auth.go (10954B)
1 // Code generated by smithy-go-codegen DO NOT EDIT. 2 3 package sts 4 5 import ( 6 "context" 7 "fmt" 8 "slices" 9 "strings" 10 11 awsmiddleware "github.com/aws/aws-sdk-go-v2/aws/middleware" 12 smithy "github.com/aws/smithy-go" 13 smithyauth "github.com/aws/smithy-go/auth" 14 "github.com/aws/smithy-go/metrics" 15 "github.com/aws/smithy-go/middleware" 16 "github.com/aws/smithy-go/tracing" 17 smithyhttp "github.com/aws/smithy-go/transport/http" 18 ) 19 20 func bindAuthParamsRegion(_ interface{}, params *AuthResolverParameters, _ interface{}, options Options) error { 21 params.Region = options.Region 22 return nil 23 } 24 25 type setLegacyContextSigningOptionsMiddleware struct { 26 } 27 28 func (*setLegacyContextSigningOptionsMiddleware) ID() string { 29 return "setLegacyContextSigningOptions" 30 } 31 32 func (m *setLegacyContextSigningOptionsMiddleware) HandleFinalize(ctx context.Context, in middleware.FinalizeInput, next middleware.FinalizeHandler) ( 33 out middleware.FinalizeOutput, metadata middleware.Metadata, err error, 34 ) { 35 rscheme := getResolvedAuthScheme(ctx) 36 schemeID := rscheme.Scheme.SchemeID() 37 38 if sn := awsmiddleware.GetSigningName(ctx); sn != "" { 39 if schemeID == "aws.auth#sigv4" { 40 smithyhttp.SetSigV4SigningName(&rscheme.SignerProperties, sn) 41 } else if schemeID == "aws.auth#sigv4a" { 42 smithyhttp.SetSigV4ASigningName(&rscheme.SignerProperties, sn) 43 } 44 } 45 46 if sr := awsmiddleware.GetSigningRegion(ctx); sr != "" { 47 if schemeID == "aws.auth#sigv4" { 48 smithyhttp.SetSigV4SigningRegion(&rscheme.SignerProperties, sr) 49 } else if schemeID == "aws.auth#sigv4a" { 50 smithyhttp.SetSigV4ASigningRegions(&rscheme.SignerProperties, []string{sr}) 51 } 52 } 53 54 return next.HandleFinalize(ctx, in) 55 } 56 57 func addSetLegacyContextSigningOptionsMiddleware(stack *middleware.Stack) error { 58 return stack.Finalize.Insert(&setLegacyContextSigningOptionsMiddleware{}, "Signing", middleware.Before) 59 } 60 61 type withAnonymous struct { 62 resolver AuthSchemeResolver 63 } 64 65 var _ AuthSchemeResolver = (*withAnonymous)(nil) 66 67 func (v *withAnonymous) ResolveAuthSchemes(ctx context.Context, params *AuthResolverParameters) ([]*smithyauth.Option, error) { 68 opts, err := v.resolver.ResolveAuthSchemes(ctx, params) 69 if err != nil { 70 return nil, err 71 } 72 73 opts = append(opts, &smithyauth.Option{ 74 SchemeID: smithyauth.SchemeIDAnonymous, 75 }) 76 return opts, nil 77 } 78 79 func wrapWithAnonymousAuth(options *Options) { 80 if _, ok := options.AuthSchemeResolver.(*defaultAuthSchemeResolver); !ok { 81 return 82 } 83 84 options.AuthSchemeResolver = &withAnonymous{ 85 resolver: options.AuthSchemeResolver, 86 } 87 } 88 89 // AuthResolverParameters contains the set of inputs necessary for auth scheme 90 // resolution. 91 type AuthResolverParameters struct { 92 // The name of the operation being invoked. 93 Operation string 94 95 // The region in which the operation is being invoked. 96 Region string 97 } 98 99 func bindAuthResolverParams(ctx context.Context, operation string, input interface{}, options Options) (*AuthResolverParameters, error) { 100 params := &AuthResolverParameters{ 101 Operation: operation, 102 } 103 104 if err := bindAuthParamsRegion(ctx, params, input, options); err != nil { 105 return nil, err 106 } 107 108 return params, nil 109 } 110 111 // AuthSchemeResolver returns a set of possible authentication options for an 112 // operation. 