Update request pipeline to use the AuthSchemeResolver to resolve the identity and signer #3552

muhammad-othman · 2024-11-18T17:22:55Z

Description

Added AuthScheme.Signer() method to retrieve the signer associated with this authentication scheme.
Retrieved identity resolver and signer for the current scheme and attach them to request context in BaseAuthResolverHandler.
Updated BaseAuthResolverHandler to allow children to override the signer.
Added AuthSchemeHandler to the pipeline (limited to S3 and AutoScaling for now).

Motivation and Context

DOTNET-7802

Testing

Ran the unit tests and integration tests for S3 and AutoScaling services.

normj · 2024-11-18T18:22:01Z

sdk/src/Core/Amazon.Runtime/Pipeline/Handlers/BaseAuthResolverHandler.cs

            }
        }

+        protected virtual AbstractAWSSigner GetSigner(IAuthScheme<BaseIdentity> scheme)


Should this return ISigner. AbstractAWSSigner seems tired to a SigV4(a) signer.

All the signers do implement AbstractAWSSigner, and this is the type of executionContext.RequestContext.Signer
so we will have to cast it again anyway.

Changing executionContext.RequestContext.Signer to ISigner wont be very simple since we do depend on signer referencing core internal types that need to be extracted / refactored (e.g. IRequest).

normj · 2024-11-18T18:31:54Z

sdk/src/Core/Amazon.Runtime/Credentials/Internal/AnonymousAuthScheme.cs

+        /// <inheritdoc/>
+        public ISigner Signer()
+        {
+            return new NullSigner();


For each of these schemes should the signer be a member variable so we can reuse the same instance instead of recreating the signer for every request?

Will add a static readonly variable to cache the signer.

normj · 2024-11-18T18:42:12Z

sdk/src/Core/Amazon.Runtime/Pipeline/Handlers/BaseAuthResolverHandler.cs

-                // var identityResolver = scheme.IdentityResolver();
-                // var identity = identityResolver.GetIdentity();
-                // var signer = scheme.Signer();
+                executionContext.RequestContext.Identity = this.Identity;


Doesn't this have the problem that if a service client has some operations that take AWS SigV4 credentials and others that take a token we will always use the identity passed into the constructor for the service client. Should we only use the identity passed into the constructor for the operations that support that type. Otherwise use the resolver.

On that note, if a service does use both SigV4 and Token how do you configure the service client for both?

Yep I did miss that, will rename this.Identity to DefaultAWSCredentials and make sure that we use it for SigV4/SigV4a.

For the other note, we didn't allow the users to provide a Token when creating the client, however the could provide IAWSTokenProvider implementation, which should be respected when implementing SSO, right @dscpinheiro?

Yes, they could provide an implementation for the token provider property.

Although I'm adding (in a separate PR) a default token identity resolver that should always be available. So my understanding is if an operation specifies both token and SigV4 as supported auth schemes we'll be able to resolve them automatically.

@dscpinheiro I mean we should check if the user defined a token provider and use it before using the new default token identity resolver.

@dscpinheiro I mean we should check if the user defined a token provider and use it before using the new default token identity resolver.

Sorry, the second sentence was replying to Norm's question (On that note, if a service does use both SigV4 and Token how do you configure the service client for both?)

sdk/src/Core/Amazon.Runtime/Pipeline/Handlers/BaseAuthResolverHandler.cs

normj · 2024-11-18T18:46:09Z

sdk/src/Core/Amazon.Runtime/Pipeline/Handlers/CredentialsRetriever.cs

-            if (Credentials != null && !(Credentials is AnonymousAWSCredentials))
+            var identity = executionContext.RequestContext.Identity as AWSCredentials;
+
+            if (identity != null && !(identity is AnonymousAWSCredentials))


Wondering if we should update AnonymousAWSCredentials to return null for GetCredentialsAsync so we can avoid having these special cases.

It should be even simpler than that, we can just return null for GetCredentials and GetCredentialsAsync has an implementation in the base class that just uses GetCredentials and we don't need to change that.

Now this made me think that we shouldn't need the BearerTokenSigner special case too that we have above, since the signer cannot be BearerTokenSigner when the Identity is AWSCredentials.

sdk/src/Services/S3/Custom/AmazonS3Client.Extensions.cs

dscpinheiro · 2024-11-19T18:10:21Z

sdk/src/Core/Amazon.Runtime/Pipeline/Handlers/BaseAuthResolverHandler.cs

-                // var identityResolver = scheme.IdentityResolver();
-                // var identity = identityResolver.GetIdentity();
-                // var signer = scheme.Signer();
+                executionContext.RequestContext.Identity = this.Identity;


Yes, they could provide an implementation for the token provider property.

Although I'm adding (in a separate PR) a default token identity resolver that should always be available. So my understanding is if an operation specifies both token and SigV4 as supported auth schemes we'll be able to resolve them automatically.

…identity and signer

Co-authored-by: Daniel Pinheiro <[email protected]>

dscpinheiro · 2024-11-19T20:18:48Z

sdk/src/Core/Amazon.Runtime/Credentials/Internal/AwsV4aAuthScheme.cs

@@ -36,7 +37,9 @@ public IIdentityResolver GetIdentityResolver(IIdentityResolverConfiguration conf
        /// <inheritdoc/>
        public ISigner Signer()
        {
-            return new AWS4aSignerCRTWrapper();
+            if (_signer == null)


Any reason why this one doesn't assign the value where the field is declared? Is it because it'll try to load the CRT dependency?

Yep, which will cause an exception if the user doesn't have the CRT dependency even if this service doesn't need it.
So unless we call this signer we shouldn't create an instance of AWS4aSignerCRTWrapper.

