apache.ApacheHttpClient.execute(ApacheHttpClient.java:254)
	at software.amazon.awssdk.http.apache.ApacheHttpClient.access$500(ApacheHttpClient.java:104)
	at software.amazon.awssdk.http.apache.ApacheHttpClient$1.call(ApacheHttpClient.java:231)
	at software.amazon.awssdk.http.apache.ApacheHttpClient$1.call(ApacheHttpClient.java:228)
	at software.amazon.awssdk.core.internal.util.MetricUtils.measureDurationUnsafe(MetricUtils.java:63)
	at software.amazon.awssdk.core.internal.http.pipeline.stages.MakeHttpRequestStage.executeHttpRequest(MakeHttpRequestStage.java:77)
	at software.amazon.awssdk.core.internal.http.pipeline.stages.MakeHttpRequestStage.execute(MakeHttpRequestStage.java:56)
	at software.amazon.awssdk.core.internal.http.pipeline.stages.MakeHttpRequestStage.execute(MakeHttpRequestStage.java:39)
	at software.amazon.awssdk.core.internal.http.pipeline.RequestPipelineBuilder$ComposingRequestPipelineStage.execute(RequestPipelineBuilder.java:206)
	at software.amazon.awssdk.core.internal.http.pipeline.RequestPipelineBuilder$ComposingRequestPipelineStage.execute(RequestPipelineBuilder.java:206)
	at software.amazon.awssdk.core.internal.http.pipeline.RequestPipelineBuilder$ComposingRequestPipelineStage.execute(RequestPipelineBuilder.java:206)
	at software.amazon.awssdk.core.internal.http.pipeline.RequestPipelineBuilder$ComposingRequestPipelineStage.execute(RequestPipelineBuilder.java:206)
	at software.amazon.awssdk.core.internal.http.pipeline.stages.ApiCallAttemptTimeoutTrackingStage.execute(ApiCallAttemptTimeoutTrackingStage.java:73)
	at software.amazon.awssdk.core.internal.http.pipeline.stages.ApiCallAttemptTimeoutTrackingStage.execute(ApiCallAttemptTimeoutTrackingStage.java:42)
	at software.amazon.awssdk.core.internal.http.pipeline.stages.TimeoutExceptionHandlingStage.execute(TimeoutExceptionHandlingStage.java:78)
	at software.amazon.awssdk.core.internal.http.pipeline.stages.TimeoutExceptionHandlingStage.execute(TimeoutExceptionHandlingStage.java:40)
	at software.amazon.awssdk.core.internal.http.pipeline.stages.ApiCallAttemptMetricCollectionStage.execute(ApiCallAttemptMetricCollectionStage.java:50)
	at software.amazon.awssdk.core.internal.http.pipeline.stages.ApiCallAttemptMetricCollectionStage.execute(ApiCallAttemptMetricCollectionStage.java:36)
	at software.amazon.awssdk.core.internal.http.pipeline.stages.RetryableStage.execute(RetryableStage.java:81)
	... 24 more
Caused by: java.net.SocketTimeoutException: connect timed out
	at java.net.PlainSocketImpl.socketConnect(Native Method)
	at java.net.AbstractPlainSocketImpl.doConnect(AbstractPlainSocketImpl.java:476)
	at java.net.AbstractPlainSocketImpl.connectToAddress(AbstractPlainSocketImpl.java:218)
	at java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:200)
	at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:394)
	at java.net.Socket.connect(Socket.java:606)
	at org.apache.http.conn.ssl.SSLConnectionSocketFactory.connectSocket(SSLConnectionSocketFactory.java:368)
	at software.amazon.awssdk.http.apache.internal.conn.SdkTlsSocketFactory.connectSocket(SdkTlsSocketFactory.java:65)
	at org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:142)
	... 52 more

We used the same credentials for both v1 and v2 connections.

Answered by debora-ito

Feb 7, 2023

The ProxyConfiguration needs to be set in the HTTP Client used in the IdentityStoreClient too.

IdentitystoreClient awsSSOClient =  IdentitystoreClient.builder()
            .credentialsProvider(StaticCredentialsProvider.create(awsCredentials)) 
            .httpClient(getProxyConfig())    // <--- this is missing
            .build();

Note that one best practice when configuring HTTP clients in service clients is to use the httpClientBuilder() method, this way the service client will manage the HTTP client lifecycle and close it when the service client gets closed.

More info - https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/http-configuration-apache.html

View full answer

debora-ito · 2023-02-07T03:16:02Z

debora-ito
Feb 7, 2023
Maintainer

The ProxyConfiguration needs to be set in the HTTP Client used in the IdentityStoreClient too.

IdentitystoreClient awsSSOClient =  IdentitystoreClient.builder()
            .credentialsProvider(StaticCredentialsProvider.create(awsCredentials)) 
            .httpClient(getProxyConfig())    // <--- this is missing
            .build();

Note that one best practice when configuring HTTP clients in service clients is to use the httpClientBuilder() method, this way the service client will manage the HTTP client lifecycle and close it when the service client gets closed.

More info - https://docs.aws.amazon.com/sdk-for-java/latest/developer-guide/http-configuration-apache.html

6 replies

c1ginly Feb 7, 2023
Author

I think it may be helpful to document the proper usage of the builder if that's possible.

debora-ito Feb 8, 2023
Maintainer

I linked a page to the Developer Guide in my last comment, do you think there's more information that should be added?

chgogu Jan 30, 2024

@debora-ito
I keep getting error connecting to identitystoreclient below is the snippet of code I'm using for java v2 sdk

Errors: Exception running rule: software/amazon/awssdk/http/auth/spi/scheme/AuthScheme

Region region = Region.of(Region.AWS_GLOBAL.toString());
SdkHttpClient httpClient = UrlConnectionHttpClient.builder().build();
IdentitystoreClient identityStoreClient = IdentitystoreClient.builder().region(region).credentialsProvider(AWSBasicCredentials.create(ikey,skey)).httpClient(httpClient).build();

debora-ito Jan 30, 2024
Maintainer

@chgogu please open a new Github Discussion, and provide the full stacktrace of the error and the Java SDK version you're using.

chgogu Jan 30, 2024

#4865 opened this case, thank you.

2023-12-01T20:07:43Z

github-actions[bot]
bot Dec 1, 2023

Hello! Reopening this discussion to make it searchable.

0 replies

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Encountering connection error while fetching IdentityStore after migrating from v1 to v2 #3747

{{title}}

{{editor}}'s edit

{{editor}}'s edit

Replies: 2 comments 6 replies

{{title}}

{{title}}

{{title}}

{{title}}

{{editor}}'s edit

{{editor}}'s edit

{{title}}

{{title}}

{{title}}

Select a reply

Encountering connection error while fetching IdentityStore after migrating from v1 to v2 #3747

c1ginly Feb 6, 2023

Replies: 2 comments · 6 replies

debora-ito Feb 7, 2023 Maintainer

c1ginly Feb 7, 2023 Author

debora-ito Feb 8, 2023 Maintainer

chgogu Jan 30, 2024

debora-ito Jan 30, 2024 Maintainer

chgogu Jan 30, 2024

github-actions[bot] bot Dec 1, 2023

c1ginly
Feb 6, 2023

Replies: 2 comments 6 replies

debora-ito
Feb 7, 2023
Maintainer

c1ginly Feb 7, 2023
Author

debora-ito Feb 8, 2023
Maintainer

debora-ito Jan 30, 2024
Maintainer

github-actions[bot]
bot Dec 1, 2023