Skip to content
Merged
Show file tree
Hide file tree
Changes from 12 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Original file line number Diff line number Diff line change
Expand Up @@ -363,9 +363,11 @@ protected MethodSpec.Builder operationBody(MethodSpec.Builder builder, Operation
builder.beginControlFlow("if (endpointDiscoveryEnabled)");

builder.addCode("$T key = $N.overrideConfiguration()", String.class, opModel.getInput().getVariableName())
.addCode(" .flatMap($T::credentialsProvider)", AwsRequestOverrideConfiguration.class)
.addCode(" .orElseGet(() -> clientConfiguration.option($T.CREDENTIALS_PROVIDER))", AwsClientOption.class)
.addCode(" .resolveCredentials().accessKeyId();");
.addCode(" .flatMap($T::credentialsIdentityProvider)", AwsRequestOverrideConfiguration.class)
.addCode(" .orElseGet(() -> clientConfiguration.option($T.CREDENTIALS_IDENTITY_PROVIDER))",
AwsClientOption.class)
// TODO: avoid join inside async
.addCode(" .resolveIdentity().join().accessKeyId();");

builder.addCode("$1T endpointDiscoveryRequest = $1T.builder()", EndpointDiscoveryRequest.class)
.addCode(" .required($L)", opModel.getInputShape().getEndpointDiscovery().isRequired())
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -244,9 +244,10 @@ private List<MethodSpec> operationMethodSpecs(OperationModel opModel) {
method.beginControlFlow("if (endpointDiscoveryEnabled)");

method.addCode("$T key = $N.overrideConfiguration()", String.class, opModel.getInput().getVariableName())
.addCode(" .flatMap($T::credentialsProvider)", AwsRequestOverrideConfiguration.class)
.addCode(" .orElseGet(() -> clientConfiguration.option($T.CREDENTIALS_PROVIDER))", AwsClientOption.class)
.addCode(" .resolveCredentials().accessKeyId();");
.addCode(" .flatMap($T::credentialsIdentityProvider)", AwsRequestOverrideConfiguration.class)
.addCode(" .orElseGet(() -> clientConfiguration.option($T.CREDENTIALS_IDENTITY_PROVIDER))",
AwsClientOption.class)
.addCode(" .resolveIdentity().join().accessKeyId();");