Hm, that makes me think we should update the BaseAuthResolverHandler to also check if the CRT is available when there are multiple auth schemes and one of them is SigV4A (in that case, we should skip SigV4A and try to use one of the other auth schemes).

This can be done in a separate PR; Here's what the endpoints resolver does:

aws-sdk-net/sdk/src/Core/Amazon.Runtime/Pipeline/Handlers/BaseEndpointResolver.cs

Lines 166 to 176 in 816c44e

case "sigv4a":

{

// If there are multiple authentication schemes but the CRT dependency is not available,

// we will proceed to check the next value in authSchemes.

if (hasMultipleSchemes)

{

if (!IsCrtDependencyAvailable())

{

continue;

}

}

…Pipeline

normj

One small comment and then I'm good.

normj · 2024-11-20T23:35:57Z

sdk/src/Core/Amazon.Runtime/Credentials/Internal/AwsV4aAuthScheme.cs

+        public ISigner Signer()
+        {
+            if (_signer == null)
+                _signer = new AWS4aSignerCRTWrapper();


To avoid weird threading issues can we use the Interlock class for this lazy setting.

Interlocked.Exchange(ref _signer, new AWS4aSignerCRTWrapper());

…identity and signer (#3552) * Update request pipeline to use the AuthSchemeResolver to resolve the identity and signer * apply code review comments * Update sdk/src/Services/S3/Custom/AmazonS3Client.Extensions.cs Co-authored-by: Daniel Pinheiro <[email protected]> * Update sdk/src/Services/S3/Custom/AmazonS3Client.Extensions.cs Co-authored-by: Daniel Pinheiro <[email protected]> * update SignerTests * Add IdentityResolverConfiguration to ClientConfigTests.KNOWN_PROPERTIES * Add AuthSchemeHandler to MockElasticTranscoderClient.CustomizeRuntimePipeline * Use Interlocked when creating AwsV4aAuthScheme.Signer --------- Co-authored-by: Daniel Pinheiro <[email protected]>

muhammad-othman requested review from normj and dscpinheiro November 18, 2024 17:22

normj requested changes Nov 18, 2024

View reviewed changes

Base automatically changed from muhamoth/DOTNET-7538-remove-CreateSigner to sra-identity-auth November 19, 2024 15:07

dscpinheiro reviewed Nov 19, 2024

View reviewed changes

muhammad-othman added 2 commits November 19, 2024 13:22

Update request pipeline to use the AuthSchemeResolver to resolve the …

26f166d

…identity and signer

apply code review comments

ff810d1

muhammad-othman force-pushed the muhamoth/DOTNET-7217-sra-update-signer-handler branch from 80f0ae4 to ff810d1 Compare November 19, 2024 18:23

muhammad-othman and others added 2 commits November 19, 2024 13:24

Update sdk/src/Services/S3/Custom/AmazonS3Client.Extensions.cs

df2dce0

Co-authored-by: Daniel Pinheiro <[email protected]>

Update sdk/src/Services/S3/Custom/AmazonS3Client.Extensions.cs

6604c6e

Co-authored-by: Daniel Pinheiro <[email protected]>

muhammad-othman requested a review from normj November 19, 2024 18:34

dscpinheiro reviewed Nov 19, 2024

View reviewed changes

dscpinheiro approved these changes Nov 19, 2024

View reviewed changes

muhammad-othman added 3 commits November 19, 2024 16:48

update SignerTests

51ce46f

Add IdentityResolverConfiguration to ClientConfigTests.KNOWN_PROPERTIES

94a75dd

Add AuthSchemeHandler to MockElasticTranscoderClient.CustomizeRuntime…

aa26ece

…Pipeline

normj requested changes Nov 20, 2024

View reviewed changes

Use Interlocked when creating AwsV4aAuthScheme.Signer

d1bc79a

muhammad-othman requested a review from normj November 21, 2024 01:02

normj approved these changes Nov 21, 2024

View reviewed changes

muhammad-othman merged commit 3da7704 into sra-identity-auth Nov 21, 2024
1 check passed

muhammad-othman deleted the muhamoth/DOTNET-7217-sra-update-signer-handler branch November 21, 2024 16:38

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update request pipeline to use the AuthSchemeResolver to resolve the identity and signer #3552

Update request pipeline to use the AuthSchemeResolver to resolve the identity and signer #3552

muhammad-othman commented Nov 18, 2024

normj Nov 18, 2024

muhammad-othman Nov 18, 2024

normj Nov 18, 2024

muhammad-othman Nov 18, 2024

normj Nov 18, 2024

muhammad-othman Nov 18, 2024

dscpinheiro Nov 19, 2024

muhammad-othman Nov 19, 2024

dscpinheiro Nov 19, 2024

normj Nov 18, 2024

muhammad-othman Nov 18, 2024

dscpinheiro Nov 19, 2024

dscpinheiro Nov 19, 2024

muhammad-othman Nov 19, 2024

dscpinheiro Nov 19, 2024

normj left a comment

normj Nov 20, 2024

muhammad-othman Nov 21, 2024

	case "sigv4a":
	{
	// If there are multiple authentication schemes but the CRT dependency is not available,
	// we will proceed to check the next value in authSchemes.
	if (hasMultipleSchemes)
	{
	if (!IsCrtDependencyAvailable())
	{
	continue;
	}
	}

Update request pipeline to use the AuthSchemeResolver to resolve the identity and signer #3552

Update request pipeline to use the AuthSchemeResolver to resolve the identity and signer #3552

Conversation

muhammad-othman commented Nov 18, 2024

Description

Motivation and Context

Testing

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

normj left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment