[DELA-208] Adding delegated token authentication in python client #2860
Conversation
juskeeratanand
changed the title
| :param headers: Header parameters dict to be updated. | ||
| :raises: ApiValueError if delegated token authentication fails | ||
| """ | ||
| from datetime import datetime |
There was a problem hiding this comment.
Thought: Is this necessary, or can it be rolled up into a more global import?
| :return: User agent string | ||
| """ | ||
| import platform |
There was a problem hiding this comment.
Thought: Do we need this import at the function level?
| # Check if we have cached credentials | ||
| if not hasattr(self.configuration, "_delegated_token_credentials"): | ||
| self.configuration._delegated_token_credentials = None |
There was a problem hiding this comment.
| # Check if we have cached credentials | |
| if not hasattr(self.configuration, "_delegated_token_credentials"): | |
| self.configuration._delegated_token_credentials = None |
Looks like this variable is already initialized as None.
| # Delegated token configuration | ||
| self.delegated_token_config = None | ||
|
|
||
| # Load default values from environment |
There was a problem hiding this comment.
Looks like constructors are missing in the config for fields such as delegated_auth_provider and delegated_auth_org_uuid
| config = DelegatedTokenConfig( | ||
| org_uuid=self.configuration.delegated_auth_org_uuid, | ||
| provider="aws", # This could be made configurable | ||
| provider_auth=self.configuration.delegated_auth_provider, | ||
| ) |
There was a problem hiding this comment.
I am not sure how often the token refreshes but we should move this up to class initialization as it seems to be a static config for the most part.
| url = get_delegated_token_url(config) | ||
|
|
||
| # Create REST client | ||
| rest_client = rest.RESTClientObject(config) |
There was a problem hiding this comment.
Can we pass the rest client initialized in the api_client? If not we should initialize this once and store it for future use
4 participants
This PR implements the work done here to add the ability to authenticate against AWS in the python client.
This is done by the client using AWS credentials to sign a request to GetCallerIdentity and then sending that signed proof to Datadog for validation. Read more about this process here. In this PR, we add the proof generation to the datadog client and add the ability to pass that token on subsequent requests.