Skip to content

Commit e488ba6

Browse files
pandheradavidh44
pandhera
authored and
davidh44
committed
Add IAM Token Generation Utility for AxdbFrontend
1 parent ff7139a commit e488ba6

File tree

6 files changed

+794
-0
lines changed

6 files changed

+794
-0
lines changed

‎docs/LaunchChangelog.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -453,6 +453,10 @@ The S3 client in 2.0 is drastically different from the client in 1.11, because i
453453

454454
1. The class`RdsIamAuthTokenGenerator` has been replaced with `RdsUtilities#generateAuthenticationToken`.
455455

456+
## 4.5. Axdbfrontend Changes
457+
458+
1. The class `AxdbfrontendUtilities#generateAuthenticationToken` can now be used to generate an Authentication token to connect to a Xanadu database.
459+
456460
# 5. Profile File Changes
457461

458462
The parsing of the `~/.aws/config` and `~/.aws/credentials` has changed to more closely emulate that used by the AWS CLI.

‎services/axdbfrontend/src/main/java/software/amazon/awssdk/services/axdbfrontend/AxdbFrontendUtilities.java

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
/*
2+
* Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License").
5+
* You may not use this file except in compliance with the License.
6+
* A copy of the License is located at
7+
*
8+
* http://aws.amazon.com/apache2.0
9+
*
10+
* or in the "license" file accompanying this file. This file is distributed
11+
* on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
12+
* express or implied. See the License for the specific language governing
13+
* permissions and limitations under the License.
14+
*/
15+
16+
package software.amazon.awssdk.services.axdbfrontend;
17+
18+
import java.util.function.Consumer;
19+
import software.amazon.awssdk.annotations.SdkPublicApi;
20+
import software.amazon.awssdk.auth.credentials.AwsCredentialsProvider;
21+
import software.amazon.awssdk.identity.spi.AwsCredentialsIdentity;
22+
import software.amazon.awssdk.identity.spi.IdentityProvider;
23+
import software.amazon.awssdk.regions.Region;
24+
import software.amazon.awssdk.services.axdbfrontend.model.GenerateAuthenticationTokenRequest;
25+
26+
/**
27+
* Utilities for working with AxdbFrontend. An instance of this class can be created by:
28+
* <p>
29+
* 1) Using the low-level client {@link AxdbFrontendClient#utilities()} (or {@link AxdbFrontendAsyncClient#utilities()}} method.
30+
* This is
31+
* recommended as SDK will use the same configuration from the {@link AxdbFrontendClient} object to create the
32+
* {@link AxdbFrontendUtilities}
33+
* object.
34+
*
35+
* <pre>
36+
* AxdbFrontendClient AxdbFrontendClient = AxdbFrontendClient.create();
37+
* AxdbFrontendUtilities utilities = AxdbFrontendClient.utilities();
38+
* </pre>
39+
* </p>
40+
*
41+
* <p>
42+
* 2) Directly using the {@link #builder()} method.
43+
*
44+
* <pre>
45+
* AxdbFrontendUtilities utilities = AxdbFrontendUtilities.builder()
46+
* .credentialsProvider(DefaultCredentialsProvider.create())
47+
* .region(Region.US_WEST_2)
48+
* .build()
49+
* </pre>
50+
* </p>
51+
*
52+
* Note: This class does not make network calls.
53+
*/
54+
@SdkPublicApi
55+
public interface AxdbFrontendUtilities {
56+
/**
57+
* Create a builder that can be used to configure and create a {@link AxdbFrontendUtilities}.
58+
*/
59+
static Builder builder() {
60+
return new DefaultAxdbFrontendUtilities.DefaultBuilder();
61+
}
62+
63+
/**
64+
* Generates an authentication token for IAM authentication to a Xanadu database.
65+
*
66+
* @param request The request used to generate the authentication token
67+
* @return String to use as the AxdbFrontend authentication token
68+
* @throws IllegalArgumentException if the required parameters are not valid
69+
*/
70+
default String generateAuthenticationToken(Consumer<GenerateAuthenticationTokenRequest.Builder> request) {
71+
return generateAuthenticationToken(GenerateAuthenticationTokenRequest.builder().applyMutation(request).build());
72+
}
73+
74+
/**
75+
* Generates an authentication token for IAM authentication to an Xanadu database.
76+
*
77+
* @param request The request used to generate the authentication token
78+
* @return String to use as the AxdbFrontend authentication token
79+
* @throws IllegalArgumentException if the required parameters are not valid
80+
*/
81+
default String generateAuthenticationToken(GenerateAuthenticationTokenRequest request) {
82+
throw new UnsupportedOperationException();
83+
}
84+
85+
/**
86+
* Builder for creating an instance of {@link AxdbFrontendUtilities}. It can be configured using
87+
* {@link AxdbFrontendUtilities#builder()}.
88+
* Once configured, the {@link AxdbFrontendUtilities} can created using {@link #build()}.
89+
*/
90+
@SdkPublicApi
91+
interface Builder {
92+
/**
93+
* The default region to use when working with the methods in {@link AxdbFrontendUtilities} class.
94+
*
95+
* @return This object for method chaining
96+
*/
97+
Builder region(Region region);
98+
99+
/**
100+
* The default credentials provider to use when working with the methods in {@link AxdbFrontendUtilities} class.
101+
*
102+
* @return This object for method chaining
103+
*/
104+
default Builder credentialsProvider(AwsCredentialsProvider credentialsProvider) {
105+
return credentialsProvider((IdentityProvider<? extends AwsCredentialsIdentity>) credentialsProvider);
106+
}
107+
108+
/**
109+
* The default credentials provider to use when working with the methods in {@link AxdbFrontendUtilities} class.
110+
*
111+
* @return This object for method chaining
112+
*/
113+
default Builder credentialsProvider(IdentityProvider<? extends AwsCredentialsIdentity> credentialsProvider) {
114+
throw new UnsupportedOperationException();
115+
}
116+
117+
/**
118+
* Create a {@link AxdbFrontendUtilities}
119+
*/
120+
AxdbFrontendUtilities build();
121+
}
122+
}