method.addCode("$1T endpointDiscoveryRequest = $1T.builder()", EndpointDiscoveryRequest.class)
.addCode(" .required($L)", opModel.getInputShape().getEndpointDiscovery().isRequired())
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -174,9 +174,9 @@ public CompletableFuture<TestDiscoveryIdentifiersRequiredResponse> testDiscovery
URI cachedEndpoint = null;
if (endpointDiscoveryEnabled) {
String key = testDiscoveryIdentifiersRequiredRequest.overrideConfiguration()
.flatMap(AwsRequestOverrideConfiguration::credentialsProvider)
.orElseGet(() -> clientConfiguration.option(AwsClientOption.CREDENTIALS_PROVIDER)).resolveCredentials()
.accessKeyId();
.flatMap(AwsRequestOverrideConfiguration::credentialsIdentityProvider)
.orElseGet(() -> clientConfiguration.option(AwsClientOption.CREDENTIALS_IDENTITY_PROVIDER))
.resolveIdentity().join().accessKeyId();
Comment thread
gosar marked this conversation as resolved.
EndpointDiscoveryRequest endpointDiscoveryRequest = EndpointDiscoveryRequest.builder().required(true)
.defaultEndpoint(clientConfiguration.option(SdkClientOption.ENDPOINT))
.overrideConfiguration(testDiscoveryIdentifiersRequiredRequest.overrideConfiguration().orElse(null))
Expand Down Expand Up @@ -242,9 +242,9 @@ public CompletableFuture<TestDiscoveryOptionalResponse> testDiscoveryOptional(
URI cachedEndpoint = null;
if (endpointDiscoveryEnabled) {
String key = testDiscoveryOptionalRequest.overrideConfiguration()
.flatMap(AwsRequestOverrideConfiguration::credentialsProvider)
.orElseGet(() -> clientConfiguration.option(AwsClientOption.CREDENTIALS_PROVIDER)).resolveCredentials()
.accessKeyId();
.flatMap(AwsRequestOverrideConfiguration::credentialsIdentityProvider)
.orElseGet(() -> clientConfiguration.option(AwsClientOption.CREDENTIALS_IDENTITY_PROVIDER))
.resolveIdentity().join().accessKeyId();
EndpointDiscoveryRequest endpointDiscoveryRequest = EndpointDiscoveryRequest.builder().required(false)
.defaultEndpoint(clientConfiguration.option(SdkClientOption.ENDPOINT))
.overrideConfiguration(testDiscoveryOptionalRequest.overrideConfiguration().orElse(null)).build();
Expand Down Expand Up @@ -317,9 +317,9 @@ public CompletableFuture<TestDiscoveryRequiredResponse> testDiscoveryRequired(
URI cachedEndpoint = null;
if (endpointDiscoveryEnabled) {
String key = testDiscoveryRequiredRequest.overrideConfiguration()
.flatMap(AwsRequestOverrideConfiguration::credentialsProvider)
.orElseGet(() -> clientConfiguration.option(AwsClientOption.CREDENTIALS_PROVIDER)).resolveCredentials()
.accessKeyId();
.flatMap(AwsRequestOverrideConfiguration::credentialsIdentityProvider)
.orElseGet(() -> clientConfiguration.option(AwsClientOption.CREDENTIALS_IDENTITY_PROVIDER))
.resolveIdentity().join().accessKeyId();
EndpointDiscoveryRequest endpointDiscoveryRequest = EndpointDiscoveryRequest.builder().required(true)
.defaultEndpoint(clientConfiguration.option(SdkClientOption.ENDPOINT))
.overrideConfiguration(testDiscoveryRequiredRequest.overrideConfiguration().orElse(null)).build();
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -151,9 +151,9 @@ public TestDiscoveryIdentifiersRequiredResponse testDiscoveryIdentifiersRequired
URI cachedEndpoint = null;
if (endpointDiscoveryEnabled) {
String key = testDiscoveryIdentifiersRequiredRequest.overrideConfiguration()
.flatMap(AwsRequestOverrideConfiguration::credentialsProvider)
.orElseGet(() -> clientConfiguration.option(AwsClientOption.CREDENTIALS_PROVIDER)).resolveCredentials()
.accessKeyId();
.flatMap(AwsRequestOverrideConfiguration::credentialsIdentityProvider)
.orElseGet(() -> clientConfiguration.option(AwsClientOption.CREDENTIALS_IDENTITY_PROVIDER))
.resolveIdentity().join().accessKeyId();
EndpointDiscoveryRequest endpointDiscoveryRequest = EndpointDiscoveryRequest.builder().required(true)
.defaultEndpoint(clientConfiguration.option(SdkClientOption.ENDPOINT))
.overrideConfiguration(testDiscoveryIdentifiersRequiredRequest.overrideConfiguration().orElse(null)).build();
Expand Down Expand Up @@ -208,9 +208,9 @@ public TestDiscoveryOptionalResponse testDiscoveryOptional(TestDiscoveryOptional
URI cachedEndpoint = null;
if (endpointDiscoveryEnabled) {
String key = testDiscoveryOptionalRequest.overrideConfiguration()
.flatMap(AwsRequestOverrideConfiguration::credentialsProvider)
.orElseGet(() -> clientConfiguration.option(AwsClientOption.CREDENTIALS_PROVIDER)).resolveCredentials()
.accessKeyId();
.flatMap(AwsRequestOverrideConfiguration::credentialsIdentityProvider)
.orElseGet(() -> clientConfiguration.option(AwsClientOption.CREDENTIALS_IDENTITY_PROVIDER))
.resolveIdentity().join().accessKeyId();
EndpointDiscoveryRequest endpointDiscoveryRequest = EndpointDiscoveryRequest.builder().required(false)
.defaultEndpoint(clientConfiguration.option(SdkClientOption.ENDPOINT))
.overrideConfiguration(testDiscoveryOptionalRequest.overrideConfiguration().orElse(null)).build();
Expand Down Expand Up @@ -272,9 +272,9 @@ public TestDiscoveryRequiredResponse testDiscoveryRequired(TestDiscoveryRequired
URI cachedEndpoint = null;
if (endpointDiscoveryEnabled) {
String key = testDiscoveryRequiredRequest.overrideConfiguration()
.flatMap(AwsRequestOverrideConfiguration::credentialsProvider)
.orElseGet(() -> clientConfiguration.option(AwsClientOption.CREDENTIALS_PROVIDER)).resolveCredentials()
.accessKeyId();
.flatMap(AwsRequestOverrideConfiguration::credentialsIdentityProvider)
.orElseGet(() -> clientConfiguration.option(AwsClientOption.CREDENTIALS_IDENTITY_PROVIDER))
.resolveIdentity().join().accessKeyId();
EndpointDiscoveryRequest endpointDiscoveryRequest = EndpointDiscoveryRequest.builder().required(true)
.defaultEndpoint(clientConfiguration.option(SdkClientOption.ENDPOINT))
.overrideConfiguration(testDiscoveryRequiredRequest.overrideConfiguration().orElse(null)).build();
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -45,6 +45,7 @@
* <p>This chain implements {@link AutoCloseable}. When closed, it will call the {@link AutoCloseable#close()} on any credential
* providers in the chain that need to be closed.</p>
*/
// TODO: deprecate with new IdentityProvider chain in identity-spi
Comment thread
gosar marked this conversation as resolved.
Outdated
@SdkPublicApi
public final class AwsCredentialsProviderChain
implements AwsCredentialsProvider,
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,9 @@
package software.amazon.awssdk.auth.credentials;

