feat: Bearer token auth #1637

sichanyoo · 2024-07-17T18:47:30Z

Companion PR: smithy-lang/smithy-swift#786

Issue #

Description of changes

Refer to comments on github diff

Manual testing steps

To test this locally, first set up your IAM Identity Center (doc link) & AWS CodeCatalyst (doc link).
Then, configure your config file to contain the following:

[default]
region=us-west-2
output=json
sso_session = codecatalyst

[profile codecatalyst]
region = us-west-2
sso_session = codecatalyst

[sso-session codecatalyst]
sso_region = us-east-1
sso_start_url = https://view.awsapps.com/start
sso_registration_scopes = codecatalyst:read_write

Then, run

aws sso login --profile=codecatalyst

on the terminal. This will open a browser tab for you to authorize your AWS account to be accessed by CodeCatalyst.
Successful previous step creates a token file at path ~/.aws/sso/cache/<sha-1-hash-of-sso-sesion-name>.json.
In CLITool, use CodeCatalyst::VerifySession API by simply doing the following:

func run() async throws {
        let client = try CodeCatalystClient(region: "us-west-2")
        let id = try await client.verifySession(input: VerifySessionInput()).identity
        print(id ?? "#### NO_ID_RETRIEVED")
}

Observe that the server accepts bearer auth and returns the ID successfully.

New/existing dependencies impact assessment, if applicable

Conventional Commits

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

…ithy-swift.

…zation & Add SSO bearer token identity resolver + Default chain resolver for bearer token identity.

…n AWS, with DefaultBearerTokenIdentityResolverChain.

…scheme plugin.

…g CryptoKit.

…entityResolver field.

sichanyoo

Comments to help reviewers.

sichanyoo · 2024-07-17T23:04:19Z

...es/AWSSDKIdentity/BearerTokenIdentityResolvers/DefaultBearerTokenIdentityResolverChain.swift

@@ -0,0 +1,35 @@
+//


This is much like the default AWS credential identity resolver chain. Unlike it tho, this only has one resolver atm.

sichanyoo · 2024-07-17T23:05:33Z

...ity/Sources/AWSSDKIdentity/BearerTokenIdentityResolvers/SSOBearerTokenIdentityResolver.swift

@@ -0,0 +1,94 @@
+//


This token identity resolver fetches the access token from cached SSO token file.

sichanyoo · 2024-07-17T23:07:31Z

...y-aws-swift-codegen/src/main/kotlin/software/amazon/smithy/aws/swift/codegen/AWSAuthUtils.kt

@@ -18,8 +18,11 @@ import software.amazon.smithy.swift.codegen.SwiftWriter
 import software.amazon.smithy.swift.codegen.integration.ProtocolGenerator


Refactored to remove logic for getting auth schemes supported by the model and move it into smithy-swift. Refer to comment: https://github.com/smithy-lang/smithy-swift/pull/786/files#r1681867714

sichanyoo · 2024-07-17T23:08:44Z

...y-aws-swift-codegen/src/main/kotlin/software/amazon/smithy/aws/swift/codegen/AWSAuthUtils.kt

+    override fun addAdditionalSchemes(writer: SwiftWriter, authSchemeList: Array<String>): Array<String> {
+        val effectiveAuthSchemes = ServiceIndex(ctx.model).getEffectiveAuthSchemes(ctx.service)

-            val sdkId = AuthSchemeResolverGenerator.getSdkId(ctx)
-            val servicesUsingSigV4A = arrayOf("S3", "EventBridge", "CloudFrontKeyValueStore")
+        val sdkId = AuthSchemeResolverGenerator.getSdkId(ctx)
+        val servicesUsingSigV4A = arrayOf("S3", "EventBridge", "CloudFrontKeyValueStore")
+        var updatedAuthSchemeList = authSchemeList

-            if (effectiveAuthSchemes.contains(SigV4Trait.ID)) {
-                authSchemeList += writer.format("\$N()", AWSSDKHTTPAuthTypes.SigV4AuthScheme)
-            }
-            if (effectiveAuthSchemes.contains(SigV4ATrait.ID) || servicesUsingSigV4A.contains(sdkId)) {
-                authSchemeList += writer.format("\$N()", AWSSDKHTTPAuthTypes.SigV4AAuthScheme)
-            }
-            return "[${authSchemeList.joinToString(", ")}]"
+        if (effectiveAuthSchemes.contains(SigV4Trait.ID)) {
+            updatedAuthSchemeList += writer.format("\$N()", AWSSDKHTTPAuthTypes.SigV4AuthScheme)
+        }
+        if (effectiveAuthSchemes.contains(SigV4ATrait.ID) || servicesUsingSigV4A.contains(sdkId)) {
+            updatedAuthSchemeList += writer.format("\$N()", AWSSDKHTTPAuthTypes.SigV4AAuthScheme)
        }
+
+        return updatedAuthSchemeList


Handles detecting and adding the SigV4 / SigV4A auth schemes to list of auth schemes supported by the service.

sichanyoo · 2024-07-17T23:09:43Z

...gen/src/main/kotlin/software/amazon/smithy/aws/swift/codegen/AWSHttpProtocolServiceClient.kt

+                "bearerTokenIdentityResolver" -> {
+                    ConfigProperty(
+                        "bearerTokenIdentityResolver",
+                        SmithyIdentityTypes.BearerTokenIdentityResolver.toGeneric(),
+                        { it.format("\$N()", AWSSDKIdentityTypes.DefaultBearerTokenIdentityResolverChain) },
+                        true
+                    )


The default value for bearerTokenIdentityResolver field of the client config was StaticBearerTokenIdentityResolver in smithy-swift, but over here in aws-sdk-swift, it has to be the default chain instead. Hence this override.

sichanyoo · 2024-07-17T23:10:21Z

...gen/src/main/kotlin/software/amazon/smithy/aws/swift/codegen/AWSHttpProtocolServiceClient.kt

-    private val authSchemesDefaultProvider = DefaultProvider(
-        { getModeledAuthSchemesSupportedBySDK(ctx, it) },
-        isThrowable = false,
-        isAsync = false
-    )
-


Moved to AuthUtils in smithy-swift.

sichanyoo · 2024-07-17T23:11:15Z

...codegen/src/main/kotlin/software/amazon/smithy/aws/swift/codegen/plugins/AuthSchemePlugin.kt

@@ -28,16 +28,20 @@ class AuthSchemePlugin(private val serviceConfig: ServiceConfig) : Plugin {
            writer.write("private var authSchemes: \$N", SmithyHTTPAuthAPITypes.AuthSchemes.toOptional())


Changes in this file are just adding bearerTokenIdentityResolver field as one of the new fields configurable by the auth scheme plugin.

sichanyoo · 2024-07-17T23:11:26Z

...c/main/kotlin/software/amazon/smithy/aws/swift/codegen/plugins/DefaultAWSAuthSchemePlugin.kt

@@ -1,7 +1,8 @@
 package software.amazon.smithy.aws.swift.codegen.plugins



Changes in this file are just adding bearerTokenIdentityResolver field as one of the new fields configurable by the auth scheme plugin.

sichanyoo · 2024-07-17T23:11:39Z

...src/main/kotlin/software/amazon/smithy/aws/swift/codegen/swiftmodules/AWSSDKIdentityTypes.kt

@@ -18,6 +18,7 @@ object AWSSDKIdentityTypes {
    val AWSEndpointsRequestContext = runtimeSymbol("AWSEndpointsRequestContext")


The new runtime type, but in codegen side.

Sichan Yoo added 12 commits July 12, 2024 11:20

Rename SigV4Utils to AWSAuthUtils, and make it extend AuthUtils in sm…

24aab9f

…ithy-swift.

ktlint.

e887757

Fix auth scheme list codegen

43aa5c7

Move all AWS credential identity resolvers under subfolder for organi…

68f60db

…zation & Add SSO bearer token identity resolver + Default chain resolver for bearer token identity.

Override default config value for bearerTokenIdentityResolver field i…

eb81ffd

…n AWS, with DefaultBearerTokenIdentityResolverChain.

Add bearerTokenIdentityResolver to auth scheme plugin & default auth …

6e39178

…scheme plugin.

Add doc comments for relevant new structs

afe4d14

Use AwsCommonRuntimeKit's implementation of SHA1 hash instead of usin…

cd08774

…g CryptoKit.

swiftlint

f549b78

Fix broken codegen tests, swiftlint, fix wrong type for bearerTokenId…

9322cee

…entityResolver field.

Add tests for SSOBearerTokenIdentityResolver.

8bcc004

Merge branch 'main' into feat/bearer-token-auth

466c1fc

sichanyoo mentioned this pull request Jul 17, 2024

feat: Bearer token auth smithy-lang/smithy-swift#786

Merged

2 tasks

Sichan Yoo added 3 commits July 17, 2024 12:04

Fix codegen compiler errors

6e749ff

Parametrize home directory URL based on platform.

25afde9

Merge branch 'main' into feat/bearer-token-auth

3705d55

sichanyoo commented Jul 17, 2024

View reviewed changes

dayaffe approved these changes Jul 24, 2024

View reviewed changes

Sichan Yoo added 2 commits July 25, 2024 09:58

Merge branch 'main' into feat/bearer-token-auth

ef71b5f

Accompanying change for PR comment in smithy-swift.

9a3a87b

sichanyoo merged commit a37a5da into main Jul 25, 2024
29 checks passed

sichanyoo deleted the feat/bearer-token-auth branch July 25, 2024 18:08

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: Bearer token auth #1637

feat: Bearer token auth #1637

sichanyoo commented Jul 17, 2024 •

edited

Loading

sichanyoo left a comment

sichanyoo Jul 17, 2024

sichanyoo Jul 17, 2024

sichanyoo Jul 17, 2024

sichanyoo Jul 17, 2024

sichanyoo Jul 17, 2024

sichanyoo Jul 17, 2024

sichanyoo Jul 17, 2024

sichanyoo Jul 17, 2024

sichanyoo Jul 17, 2024

		@@ -18,8 +18,11 @@ import software.amazon.smithy.swift.codegen.SwiftWriter
		import software.amazon.smithy.swift.codegen.integration.ProtocolGenerator

		@@ -28,16 +28,20 @@ class AuthSchemePlugin(private val serviceConfig: ServiceConfig) : Plugin {
		writer.write("private var authSchemes: \$N", SmithyHTTPAuthAPITypes.AuthSchemes.toOptional())

		@@ -1,7 +1,8 @@
		package software.amazon.smithy.aws.swift.codegen.plugins

		@@ -18,6 +18,7 @@ object AWSSDKIdentityTypes {
		val AWSEndpointsRequestContext = runtimeSymbol("AWSEndpointsRequestContext")

feat: Bearer token auth #1637

feat: Bearer token auth #1637

Conversation

sichanyoo commented Jul 17, 2024 • edited Loading

Issue #

Description of changes

Manual testing steps

New/existing dependencies impact assessment, if applicable

Conventional Commits

sichanyoo left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sichanyoo commented Jul 17, 2024 •

edited

Loading