‎services/axdbfrontend/src/main/java/software/amazon/awssdk/services/axdbfrontend/DefaultAxdbFrontendUtilities.java

Lines changed: 157 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,157 @@
1+
/*
2+
* Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License").
5+
* You may not use this file except in compliance with the License.
6+
* A copy of the License is located at
7+
*
8+
* http://aws.amazon.com/apache2.0
9+
*
10+
* or in the "license" file accompanying this file. This file is distributed
11+
* on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
12+
* express or implied. See the License for the specific language governing
13+
* permissions and limitations under the License.
14+
*/
15+
16+
package software.amazon.awssdk.services.axdbfrontend;
17+
18+
import java.time.Clock;
19+
import java.time.Instant;
20+
import software.amazon.awssdk.annotations.Immutable;
21+
import software.amazon.awssdk.annotations.SdkInternalApi;
22+
import software.amazon.awssdk.auth.credentials.AwsCredentials;
23+
import software.amazon.awssdk.auth.credentials.CredentialUtils;
24+
import software.amazon.awssdk.auth.signer.Aws4Signer;
25+
import software.amazon.awssdk.auth.signer.params.Aws4PresignerParams;
26+
import software.amazon.awssdk.awscore.client.config.AwsClientOption;
27+
import software.amazon.awssdk.core.client.config.SdkClientConfiguration;
28+
import software.amazon.awssdk.http.SdkHttpFullRequest;
29+
import software.amazon.awssdk.http.SdkHttpMethod;
30+
import software.amazon.awssdk.identity.spi.AwsCredentialsIdentity;
31+
import software.amazon.awssdk.identity.spi.IdentityProvider;
32+
import software.amazon.awssdk.regions.Region;
33+
import software.amazon.awssdk.services.axdbfrontend.model.GenerateAuthenticationTokenRequest;
34+
import software.amazon.awssdk.utils.CompletableFutureUtils;
35+
import software.amazon.awssdk.utils.Logger;
36+
import software.amazon.awssdk.utils.StringUtils;
37+
38+
@Immutable
39+
@SdkInternalApi
40+
final class DefaultAxdbFrontendUtilities implements AxdbFrontendUtilities {
41+
private static final Logger log = Logger.loggerFor(AxdbFrontendUtilities.class);
42+
private final Aws4Signer signer = Aws4Signer.create();
43+
private final Region region;
44+
private final IdentityProvider<? extends AwsCredentialsIdentity> credentialsProvider;
45+
private final Clock clock;
46+
47+
DefaultAxdbFrontendUtilities(DefaultBuilder builder) {
48+
this(builder, Clock.systemUTC());
49+
}
50+
51+
/**
52+
* For testing purposes only
53+
*/
54+
DefaultAxdbFrontendUtilities(DefaultBuilder builder, Clock clock) {
55+
this.credentialsProvider = builder.credentialsProvider;
56+
this.region = builder.region;
57+
this.clock = clock;
58+
}
59+
60+
/**
61+
* Used by AxdbFrontend low-level client's utilities() method
62+
*/
63+
@SdkInternalApi
64+
static AxdbFrontendUtilities create(SdkClientConfiguration clientConfiguration) {
65+
return new DefaultBuilder().clientConfiguration(clientConfiguration).build();
66+
}
67+
68+
@Override
69+
public String generateAuthenticationToken(GenerateAuthenticationTokenRequest request) {
70+
SdkHttpFullRequest httpRequest = SdkHttpFullRequest.builder()
71+
.method(SdkHttpMethod.GET)
72+
.protocol("https")
73+
.host(request.hostname())
74+
.encodedPath("/")
75+
.putRawQueryParameter("Action", request.action().name())
76+
.build();
77+
78+
Instant expirationTime = Instant.now(clock).plus(request.expiresIn());
79+
80+
Aws4PresignerParams presignRequest = Aws4PresignerParams.builder()
81+
.signingClockOverride(clock)
82+
.expirationTime(expirationTime)
83+
.awsCredentials(resolveCredentials(request))
84+
.signingName("xanadu")
85+
.signingRegion(resolveRegion(request))
86+
.build();
87+
88+
