This repository has been archived by the owner on Sep 18, 2023. It is now read-only.
Handle ExpiredTokenException correctly and restructure flow paths #150
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This will accomodate all possible MaxSession lengths that AWS could have
This emits clearer and more deterministic exceptions if the AWS STS call fails
* get_id_token was a method that did far more than getting an id token.
This change explodes the functionality in that method into multiple
methods.
* `get_id_token`
* `validate_id_token`
* `get_role_map`
* `exchange_token_for_credentials`
* `print_output`
* Add checking for when AWS responds with ExpiredTokenException and
initiate a new auth flow to fetch a new ID token.
* This would come into play when we have a cached ID token that is
older than the AWS undocumented max ID token validity of 1 day
* This means that listener.py can now initiate a redirect for the user
to start the auth flow over
* This includes a new `state` value called "restart_auth" that triggers
the redirect to the IdP to restart the auth flow
* Break out login path from 2 to 3 paths
* Previously when going through the login method the user would either
* Initiate an IdP auth flow if either the ID token was invalid or
if the ID token was totally valid but the user hadn't asserted a
role_arn
* This meant that each time a user was running the tool and not
passing a role_arn, there was an unnecessary IdP auth flow slowing
things down (if there was a local cached valid ID token)
* Skip the IdP auth flow if the user had both a cached ID token *and*
had passed a role_arn as a command line argument
* Now there are 3 paths
* We have a cached ID token and the role was passed as an argument
* We have a cached ID token but the role passed on the command line
wasn't valid. Show the role picker
* Either the cached ID token was invalid or missing and we need
to get a new one, or the user passed no role_arn on the command
line so we need to spawn the role picker
* Move token and id_token_dict from ephemeral variables into attributes of
the Login class. This allows for persisting these values.
april
reviewed
Dec 3, 2019
april
reviewed
Dec 3, 2019
| logger.error( | ||
| 'AWS STS Call failed {status} {Type} {Code} : {Message}'.format( | ||
| status=resp.status_code, **error)) | ||
| if (error['Code'] == 'ValidationError' |
There was a problem hiding this comment.
Can we just key off of Code == ValidationError? I'm sure it's not a 1:1 mapping, but if it's the only thing in our code that triggers it then it seems fine?
There was a problem hiding this comment.
No, since there are other things that can cause a ValidationError besides this max duration issue. If we did, we could detect other, non-duration-related, validation errors and start our duration backoff which would be wrong.
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Handle ExpiredTokenException correctly and restructure flow paths
This change explodes the functionality in that method into multiple
methods.
get_id_tokenvalidate_id_tokenget_role_mapexchange_token_for_credentialsprint_outputinitiate a new auth flow to fetch a new ID token.
older than the AWS undocumented max ID token validity of 1 day
to start the auth flow over
statevalue called "restart_auth" that triggersthe redirect to the IdP to restart the auth flow
if the ID token was totally valid but the user hadn't asserted a
role_arn
passing a role_arn, there was an unnecessary IdP auth flow slowing
things down (if there was a local cached valid ID token)
had passed a role_arn as a command line argument
wasn't valid. Show the role picker
to get a new one, or the user passed no role_arn on the command
line so we need to spawn the role picker
the Login class. This allows for persisting these values.
Fixes #146
Fixes #141