113 type AuthSchemeResolver interface { 114 ResolveAuthSchemes(context.Context, *AuthResolverParameters) ([]*smithyauth.Option, error) 115 } 116 117 type defaultAuthSchemeResolver struct{} 118 119 var _ AuthSchemeResolver = (*defaultAuthSchemeResolver)(nil) 120 121 func (*defaultAuthSchemeResolver) ResolveAuthSchemes(ctx context.Context, params *AuthResolverParameters) ([]*smithyauth.Option, error) { 122 if overrides, ok := operationAuthOptions[params.Operation]; ok { 123 return overrides(params), nil 124 } 125 return serviceAuthOptions(params), nil 126 } 127 128 var operationAuthOptions = map[string]func(*AuthResolverParameters) []*smithyauth.Option{ 129 "AssumeRoleWithSAML": func(params *AuthResolverParameters) []*smithyauth.Option { 130 return []*smithyauth.Option{ 131 {SchemeID: smithyauth.SchemeIDAnonymous}, 132 } 133 }, 134 135 "AssumeRoleWithWebIdentity": func(params *AuthResolverParameters) []*smithyauth.Option { 136 return []*smithyauth.Option{ 137 {SchemeID: smithyauth.SchemeIDAnonymous}, 138 } 139 }, 140 } 141 142 func serviceAuthOptions(params *AuthResolverParameters) []*smithyauth.Option { 143 return []*smithyauth.Option{ 144 { 145 SchemeID: smithyauth.SchemeIDSigV4, 146 SignerProperties: func() smithy.Properties { 147 var props smithy.Properties 148 smithyhttp.SetSigV4SigningName(&props, "sts") 149 smithyhttp.SetSigV4SigningRegion(&props, params.Region) 150 return props 151 }(), 152 }, 153 154 { 155 SchemeID: smithyauth.SchemeIDSigV4A, 156 SignerProperties: func() smithy.Properties { 157 var props smithy.Properties 158 smithyhttp.SetSigV4ASigningName(&props, "sts") 159 smithyhttp.SetSigV4ASigningRegions(&props, []string{params.Region}) 160 return props 161 }(), 162 }, 163 } 164 } 165 166 type resolveAuthSchemeMiddleware struct { 167 operation string 168 options Options 169 } 170 171 func (*resolveAuthSchemeMiddleware) ID() string { 172 return "ResolveAuthScheme" 173 } 174 175 func (m *resolveAuthSchemeMiddleware) HandleFinalize(ctx context.Context, in middleware.FinalizeInput, next middleware.FinalizeHandler) ( 176 out middleware.FinalizeOutput, metadata middleware.Metadata, err error, 177 ) { 178 _, span := tracing.StartSpan(ctx, "ResolveAuthScheme") 179 defer span.End() 180 181 params, err := bindAuthResolverParams(ctx, m.operation, getOperationInput(ctx), m.options) 182 if err != nil { 183 return out, metadata, fmt.Errorf("bind auth scheme params: %w", err) 184 } 185 options, err := m.options.AuthSchemeResolver.ResolveAuthSchemes(ctx, params) 186 if err != nil { 187 return out, metadata, fmt.Errorf("resolve auth scheme: %w", err) 188 } 189 190 scheme, ok := m.selectScheme(options) 191 if !ok { 192 return out, metadata, fmt.Errorf("could not select an auth scheme") 193 } 194 195 ctx = setResolvedAuthScheme(ctx, scheme) 196 197 span.SetProperty("auth.scheme_id", scheme.Scheme.SchemeID()) 198 span.End() 199 return next.HandleFinalize(ctx, in) 200 } 201 202 func (m *resolveAuthSchemeMiddleware) selectScheme(options []*smithyauth.Option) (*resolvedAuthScheme, bool) { 203 sorted := sortAuthOptions(options, m.options.AuthSchemePreference) 204 for _, option := range sorted { 205 if option.SchemeID == smithyauth.SchemeIDAnonymous { 206 return newResolvedAuthScheme(smithyhttp.NewAnonymousScheme(), option), true 207 } 208 209 for _, scheme := range m.options.AuthSchemes { 210 if !matchSchemeID(scheme.SchemeID(), option.SchemeID) { 211 continue 212 } 213 214 if scheme.IdentityResolver(m.options) != nil { 215 return newResolvedAuthScheme(scheme, option), true 216 } 217 } 218 } 219 220 return nil, false 221 } 222 223 func matchSchemeID(registered, option string) bool { 224 if registered == option { 225 return true 226 } 227 if i := strings.LastIndex(registered, "#"); i != -1 { 228 return registered[i+1:] == option 229 } 230 return false 231 } 232 233 func sortAuthOptions(options []*smithyauth.Option, preferred []string) []*smithyauth.Option { 234 byPriority := make([]*smithyauth.Option, 0, len(options)) 235 for _, prefName := range preferred { 236 for _, option := range options { 237 optName := option.SchemeID 238 if parts := strings.Split(option.SchemeID, "#"); len(parts) == 2 { 239 optName = parts[1] 240 } 241 if prefName == optName { 242 byPriority = append(byPriority, option) 243 } 244 } 245 } 246 for _, option := range options { 247 if !slices.ContainsFunc(byPriority, func(o *smithyauth.Option) bool { 248 return o.SchemeID == option.SchemeID 249 }) { 250 byPriority = append(byPriority, option) 