import software.amazon.awssdk.annotations.SdkProtectedApi;
import software.amazon.awssdk.identity.spi.AwsCredentialsIdentity;
import software.amazon.awssdk.identity.spi.AwsSessionCredentialsIdentity;
import software.amazon.awssdk.identity.spi.IdentityProvider;

@SdkProtectedApi
public final class CredentialUtils {
Expand All @@ -28,6 +31,72 @@ private CredentialUtils() {
* authenticate themselves.
*/
public static boolean isAnonymous(AwsCredentials credentials) {
return isAnonymous((AwsCredentialsIdentity) credentials);
}

/**
* Determine whether the provided credentials are anonymous credentials, indicating that the customer is not attempting to
* authenticate themselves.
*/
public static boolean isAnonymous(AwsCredentialsIdentity credentials) {
return credentials.secretAccessKey() == null && credentials.accessKeyId() == null;
}
Comment thread
gosar marked this conversation as resolved.

/**
* Converts an {@link AwsCredentialsIdentity} to {@link AwsCredentials}.
*
* <p>Usage of the new AwsCredentialsIdentity type is preferred over AwsCredentials. But some places may need to still
* convert to the older AwsCredentials type to work with existing code.</p>
*
* <p>The conversion is only aware of {@link AwsCredentialsIdentity} and {@link AwsSessionCredentialsIdentity} types. If the
* input is another sub-type that has other properties, they are not carried over. i.e.,
* <ul>
* <li>AwsSessionCredentialsIdentity -> AwsSessionCredentials</li>
* <li>AwsCredentialsIdentity -> AwsBasicCredentials</li>
* </ul>
* </p>
*
* @param awsCredentialsIdentity The {@link AwsCredentialsIdentity} to convert
* @return The corresponding {@link AwsCredentials}
*/
public static AwsCredentials toCredentials(AwsCredentialsIdentity awsCredentialsIdentity) {
if (awsCredentialsIdentity == null) {
return null;
}
// identity-spi defines 2 known types - AwsCredentialsIdentity and a sub-type AwsSessionCredentialsIdentity
if (awsCredentialsIdentity instanceof AwsSessionCredentialsIdentity) {
AwsSessionCredentialsIdentity awsSessionCredentialsIdentity = (AwsSessionCredentialsIdentity) awsCredentialsIdentity;
return AwsSessionCredentials.create(awsSessionCredentialsIdentity.accessKeyId(),
awsSessionCredentialsIdentity.secretAccessKey(),
awsSessionCredentialsIdentity.sessionToken());
}
if (isAnonymous(awsCredentialsIdentity)) {
return AwsBasicCredentials.ANONYMOUS_CREDENTIALS;
}
return AwsBasicCredentials.create(awsCredentialsIdentity.accessKeyId(),
awsCredentialsIdentity.secretAccessKey());
Comment thread
gosar marked this conversation as resolved.
}

