-
Notifications
You must be signed in to change notification settings - Fork 47
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat: FederatedAuthConnectionPlugin #741
Conversation
a2ac9cd
to
bc89e93
Compare
docs/using-the-jdbc-driver/using-plugins/UsingTheFederatedAuthPlugin.md
Outdated
Show resolved
Hide resolved
docs/using-the-jdbc-driver/using-plugins/UsingTheFederatedAuthPlugin.md
Outdated
Show resolved
Hide resolved
docs/using-the-jdbc-driver/using-plugins/UsingTheFederatedAuthPlugin.md
Outdated
Show resolved
Hide resolved
...rc/main/java/software/amazon/jdbc/plugin/federatedauth/CredentialsProviderGetterFactory.java
Outdated
Show resolved
Hide resolved
...r/src/main/java/software/amazon/jdbc/plugin/federatedauth/FederatedAuthConnectionPlugin.java
Outdated
Show resolved
Hide resolved
...r/src/main/java/software/amazon/jdbc/plugin/federatedauth/FederatedAuthConnectionPlugin.java
Outdated
Show resolved
Hide resolved
...r/src/main/java/software/amazon/jdbc/plugin/federatedauth/FederatedAuthConnectionPlugin.java
Outdated
Show resolved
Hide resolved
...r/src/main/java/software/amazon/jdbc/plugin/federatedauth/FederatedAuthConnectionPlugin.java
Outdated
Show resolved
Hide resolved
bc89e93
to
84018c3
Compare
a0c2a31
to
6b73c62
Compare
2419f9e
to
15a5ba6
Compare
.../src/main/java/software/amazon/jdbc/plugin/federatedauth/AdfsCredentialsProviderFactory.java
Outdated
Show resolved
Hide resolved
.../src/main/java/software/amazon/jdbc/plugin/federatedauth/AdfsCredentialsProviderFactory.java
Outdated
Show resolved
Hide resolved
...r/src/main/java/software/amazon/jdbc/plugin/federatedauth/FederatedAuthConnectionPlugin.java
Outdated
Show resolved
Hide resolved
...r/src/main/java/software/amazon/jdbc/plugin/federatedauth/FederatedAuthConnectionPlugin.java
Outdated
Show resolved
Hide resolved
.../src/main/java/software/amazon/jdbc/plugin/federatedauth/AdfsCredentialsProviderFactory.java
Outdated
Show resolved
Hide resolved
...r/src/main/java/software/amazon/jdbc/plugin/federatedauth/FederatedAuthConnectionPlugin.java
Outdated
Show resolved
Hide resolved
...r/src/main/java/software/amazon/jdbc/plugin/federatedauth/FederatedAuthConnectionPlugin.java
Outdated
Show resolved
Hide resolved
d37c8be
to
6bcfc68
Compare
@@ -92,7 +93,8 @@ public class ConnectionPluginChainBuilder { | |||
put(HostMonitoringConnectionPluginFactory.class, 800); | |||
put(IamAuthConnectionPluginFactory.class, 900); | |||
put(AwsSecretsManagerConnectionPluginFactory.class, 1000); | |||
put(LogQueryConnectionPluginFactory.class, 1100); | |||
put(FederatedAuthPluginFactory.class, 1100); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
What would happen if users provide both IAM and FederatedAuth in their plugin list? Should federated auth be put before IAM?
wrapper/src/main/java/software/amazon/jdbc/plugin/federatedauth/HttpClientFactory.java
Outdated
Show resolved
Hide resolved
wrapper/src/main/java/software/amazon/jdbc/plugin/federatedauth/HttpClientFactory.java
Outdated
Show resolved
Hide resolved
.../src/main/java/software/amazon/jdbc/plugin/federatedauth/AdfsCredentialsProviderFactory.java
Outdated
Show resolved
Hide resolved
.../src/main/java/software/amazon/jdbc/plugin/federatedauth/AdfsCredentialsProviderFactory.java
Outdated
Show resolved
Hide resolved
wrapper/src/main/java/software/amazon/jdbc/plugin/federatedauth/FederatedAuthPluginFactory.java
Outdated
Show resolved
Hide resolved
wrapper/src/main/resources/aws_advanced_jdbc_wrapper_messages.properties
Outdated
Show resolved
Hide resolved
wrapper/src/main/resources/aws_advanced_jdbc_wrapper_messages.properties
Outdated
Show resolved
Hide resolved
@@ -147,6 +157,17 @@ Failover.failedToUpdateCurrentHostspecAvailability=Failed to update current host | |||
Failover.noOperationsAfterConnectionClosed=No operations allowed after connection closed. | |||
Failover.invalidHostListProvider=Incorrect type of host list provider found, please ensure the correct host list provider is specified. The host list provider in use is: ''{0}'', the plugin is expected a cluster-aware host list provider such as the AuroraHostListProvider. | |||
|
|||
# Federated Authentication Connection Plugin | |||
FederatedAuthPlugin.generatedNewIamToken=Generated new IAM token = ''{0}'' |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Why do we need two sets of the same messages for iam auth and federated auth plugin
wrapper/src/main/resources/aws_advanced_jdbc_wrapper_messages.properties
Outdated
Show resolved
Hide resolved
} else if (html.startsWith("<", i)) { | ||
sb.append('<'); | ||
i += 4; | ||
} else if (html.startsWith(">", i)) { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Can we use replaceAll to simplify this logic?