SdkHttpFullRequest fullRequest = signer.presign(httpRequest, presignRequest);
89+
String signedUrl = fullRequest.getUri().toString();
90+
91+
String result = StringUtils.replacePrefixIgnoreCase(signedUrl, "https://", "");
92+
return result;
93+
}
94+
95+
private Region resolveRegion(GenerateAuthenticationTokenRequest request) {
96+
if (request.region() != null) {
97+
return request.region();
98+
}
99+
100+
if (this.region != null) {
101+
return this.region;
102+
}
103+
104+
throw new IllegalArgumentException("Region should be provided either in GenerateAuthenticationTokenRequest object " +
105+
"or AxdbFrontendUtilities object");
106+
}
107+
108+
private AwsCredentials resolveCredentials(GenerateAuthenticationTokenRequest request) {
109+
if (request.credentialsIdentityProvider() != null) {
110+
return CredentialUtils.toCredentials(
111+
CompletableFutureUtils.joinLikeSync(request.credentialsIdentityProvider().resolveIdentity()));
112+
}
113+
114+
if (this.credentialsProvider != null) {
115+
return CredentialUtils.toCredentials(CompletableFutureUtils.joinLikeSync(this.credentialsProvider.resolveIdentity()));
116+
}
117+
118+
throw new IllegalArgumentException("CredentialProvider should be provided either in GenerateAuthenticationTokenRequest " +
119+
"object or AxdbFrontendUtilities object");
120+
}
121+
122+
@SdkInternalApi
123+
static final class DefaultBuilder implements Builder {
124+
private Region region;
125+
private IdentityProvider<? extends AwsCredentialsIdentity> credentialsProvider;
126+
127+
DefaultBuilder() {
128+
}
129+
130+
Builder clientConfiguration(SdkClientConfiguration clientConfiguration) {
131+
this.credentialsProvider = clientConfiguration.option(AwsClientOption.CREDENTIALS_IDENTITY_PROVIDER);
132+
this.region = clientConfiguration.option(AwsClientOption.AWS_REGION);
133+
134+
return this;
135+
}
136+
137+
@Override
138+
public Builder region(Region region) {
139+
this.region = region;
140+
return this;
141+
}
142+
143+
@Override
144+
public Builder credentialsProvider(IdentityProvider<? extends AwsCredentialsIdentity> credentialsProvider) {
145+
this.credentialsProvider = credentialsProvider;
146+
return this;
147+
}
148+
149+
/**
150+
* Construct a {@link AxdbFrontendUtilities} object.
151+
*/
152+
@Override
153+
public AxdbFrontendUtilities build() {
154+
return new DefaultAxdbFrontendUtilities(this);
155+
}
156+
}
157+
}

‎services/axdbfrontend/src/main/java/software/amazon/awssdk/services/axdbfrontend/model/Action.java

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
/*
2+
* Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License").
5+
* You may not use this file except in compliance with the License.
6+
* A copy of the License is located at
7+
*
8+
* http://aws.amazon.com/apache2.0
9+
*
10+
* or in the "license" file accompanying this file. This file is distributed
11+
* on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either
12+
* express or implied. See the License for the specific language governing
13+
* permissions and limitations under the License.
14+
*/
15+
16+
package software.amazon.awssdk.services.axdbfrontend.model;
17+
18+
import java.io.Serializable;
19+
20+
/**
21+
* Enumerations of possible actions that can be performed on a Xanadu database.
22+
*/
23+
public enum Action implements Serializable {
24+
DbConnect,
25+
DbConnectSuperuser;
26+
27+
public static Action variant(String value) {
28+
if (value.equalsIgnoreCase(Action.DbConnect.name())) {
29+
return Action.DbConnect;
30+
} else if (value.equalsIgnoreCase(Action.DbConnectSuperuser.name())) {
31+
return Action.DbConnectSuperuser;
32+
} else {
33+
throw new IllegalArgumentException("Invalid action: " + value);
34+
}
35+
}
36+
}

0 commit comments

Comments
 (0)