feat: SSO creds resolver #1958

sichanyoo · 2025-06-17T21:43:38Z

Issue #

2380

Description of changes

Adds SSO creds resolver.
Tested manually.

New/existing dependencies impact assessment, if applicable

Conventional Commits

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

…nerated in AWSSDKIdentity module.

…vice clients used by creds resolvers.

This reverts commit 5794bc3.

…ume role APIs needed for credential resolvers.

…ing & caching logic.

…than one service.

…nstead of STS specific.

…includes internal SSO and SSOOIDC clients.

…e clients. Also, separate InternalAWSSTS into its own target in Package.Base.txt.

…inversion principle (DIP) so that AWSSDKIdentity doesn't directly depend on the internal STS client.

…into auth options returned by auth scheme resolver.

…eme resolver codegen & add codegen for IdentityProvidingSTSClient struct in internal AWS STS target.

…ues from shared config file.

…staged for release.

…ds-resolver

…h scheme resolver as well & update codegen test.

…existence check isn't done at initialization anymore.

sichanyoo

Comments to help reviewers.

sichanyoo · 2025-06-17T22:33:34Z

AWSSDKSwiftCLI/Sources/AWSSDKSwiftCLI/Resources/Package.Base.txt

                .awsSDKHTTPAuth,
                .awsSDKEventStreamsAuth,
                .awsSDKChecksums,
            ],


Adds two new targets: InternalAWSSSO and InternalAWSSSOOIDC. Just like InternalAWSSTS, they are service clients generated for internal use with only the couple operations needed for the SSO credential resolver.

sichanyoo · 2025-06-17T22:34:47Z

...Sources/AWSSDKIdentity/AWSCredentialIdentityResolvers/SSOAWSCredentialIdentityResolver.swift

 // Copyright Amazon.com Inc. or its affiliates.
 // All Rights Reserved.
 //
 // SPDX-License-Identifier: Apache-2.0


Uses SSOBearerTokenIdentityResolver to fetch SSO token and makes request to SSO::getRoleCredentials with it to fetch temporary AWS credentials. The SSO client used here is the internal client, instantiated and passed off to the resolver here from public service clients' auth scheme resolvers.

sichanyoo · 2025-06-17T22:36:32Z

...ity/Sources/AWSSDKIdentity/BearerTokenIdentityResolvers/SSOBearerTokenIdentityResolver.swift

 // SPDX-License-Identifier: Apache-2.0
 //

 import protocol SmithyIdentity.BearerTokenIdentityResolver


SSO token resolver. The SSO token must have been previously created & cached by the user via another tool like AWS CLI. Then, this token resolver reads the cached token and refreshes it if needed.

sichanyoo · 2025-06-17T22:37:37Z

...dentity/Sources/AWSSDKIdentity/IdentityProvidingClients/IdentityProvidingSSOOIDCClient.swift

@@ -0,0 +1,17 @@
+//


The protocol for SSO OIDC client, used for dependency inversion. The concrete struct that conforms to this protocol is code generated at Sources/Core/AWSSDKIdentity/Sources/InternalAWSSSOOIDC/IdentityProvidingSSOOIDCClient.swift.

sichanyoo · 2025-06-17T22:38:46Z

...Core/AWSSDKIdentity/Sources/AWSSDKIdentity/IdentityProvidingClients/InternalClientKeys.swift


 public enum InternalClientKeys {
    /// The STS client to be used in credential resolution.
    public static let internalSTSClientKey = AttributeKey<any IdentityProvidingSTSClient>(


The attribute keys used to save instances of internal SSO / SSO OIDC clients into identityProperties of the auth options returned by auth scheme resolvers generated for each public service.

sichanyoo · 2025-06-17T22:44:00Z

...swift-codegen/src/main/kotlin/software/amazon/smithy/aws/swift/codegen/AWSSwiftDependency.kt

                "0.0.1",
                "aws-sdk-swift",
                "../../../aws-sdk-swift",
                "InternalAWSSTS",


New target info in codegen side.

sichanyoo · 2025-06-17T22:44:40Z

...tware/amazon/smithy/aws/swift/codegen/customization/RulesBasedAuthSchemeResolverGenerator.kt

            }
        }
    }



Below lines add auth option customization for SSO and SSO OIDC to rules based auth scheme resolver as well. Addition of function is just to reduce duplication above.

sichanyoo · 2025-06-17T22:45:33Z

...ft/codegen/customization/credentialresolverservices/IdentityProvidingSSOClientIntegration.kt

@@ -0,0 +1,70 @@
+package software.amazon.smithy.aws.swift.codegen.customization.credentialresolverservices


This integration generates IdentityProvidingSSOClient struct in InternalAWSSSO target. It conforms to IdentityProvidingSSOClient protocol in AWSSDKIdentity target. Allows dependency inversion.