251 } 252 } 253 return byPriority 254 } 255 256 type resolvedAuthSchemeKey struct{} 257 258 type resolvedAuthScheme struct { 259 Scheme smithyhttp.AuthScheme 260 IdentityProperties smithy.Properties 261 SignerProperties smithy.Properties 262 } 263 264 func newResolvedAuthScheme(scheme smithyhttp.AuthScheme, option *smithyauth.Option) *resolvedAuthScheme { 265 return &resolvedAuthScheme{ 266 Scheme: scheme, 267 IdentityProperties: option.IdentityProperties, 268 SignerProperties: option.SignerProperties, 269 } 270 } 271 272 func setResolvedAuthScheme(ctx context.Context, scheme *resolvedAuthScheme) context.Context { 273 return middleware.WithStackValue(ctx, resolvedAuthSchemeKey{}, scheme) 274 } 275 276 func getResolvedAuthScheme(ctx context.Context) *resolvedAuthScheme { 277 v, _ := middleware.GetStackValue(ctx, resolvedAuthSchemeKey{}).(*resolvedAuthScheme) 278 return v 279 } 280 281 type getIdentityMiddleware struct { 282 options Options 283 } 284 285 func (*getIdentityMiddleware) ID() string { 286 return "GetIdentity" 287 } 288 289 func (m *getIdentityMiddleware) HandleFinalize(ctx context.Context, in middleware.FinalizeInput, next middleware.FinalizeHandler) ( 290 out middleware.FinalizeOutput, metadata middleware.Metadata, err error, 291 ) { 292 innerCtx, span := tracing.StartSpan(ctx, "GetIdentity") 293 defer span.End() 294 295 rscheme := getResolvedAuthScheme(innerCtx) 296 if rscheme == nil { 297 return out, metadata, fmt.Errorf("no resolved auth scheme") 298 } 299 300 resolver := rscheme.Scheme.IdentityResolver(m.options) 301 if resolver == nil { 302 return out, metadata, fmt.Errorf("no identity resolver") 303 } 304 305 identity, err := timeOperationMetric(ctx, "client.call.resolve_identity_duration", 306 func() (smithyauth.Identity, error) { 307 return resolver.GetIdentity(innerCtx, rscheme.IdentityProperties) 308 }, 309 func(o *metrics.RecordMetricOptions) { 310 o.Properties.Set("auth.scheme_id", rscheme.Scheme.SchemeID()) 311 }) 312 if err != nil { 313 return out, metadata, fmt.Errorf("get identity: %w", err) 314 } 315 316 ctx = setIdentity(ctx, identity) 317 318 span.End() 319 return next.HandleFinalize(ctx, in) 320 } 321 322 type identityKey struct{} 323 324 func setIdentity(ctx context.Context, identity smithyauth.Identity) context.Context { 325 return middleware.WithStackValue(ctx, identityKey{}, identity) 326 } 327 328 func getIdentity(ctx context.Context) smithyauth.Identity { 329 v, _ := middleware.GetStackValue(ctx, identityKey{}).(smithyauth.Identity) 330 return v 331 } 332 333 type signRequestMiddleware struct { 334 options Options 335 } 336 337 func (*signRequestMiddleware) ID() string { 338 return "Signing" 339 } 340 341 func (m *signRequestMiddleware) HandleFinalize(ctx context.Context, in middleware.FinalizeInput, next middleware.FinalizeHandler) ( 342 out middleware.FinalizeOutput, metadata middleware.Metadata, err error, 343 ) { 344 _, span := tracing.StartSpan(ctx, "SignRequest") 345 defer span.End() 346 347 req, ok := in.Request.(*smithyhttp.Request) 348 if !ok { 349 return out, metadata, fmt.Errorf("unexpected transport type %T", in.Request) 350 } 351 352 rscheme := getResolvedAuthScheme(ctx) 353 if rscheme == nil { 354 return out, metadata, fmt.Errorf("no resolved auth scheme") 355 } 356 357 identity := getIdentity(ctx) 358 if identity == nil { 359 return out, metadata, fmt.Errorf("no identity") 360 } 361 362 signer := rscheme.Scheme.Signer() 363 if signer == nil { 364 return out, metadata, fmt.Errorf("no signer") 365 } 366 367 _, err = timeOperationMetric(ctx, "client.call.signing_duration", func() (any, error) { 368 return nil, signer.SignRequest(ctx, req, identity, rscheme.SignerProperties) 369 }, func(o *metrics.RecordMetricOptions) { 370 o.Properties.Set("auth.scheme_id", rscheme.Scheme.SchemeID()) 371 }) 372 if err != nil { 373 return out, metadata, fmt.Errorf("sign request: %w", err) 374 } 375 376 span.End() 377 return next.HandleFinalize(ctx, in) 378 }