/**
* Converts an {@link IdentityProvider<? extends AwsCredentialsIdentity>} to {@link AwsCredentialsProvider} based on
* {@link #toCredentials(AwsCredentialsIdentity)}.
*
* <p>Usage of the new IdentityProvider type is preferred over AwsCredentialsProvider. But some places may need to still
* convert to the older AwsCredentialsProvider type to work with existing code.
* </p>
*
* @param identityProvider The {@link IdentityProvider<? extends AwsCredentialsIdentity>} to convert
* @return The corresponding {@link AwsCredentialsProvider}
*/
public static AwsCredentialsProvider toCredentialsProvider(
IdentityProvider<? extends AwsCredentialsIdentity> identityProvider) {
if (identityProvider == null) {
return null;
}
return () -> {
// TODO: Exception handling for CompletionException thrown from join?
AwsCredentialsIdentity awsCredentialsIdentity = identityProvider.resolveIdentity().join();
return toCredentials(awsCredentialsIdentity);
};
}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,115 @@
/*
* Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
*
* Licensed under the Apache License, Version 2.0 (the "License").
* You may not use this file except in compliance with the License.
* A copy of the License is located at
*
* http://aws.amazon.com/apache2.0
*
* or in the "license" file accompanying this file. This file is distributed
* on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
* express or implied. See the License for the specific language governing
* permissions and limitations under the License.
*/

package software.amazon.awssdk.auth.credentials;

import static org.assertj.core.api.Assertions.assertThat;

import org.junit.jupiter.api.Test;
import software.amazon.awssdk.identity.spi.AwsCredentialsIdentity;
import software.amazon.awssdk.identity.spi.AwsSessionCredentialsIdentity;

public class CredentialUtilsTest {

@Test
public void isAnonymous_AwsCredentials_true() {
assertThat(CredentialUtils.isAnonymous(AwsBasicCredentials.ANONYMOUS_CREDENTIALS)).isTrue();
}

@Test
public void isAnonymous_AwsCredentials_false() {
assertThat(CredentialUtils.isAnonymous(AwsBasicCredentials.create("akid", "skid"))).isFalse();
}

@Test
public void isAnonymous_AwsCredentialsIdentity_true() {
assertThat(CredentialUtils.isAnonymous((AwsCredentialsIdentity) AwsBasicCredentials.ANONYMOUS_CREDENTIALS)).isTrue();
}

@Test
public void isAnonymous_AwsCredentialsIdentity_false() {
assertThat(CredentialUtils.isAnonymous((AwsCredentialsIdentity) AwsBasicCredentials.create("akid", "skid"))).isFalse();
}

@Test
public void toCredentials_null_returnsNull() {
assertThat(CredentialUtils.toCredentials(null)).isNull();
}

@Test
public void toCredentials_AwsSessionCredentialsIdentity_returnsAwsSessionCredentials() {
AwsCredentials awsCredentials = CredentialUtils.toCredentials(new AwsSessionCredentialsIdentity() {
@Override
public String accessKeyId() {
return "akid";
}

@Override
public String secretAccessKey() {
return "skid";
}

@Override
public String sessionToken() {
return "session";
}
});

assertThat(awsCredentials).isInstanceOf(AwsSessionCredentials.class);
AwsSessionCredentials awsSessionCredentials = (AwsSessionCredentials) awsCredentials;
assertThat(awsSessionCredentials.accessKeyId()).isEqualTo("akid");
assertThat(awsSessionCredentials.secretAccessKey()).isEqualTo("skid");
assertThat(awsSessionCredentials.sessionToken()).isEqualTo("session");
}

@Test
public void toCredentials_AwsCredentialsIdentity_returnsAwsCredentials() {
AwsCredentials awsCredentials = CredentialUtils.toCredentials(new AwsCredentialsIdentity() {
@Override
public String accessKeyId() {
return "akid";
}

@Override
public String secretAccessKey() {
return "skid";
}
});

assertThat(awsCredentials.accessKeyId()).isEqualTo("akid");
assertThat(awsCredentials.secretAccessKey()).isEqualTo("skid");
}

@Test
public void toCredentials_Anonymous_returnsAnonymous() {
AwsCredentials awsCredentials = CredentialUtils.toCredentials(AwsBasicCredentials.ANONYMOUS_CREDENTIALS);
assertThat(awsCredentials.accessKeyId()).isNull();
assertThat(awsCredentials.secretAccessKey()).isNull();
}

@Test
public void toCredentialsProvider_null_returnsNull() {
assertThat(CredentialUtils.toCredentialsProvider(null)).isNull();
}

@Test
public void toCredentialsProvider_IdentityProvider_converts() {
AwsCredentialsProvider credentialsProvider = CredentialUtils.toCredentialsProvider(
StaticCredentialsProvider.create(AwsBasicCredentials.create("akid", "skid")));
AwsCredentials credentials = credentialsProvider.resolveCredentials();
assertThat(credentials.accessKeyId()).isEqualTo("akid");
assertThat(credentials.secretAccessKey()).isEqualTo("skid");
}
}
Loading