api_op_IntrospectOAuth2TokenWithIAM.go (5493B)
1 // Code generated by smithy-go-codegen DO NOT EDIT. 2 3 package signin 4 5 import ( 6 "context" 7 8 "github.com/aws/smithy-go/middleware" 9 "github.com/aws/smithy-go/ptr" 10 ) 11 12 // Grants permission to inspect the metadata and state of an OAuth 2.0 access 13 // token or refresh token 14 // 15 // Implements RFC 7662 OAuth 2.0 Token Introspection over a SigV4-authenticated 16 // endpoint. Inspects the metadata of an access_token or refresh_token issued by 17 // AWS Sign-In and returns the claims associated with it. 18 // 19 // Inactive token semantics (RFC 7662 §2.2): when the supplied token is unknown, 20 // expired, revoked, malformed, or owned by a different account, the response body 21 // is exactly { "active": false } with all other claims omitted. 22 func (c *Client) IntrospectOAuth2TokenWithIAM(ctx context.Context, params *IntrospectOAuth2TokenWithIAMInput, optFns ...func(*Options)) (*IntrospectOAuth2TokenWithIAMOutput, error) { 23 if params == nil { 24 params = &IntrospectOAuth2TokenWithIAMInput{} 25 } 26 27 result, metadata, err := c.invokeOperation(ctx, "IntrospectOAuth2TokenWithIAM", params, optFns, c.addOperationIntrospectOAuth2TokenWithIAMMiddlewares) 28 if err != nil { 29 return nil, err 30 } 31 32 out := result.(*IntrospectOAuth2TokenWithIAMOutput) 33 out.ResultMetadata = metadata 34 return out, nil 35 } 36 37 // Input structure for IntrospectOAuth2TokenWithIAM operation 38 // 39 // RFC 7662 §2.1 introspection request. Contains the token to inspect and an 40 // optional hint about the token's type. 41 type IntrospectOAuth2TokenWithIAMInput struct { 42 43 // The string value of the token to introspect. May be either an access_token or a 44 // refresh_token issued by AWS Sign-In. 45 // 46 // This member is required. 47 Token *string 48 49 // Optional hint about the type of the token submitted for introspection. The 50 // server uses this hint to optimize lookup, but still falls back to the other 51 // token type on miss. Allowed values: access_token, refresh_token. 52 TokenTypeHint *string 53 54 noSmithyDocumentSerde 55 } 56 57 func (in *IntrospectOAuth2TokenWithIAMInput) bindEndpointParams(p *EndpointParameters) { 58 59 p.IsOAuthEndpoint = ptr.Bool(true) 60 } 61 62 // Output structure for IntrospectOAuth2TokenWithIAM operation 63 // 64 // RFC 7662 §2.2 introspection response. Only active is required; all other claims 65 // are omitted when the token is inactive. 66 type IntrospectOAuth2TokenWithIAMOutput struct { 67 68 // Indicates whether the token is currently active. true only when the token is 69 // valid, has not expired, has not been revoked, and belongs to the caller's 70 // account. 71 // 72 // This member is required. 73 Active *bool 74 75 // 12-digit AWS account ID of the token's subject principal. 76 AccountId *string 77 78 // Audience of the token: the OAuth resource the token is scoped to (for example, 79 // "aws-mcp.amazonaws.com"). Omitted for refresh tokens. 80 Aud *string 81 82 // Client identifier for the OAuth 2.0 client that requested the token. 83 ClientId *string 84 85 // Token expiration time as a NumericDate (Unix epoch seconds). 86 Exp *int64 87 88 // Token issuance time as a NumericDate (Unix epoch seconds). 89 Iat *int64 90 91 // Issuer of the token. Always "signin.amazonaws.com" for AWS Sign-In. 92 Iss *string 93 94 // Unique identifier for the token. 95 Jti *string 96 97 // Token "not before" time as a NumericDate (Unix epoch seconds). 98 Nbf *int64 99 100 // The OAuth resource the token is scoped to during Human OAuth flow. Only present 101 // for refresh token introspection. 102 Resource *string 103 104 // AWS Sign-In session ARN bound to the token, of the form 105 // arn:aws:signin:{region}:{account}:session/{uuid}. 106 SigninSession *string 107 108 // Subject of the token: the IAM principal ARN. For assumed-role sessions, this is 109 // the session ARN (matches sts:GetCallerIdentity's Arn field), e.g. 110 // arn:aws:sts::123456789012:assumed-role/MyRole/session-name. 111 Sub *string 112 113 // Indicates which kind of token was introspected. One of "access_token" or 114 // "refresh_token". 115 TokenType *string 116 117 // User identifier matching sts:GetCallerIdentity's UserId field for the token's 118 // subject principal (e.g. "AIDAEXAMPLE" for an IAM user, or 119 // "AROAEXAMPLE:session-name" for an assumed role). 120 UserId *string 121 122 // Metadata pertaining to the operation's result. 123 ResultMetadata middleware.Metadata 124 125 noSmithyDocumentSerde 126 } 127 128 func (c *Client) addOperationIntrospectOAuth2TokenWithIAMMiddlewares(stack *middleware.Stack, options Options) (err error) { 129 err = stack.Serialize.Add(&awsRestjson1_serializeOpIntrospectOAuth2TokenWithIAM{}, middleware.After) 130 if err != nil { 131 return err 132 } 133 err = stack.Deserialize.Add(&awsRestjson1_deserializeOpIntrospectOAuth2TokenWithIAM{}, middleware.After) 134 if err != nil { 135 return err 136 } 137 138 if err = addComputeContentLength(stack); err != nil { 139 return err 140 } 141 if err = addResolveEndpointMiddleware(stack, options); err != nil { 142 return err 143 } 144 if err = addComputePayloadSHA256(stack); err != nil { 145 return err 146 } 147 if err = addRecordResponseTiming(stack, options); err != nil { 148 return err 149 } 150 if err = addCredentialSource(stack, options); err != nil { 151 return err 152 } 153 if err = addOpIntrospectOAuth2TokenWithIAMValidationMiddleware(stack); err != nil { 154 return err 155 } 156 if err = addRequestIDRetrieverMiddleware(stack); err != nil { 157 return err 158 } 159 if err = addResponseErrorMiddleware(stack); err != nil { 160 return err 161 } 162 if err = addRequestResponseLogging(stack, options); err != nil { 163 return err 164 } 165 if err = addDisableHTTPSMiddleware(stack, options); err != nil { 166 return err 167 } 168 if err = addInterceptors(stack, options); err != nil { 169 return err 170 } 171 return nil 172 }