sichanyoo · 2025-06-17T22:45:50Z

...odegen/customization/credentialresolverservices/IdentityProvidingSSOOIDCClientIntegration.kt

@@ -0,0 +1,54 @@
+package software.amazon.smithy.aws.swift.codegen.customization.credentialresolverservices


This integration generates IdentityProvidingSSOOIDCClient struct in InternalAWSSSOOIDC target. It conforms to IdentityProvidingSSOOIDCClient protocol in AWSSDKIdentity target. Allows dependency inversion.

sichanyoo · 2025-06-17T22:46:24Z

...mithy/aws/swift/codegen/customization/credentialresolverservices/InternalModelIntegration.kt

 class InternalModelIntegration : SwiftIntegration {
    private val stsOps =
        listOf(
            "com.amazonaws.sts#AssumeRole",


For internal SSO, we only need the getRoleCredentials API.
For Internal SSO OIDC, we only need createToken API.

jbelkins

I have questions & nit fix requests, please answer/fix and merge

jbelkins · 2025-06-20T21:23:58Z

...Sources/AWSSDKIdentity/AWSCredentialIdentityResolvers/SSOAWSCredentialIdentityResolver.swift

+        let homeDir = FileManager.default.homeDirectoryForCurrentUser
+        #else
+        // On iOS, tvOS, and watchOS, use NSHomeDirectory()
+        let homeDir = URL(fileURLWithPath: NSHomeDirectory(), isDirectory: true)


Does this copy current CRT SSO behavior?

Fetching token from home directory + .aws/sso/cache/<SHA-1-hash-of-startUrl>.json is the behavior defined in SEP for legacy token behavior, so assuming CRT implemented it to match SEP, it should be the same.

jbelkins · 2025-06-20T21:30:55Z

AWSSDKSwiftCLI/Sources/AWSSDKSwiftCLI/Resources/Package.Base.txt

        ),
+        .target(
+            name: "InternalAWSSSO",
+            dependencies: [


Are these internal client dependencies the same list as for a public AWS service client?

Only difference is that public AWS service clients also depend on the internal client targets, but internal client targets don't depend on any other internal clients.

jbelkins · 2025-06-20T21:44:52Z

Sources/Core/AWSSDKIdentity/Sources/InternalAWSSSO/IdentityProvidingSSOClient.swift

+
+package struct IdentityProvidingSSOClient: AWSSDKIdentity.IdentityProvidingSSOClient {
+    package init() {}
+    package func getCredentialsWithSSOToken(region: String, accessToken: String, accountID: String, roleName: String) async throws -> AWSSDKIdentity.AWSCredentialIdentity {


nit: can we get vertical whitespace between methods?

Added writer.write("") (to add vertical white space between methods) to codegen for all IdentityProvidingXYZClient codegen customizations.

jbelkins · 2025-06-20T21:47:29Z

...en/src/main/kotlin/software/amazon/smithy/aws/swift/codegen/AWSHTTPProtocolCustomizations.kt

+                        "$authOptionName.identityProperties.set(key: \$N.internalSSOOIDCClientKey, value: \$N())",
+                        AWSSDKIdentityTypes.InternalClientKeys,
+                        InternalClientTypes.IdentityProvidingSSOOIDCClient,
+                    )


Q: so these clients are created and put into identity properties for every operation on every service (except for the conditions on L71 above)?

answered my own concern: Looks like these IdentityProvidingSSOClient and IdentityProvidingSSOOIDCClient structures don't initialize any clients, etc. until they're used, so the performance/memory penalty from setting these should be effectively zero.

…t structs.

Sichan Yoo added 30 commits June 2, 2025 12:42

Rough draft implementation w/ generated internal STS client.

6795e09

Resolve circular dependency issues with custom internal STS client ge…

34110d2

…nerated in AWSSDKIdentity module.

Changed AWSSDKIdentity dependencies; required for custom internal ser…

d7f7973

…vice clients used by creds resolvers.

Merge main into feat/sts-web-identity-creds-resolver.

5736a0e

Remove throws keyword from STS web identity creds resolver initializer.

d5d1673

Remove unnecessary import.

b38d3fd

Add missing dependency to AWSSDKEventStreamsAuthTests

4cb29a8

Temp release manifest logic change for internal build test

5794bc3

Revert "Temp release manifest logic change for internal build test"

d594231

This reverts commit 5794bc3.

Filter STS client generated in AWSSDKIdentity to contain only the ass…

4e91782

…ume role APIs needed for credential resolvers.

Undo accidental removal.

117fbe2

ktlint

a42d5e0

Delete old FieldResolver.

