api_op_CreateTokenWithIAM.go (8273B)
1 // Code generated by smithy-go-codegen DO NOT EDIT. 2 3 package ssooidc 4 5 import ( 6 "context" 7 8 "github.com/aws/aws-sdk-go-v2/service/ssooidc/types" 9 "github.com/aws/smithy-go/middleware" 10 ) 11 12 // Creates and returns access and refresh tokens for authorized client 13 // applications that are authenticated using any IAM entity, such as a service role 14 // or user. These tokens might contain defined scopes that specify permissions such 15 // as read:profile or write:data . Through downscoping, you can use the scopes 16 // parameter to request tokens with reduced permissions compared to the original 17 // client application's permissions or, if applicable, the refresh token's scopes. 18 // The access token can be used to fetch short-lived credentials for the assigned 19 // Amazon Web Services accounts or to access application APIs using bearer 20 // authentication. 21 // 22 // This API is used with Signature Version 4. For more information, see [Amazon Web Services Signature Version 4 for API Requests]. 23 // 24 // [Amazon Web Services Signature Version 4 for API Requests]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv.html 25 func (c *Client) CreateTokenWithIAM(ctx context.Context, params *CreateTokenWithIAMInput, optFns ...func(*Options)) (*CreateTokenWithIAMOutput, error) { 26 if params == nil { 27 params = &CreateTokenWithIAMInput{} 28 } 29 30 result, metadata, err := c.invokeOperation(ctx, "CreateTokenWithIAM", params, optFns, c.addOperationCreateTokenWithIAMMiddlewares) 31 if err != nil { 32 return nil, err 33 } 34 35 out := result.(*CreateTokenWithIAMOutput) 36 out.ResultMetadata = metadata 37 return out, nil 38 } 39 40 type CreateTokenWithIAMInput struct { 41 42 // The unique identifier string for the client or application. This value is an 43 // application ARN that has OAuth grants configured. 44 // 45 // This member is required. 46 ClientId *string 47 48 // Supports the following OAuth grant types: Authorization Code, Refresh Token, 49 // JWT Bearer, and Token Exchange. Specify one of the following values, depending 50 // on the grant type that you want: 51 // 52 // * Authorization Code - authorization_code 53 // 54 // * Refresh Token - refresh_token 55 // 56 // * JWT Bearer - urn:ietf:params:oauth:grant-type:jwt-bearer 57 // 58 // * Token Exchange - urn:ietf:params:oauth:grant-type:token-exchange 59 // 60 // This member is required. 61 GrantType *string 62 63 // Used only when calling this API for the JWT Bearer grant type. This value 64 // specifies the JSON Web Token (JWT) issued by a trusted token issuer. To 65 // authorize a trusted token issuer, configure the JWT Bearer GrantOptions for the 66 // application. 67 Assertion *string 68 69 // Used only when calling this API for the Authorization Code grant type. This 70 // short-lived code is used to identify this authorization request. The code is 71 // obtained through a redirect from IAM Identity Center to a redirect URI persisted 72 // in the Authorization Code GrantOptions for the application. 73 Code *string 74 75 // Used only when calling this API for the Authorization Code grant type. This 76 // value is generated by the client and presented to validate the original code 77 // challenge value the client passed at authorization time. 78 CodeVerifier *string 79 80 // Used only when calling this API for the Authorization Code grant type. This 81 // value specifies the location of the client or application that has registered to 82 // receive the authorization code. 83 RedirectUri *string 84 85 // Used only when calling this API for the Refresh Token grant type. This token is 86 // used to refresh short-lived tokens, such as the access token, that might expire. 87 // 88 // For more information about the features and limitations of the current IAM 89 // Identity Center OIDC implementation, see Considerations for Using this Guide in 90 // the [IAM Identity Center OIDC API Reference]. 91 // 92 // [IAM Identity Center OIDC API Reference]: https://docs.aws.amazon.com/singlesignon/latest/OIDCAPIReference/Welcome.html 93 RefreshToken *string 94 95 // Used only when calling this API for the Token Exchange grant type. This value 96 // specifies the type of token that the requester can receive. The following values 97 // are supported: 98 // 99 // * Access Token - urn:ietf:params:oauth:token-type:access_token 100 // 101 // * Refresh Token - urn:ietf:params:oauth:token-type:refresh_token 102 RequestedTokenType *string 103 104 // The list of scopes for which authorization is requested. The access token that 105 // is issued is limited to the scopes that are granted. If the value is not 106 // specified, IAM Identity Center authorizes all scopes configured for the 107 // application, including the following default scopes: openid , aws , 108 // sts:identity_context . 109 Scope []string 110 111 // Used only when calling this API for the Token Exchange grant type. This value 112 // specifies the subject of the exchange. The value of the subject token must be an 113 // access token issued by IAM Identity Center to a different client or application. 114 // The access token must have authorized scopes that indicate the requested 115 // application as a target audience. 116 SubjectToken *string 117 118 // Used only when calling this API for the Token Exchange grant type. This value 119 // specifies the type of token that is passed as the subject of the exchange. The 120 // following value is supported: 121 // 122 // * Access Token - urn:ietf:params:oauth:token-type:access_token 123 SubjectTokenType *string 124 125 noSmithyDocumentSerde 126 } 127 128 type CreateTokenWithIAMOutput struct { 129 130 // A bearer token to access Amazon Web Services accounts and applications assigned 131 // to a user. 132 AccessToken *string 133 134 // A structure containing information from IAM Identity Center managed user and 135 // group information. 136 AwsAdditionalDetails *types.AwsAdditionalDetails 137 138 // Indicates the time in seconds when an access token will expire. 139 ExpiresIn int32 140 141 // A JSON Web Token (JWT) that identifies the user associated with the issued 142 // access token. 143 IdToken *string 144 145 // Indicates the type of tokens that are issued by IAM Identity Center. The 146 // following values are supported: 147 // 148 // * Access Token - urn:ietf:params:oauth:token-type:access_token 149 // 150 // * Refresh Token - urn:ietf:params:oauth:token-type:refresh_token 151 IssuedTokenType *string 152 153 // A token that, if present, can be used to refresh a previously issued access 154 // token that might have expired. 155 // 156 // For more information about the features and limitations of the current IAM 157 // Identity Center OIDC implementation, see Considerations for Using this Guide in 158 // the [IAM Identity Center OIDC API Reference]. 159 // 160 // [IAM Identity Center OIDC API Reference]: https://docs.aws.amazon.com/singlesignon/latest/OIDCAPIReference/Welcome.html 161 RefreshToken *string 162 163 // The list of scopes for which authorization is granted. The access token that is 164 // issued is limited to the scopes that are granted. 165 Scope []string 166 167 // Used to notify the requester that the returned token is an access token. The 168 // supported token type is Bearer . 169 TokenType *string 170 171 // Metadata pertaining to the operation's result. 172 ResultMetadata middleware.Metadata 173 174 noSmithyDocumentSerde 175 } 176 177 func (c *Client) addOperationCreateTokenWithIAMMiddlewares(stack *middleware.Stack, options Options) (err error) { 178 err = stack.Serialize.Add(&awsRestjson1_serializeOpCreateTokenWithIAM{}, middleware.After) 179 if err != nil { 180 return err 181 } 182 err = stack.Deserialize.Add(&awsRestjson1_deserializeOpCreateTokenWithIAM{}, middleware.After) 183 if err != nil { 184 return err 185 } 186 187 if err = addComputeContentLength(stack); err != nil { 188 return err 189 } 190 if err = addResolveEndpointMiddleware(stack, options); err != nil { 191 return err 192 } 193 if err = addComputePayloadSHA256(stack); err != nil { 194 return err 195 } 196 if err = addRecordResponseTiming(stack, options); err != nil { 197 return err 198 } 199 if err = addCredentialSource(stack, options); err != nil { 200 return err 201 } 202 if err = addOpCreateTokenWithIAMValidationMiddleware(stack); err != nil { 203 return err 204 } 205 if err = addRequestIDRetrieverMiddleware(stack); err != nil { 206 return err 207 } 208 if err = addResponseErrorMiddleware(stack); err != nil { 209 return err 210 } 211 if err = addRequestResponseLogging(stack, options); err != nil { 212 return err 213 } 214 if err = addDisableHTTPSMiddleware(stack, options); err != nil { 215 return err 216 } 217 if err = addInterceptors(stack, options); err != nil { 218 return err 219 } 220 return nil 221 }