1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
|
/**
* Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
* SPDX-License-Identifier: Apache-2.0.
*/
#include <aws/auth/credentials.h>
#include <aws/auth/private/aws_profile.h>
#include <aws/auth/private/credentials_utils.h>
#include <aws/auth/private/sso_token_providers.h>
#include <aws/auth/private/sso_token_utils.h>
#include <aws/common/clock.h>
#ifdef _MSC_VER
/* allow non-constant declared initializers. */
# pragma warning(disable : 4204)
#endif
/*
* sso-token profile provider implementation
*/
struct aws_token_provider_profile_impl {
struct aws_string *sso_token_file_path;
aws_io_clock_fn *system_clock_fn;
};
static int s_token_provider_profile_get_token(
struct aws_credentials_provider *provider,
aws_on_get_credentials_callback_fn callback,
void *user_data) {
struct aws_token_provider_profile_impl *impl = provider->impl;
struct aws_sso_token *sso_token = NULL;
struct aws_credentials *credentials = NULL;
int result = AWS_OP_ERR;
sso_token = aws_sso_token_new_from_file(provider->allocator, impl->sso_token_file_path);
if (!sso_token) {
AWS_LOGF_ERROR(AWS_LS_AUTH_CREDENTIALS_PROVIDER, "(id=%p) failed to get sso token from file", (void *)provider);
goto done;
}
/* check token expiration. */
uint64_t now_ns = UINT64_MAX;
if (impl->system_clock_fn(&now_ns) != AWS_OP_SUCCESS) {
goto done;
}
if (aws_date_time_as_nanos(&sso_token->expiration) <= now_ns) {
AWS_LOGF_ERROR(AWS_LS_AUTH_CREDENTIALS_PROVIDER, "(id=%p) cached sso token is expired.", (void *)provider);
aws_raise_error(AWS_AUTH_SSO_TOKEN_EXPIRED);
goto done;
}
credentials = aws_credentials_new_token(
provider->allocator,
aws_byte_cursor_from_string(sso_token->access_token),
(uint64_t)aws_date_time_as_epoch_secs(&sso_token->expiration));
if (!credentials) {
AWS_LOGF_ERROR(AWS_LS_AUTH_CREDENTIALS_PROVIDER, "(id=%p) Unable to construct credentials.", (void *)provider);
goto done;
}
callback(credentials, AWS_OP_SUCCESS, user_data);
result = AWS_OP_SUCCESS;
done:
aws_sso_token_destroy(sso_token);
aws_credentials_release(credentials);
return result;
}
static void s_token_provider_profile_destroy(struct aws_credentials_provider *provider) {
struct aws_token_provider_profile_impl *impl = provider->impl;
if (impl == NULL) {
return;
}
aws_string_destroy(impl->sso_token_file_path);
aws_credentials_provider_invoke_shutdown_callback(provider);
aws_mem_release(provider->allocator, provider);
}
static struct aws_credentials_provider_vtable s_aws_token_provider_profile_vtable = {
.get_credentials = s_token_provider_profile_get_token,
.destroy = s_token_provider_profile_destroy,
};
AWS_STRING_FROM_LITERAL(s_profile_sso_start_url_name, "sso_start_url");
static struct aws_string *s_construct_profile_sso_token_path(
struct aws_allocator *allocator,
const struct aws_token_provider_sso_profile_options *options) {
struct aws_profile_collection *config_collection = NULL;
struct aws_string *profile_name = NULL;
struct aws_string *sso_token_path = NULL;
profile_name = aws_get_profile_name(allocator, &options->profile_name_override);
if (!profile_name) {
AWS_LOGF_ERROR(AWS_LS_AUTH_CREDENTIALS_PROVIDER, "token-provider-sso-profile: failed to resolve profile name");
aws_raise_error(AWS_AUTH_SSO_TOKEN_PROVIDER_SOURCE_FAILURE);
goto cleanup;
}
if (options->config_file_cached) {
/* Use cached config file */
config_collection = aws_profile_collection_acquire(options->config_file_cached);
} else {
/* load config file */
config_collection = aws_load_profile_collection_from_config_file(allocator, options->config_file_name_override);
}
if (!config_collection) {
AWS_LOGF_ERROR(
AWS_LS_AUTH_CREDENTIALS_PROVIDER,
"token-provider-sso-profile: could not load or parse"
" a config file.");
aws_raise_error(AWS_AUTH_SSO_TOKEN_PROVIDER_SOURCE_FAILURE);
goto cleanup;
}
const struct aws_profile *profile = aws_profile_collection_get_profile(config_collection, profile_name);
if (!profile) {
AWS_LOGF_ERROR(
AWS_LS_AUTH_CREDENTIALS_PROVIDER,
"token-provider-sso-profile: could not load"
" a profile at %s.",
aws_string_c_str(profile_name));
aws_raise_error(AWS_AUTH_SSO_TOKEN_PROVIDER_SOURCE_FAILURE);
goto cleanup;
}
const struct aws_profile_property *sso_start_url_property =
aws_profile_get_property(profile, s_profile_sso_start_url_name);
if (!sso_start_url_property) {
AWS_LOGF_ERROR(AWS_LS_AUTH_CREDENTIALS_PROVIDER, "token-provider-sso-profile: failed to find sso_start_url");
aws_raise_error(AWS_AUTH_SSO_TOKEN_PROVIDER_SOURCE_FAILURE);
goto cleanup;
}
sso_token_path = aws_construct_sso_token_path(allocator, aws_profile_property_get_value(sso_start_url_property));
if (!sso_token_path) {
AWS_LOGF_ERROR(AWS_LS_AUTH_CREDENTIALS_PROVIDER, "token-provider-sso-profile: failed to construct token path");
goto cleanup;
}
cleanup:
aws_string_destroy(profile_name);
aws_profile_collection_release(config_collection);
return sso_token_path;
}
struct aws_credentials_provider *aws_token_provider_new_sso_profile(
struct aws_allocator *allocator,
const struct aws_token_provider_sso_profile_options *options) {
struct aws_string *token_path = s_construct_profile_sso_token_path(allocator, options);
if (!token_path) {
return NULL;
}
struct aws_credentials_provider *provider = NULL;
struct aws_token_provider_profile_impl *impl = NULL;
aws_mem_acquire_many(
allocator,
2,
&provider,
sizeof(struct aws_credentials_provider),
&impl,
sizeof(struct aws_token_provider_profile_impl));
AWS_ZERO_STRUCT(*provider);
AWS_ZERO_STRUCT(*impl);
aws_credentials_provider_init_base(provider, allocator, &s_aws_token_provider_profile_vtable, impl);
impl->sso_token_file_path = aws_string_new_from_string(allocator, token_path);
provider->shutdown_options = options->shutdown_options;
if (options->system_clock_fn) {
impl->system_clock_fn = options->system_clock_fn;
} else {
impl->system_clock_fn = aws_sys_clock_get_ticks;
}
aws_string_destroy(token_path);
return provider;
}
|