7fdd73a

Limit visibility of plugins generated for internal use.

42bf26e

Newly generated internal STS with internal access levels for everything.

874db10

Refactor SSOBearerTokenIdentityResolver to be ready for token refresh…

a15f5d1

…ing & caching logic.

Refactor internal service client codegen changes to accommodate more …

3c7b1ec

…than one service.

Swiftlint & ktlint

3403985

Add missing return stmt

2518d6d

Make internal service client relocation during gradle build generic i…

d354c67

…nstead of STS specific.

Fix staging location bug in codegen for internal clients. This comit …

f930815

…includes internal SSO and SSOOIDC clients.

Delete accidentally commited generated endpoint reoslver tests for STS.

fd17646

Complete SSO token provide refactor.

24dcd28

Delete accidentally committed generated endpoint reoslver test

4c102b7

Generic-fy the model preprocessing & build script for internal servic…

2e2fe06

…e clients. Also, separate InternalAWSSTS into its own target in Package.Base.txt.

Make runtime module changes in AWSSDKIdentity, needed for dependency …

e5e0a72

…inversion principle (DIP) so that AWSSDKIdentity doesn't directly depend on the internal STS client.

Add attribute key for internal STS client.

79de694

Add InternalAWSSTS as dependency to service clients.

1d91db1

Codegen changes for constructing & saving IdentityResolvingSTSClient …

11cc78f

…into auth options returned by auth scheme resolver.

Add IdentityProvidingSTSClient construction into rules based auth sch…

8306959

…eme resolver codegen & add codegen for IdentityProvidingSTSClient struct in internal AWS STS target.

Sichan Yoo and others added 18 commits June 13, 2025 12:55

Newly generated internal clients & codegen bug fixes.

60b728c

Fix bug where wrong field was being copied into clientSecret.

56b21e7

Reduce code duplication in SSO cred resolver when fetching config val…

3bfd6ba

…ues from shared config file.

Merge branch 'main' into feat/sts-web-identity-creds-resolver

595c264

Update internal STS client.

7b92ee7

Add generated internal service clients under AWSSDKIdentity as files …

a894abd

…staged for release.

Merge branch 'main' into feat/sts-web-identity-creds-resolver

39ed7d3

Update stage files unit test.

1bb811d

Merge branch 'feat/sts-web-identity-creds-resolver' into feat/sso-cre…

03d3e02

…ds-resolver

Re-codegen internal SSO and SSO OIDC.

edb086b

Merge main into feat/sso-creds-resolver

483f959

ktlint & swiftlint

dec8217

Add codegen for SSO and SSOOIDC internal clients into rules based aut…

a06496b

…h scheme resolver as well & update codegen test.

Remove conflict marker from base package.

16b4628

Remove conflict markers from genreated package manifest.

a29a275

Add missing try keyword to unit test for SSO token provider.

bf2c873

ktlint & remove unit test that tests logic that was removed; profile …

241476b

…existence check isn't done at initialization anymore.

Remove conflict marker in InternalAWSSTS/AuthSchemeResolver.

7c86429

sichanyoo commented Jun 17, 2025

View reviewed changes

sichanyoo requested a review from jbelkins June 17, 2025 22:46

Sichan Yoo added 4 commits June 18, 2025 15:13

Merge branch 'main' into feat/sso-creds-resolver

419e781

Merge branch 'main' into feat/sso-creds-resolver

5821aa2

Add legacy token flow.

f0cdab3

Add missing import

43184a3

jbelkins approved these changes Jun 20, 2025

View reviewed changes

Sichan Yoo and others added 3 commits June 23, 2025 11:03

Add empty line between methods to generated IdentityProvidingXYZClien…

8ec0fc2

…t structs.

Merge branch 'main' into feat/sso-creds-resolver

b304503

Merge branch 'main' into feat/sso-creds-resolver

679f15d

sichanyoo merged commit 891942b into main Jun 23, 2025
41 of 43 checks passed

sichanyoo deleted the feat/sso-creds-resolver branch June 23, 2025 19:45

		@@ -0,0 +1,70 @@
		package software.amazon.smithy.aws.swift.codegen.customization.credentialresolverservices

		@@ -0,0 +1,54 @@
		package software.amazon.smithy.aws.swift.codegen.customization.credentialresolverservices

feat: SSO creds resolver #1958

feat: SSO creds resolver #1958

Conversation

sichanyoo commented Jun 17, 2025

Issue #

Description of changes

New/existing dependencies impact assessment, if applicable

Conventional Commits

Uh oh!

sichanyoo left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jbelkins left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sichanyoo Jun 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sichanyoo Jun 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

sichanyoo Jun 23, 2025 •

edited

Loading

sichanyoo Jun 23, 2025 •

edited

Loading