.../src/main/java/software/amazon/jdbc/plugin/federatedauth/AdfsCredentialsProviderFactory.java
Outdated
Show resolved
Hide resolved
|
||
private String getSignInPageBody(final CloseableHttpClient httpClient, final String uri) throws IOException { | ||
LOGGER.finest(Messages.get("AdfsCredentialsProviderFactory.signOnPageUrl", new Object[] {uri})); | ||
validateURL(uri); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
nit: other method names use "Url", so should be validateUrl()
.../src/main/java/software/amazon/jdbc/plugin/federatedauth/AdfsCredentialsProviderFactory.java
Outdated
Show resolved
Hide resolved
.../src/main/java/software/amazon/jdbc/plugin/federatedauth/AdfsCredentialsProviderFactory.java
Outdated
Show resolved
Hide resolved
.../src/main/java/software/amazon/jdbc/plugin/federatedauth/AdfsCredentialsProviderFactory.java
Outdated
Show resolved
Hide resolved
.../src/main/java/software/amazon/jdbc/plugin/federatedauth/AdfsCredentialsProviderFactory.java
Outdated
Show resolved
Hide resolved
wrapper/src/main/java/software/amazon/jdbc/plugin/federatedauth/FederatedAuthPlugin.java
Outdated
Show resolved
Hide resolved
wrapper/src/main/java/software/amazon/jdbc/plugin/federatedauth/FederatedAuthPlugin.java
Outdated
Show resolved
Hide resolved
c3ef0ad
to
e13a560
Compare
final Optional<Region> regionOptional = Region.regions().stream() | ||
.filter(r -> r.id().equalsIgnoreCase(rdsRegion)) | ||
.findFirst(); | ||
|
||
if (!regionOptional.isPresent()) { | ||
final String exceptionMessage = Messages.get( | ||
"AwsSdk.unsupportedRegion", | ||
new Object[] {rdsRegion}); | ||
|
||
LOGGER.fine(exceptionMessage); | ||
throw new SQLException(exceptionMessage); | ||
} | ||
|
||
return regionOptional.get(); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Can we move this validation to RdsUtils? Duplicated code as the IAM plugin.
} | ||
} | ||
|
||
private void updateAuthenticationToken(HostSpec hostSpec, Properties props, Region region, String cacheKey) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Can we move these IAM specific methods to IamAuthUtils to reduce duplicated code?
FederatedAuthPlugin plugin = | ||
new FederatedAuthPlugin(mockPluginService, mockCredentialsProviderFactory); | ||
FederatedAuthPlugin spyPlugin = Mockito.spy(plugin); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
FederatedAuthPlugin plugin = | |
new FederatedAuthPlugin(mockPluginService, mockCredentialsProviderFactory); | |
FederatedAuthPlugin spyPlugin = Mockito.spy(plugin); | |
FederatedAuthPlugin spyPlugin = Mockito.spy(new FederatedAuthPlugin(mockPluginService, mockCredentialsProviderFactory)); |
new FederatedAuthPlugin(mockPluginService, mockCredentialsProviderFactory); | ||
|
||
String key = "us-east-2:pg.testdb.us-east-2.rds.amazonaws.com:" + DEFAULT_PORT + ":iamUser"; | ||
TokenInfo tokenInfo = new TokenInfo( |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
can we make tokenInfo a private static final variable?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM, some nits
ea01672
to
820dbef
Compare
820dbef
to
02cdd53
Compare
@@ -14,6 +14,15 @@ | |||
# limitations under the License. | |||
# | |||
|
|||
# ADFS Credentials Provider Getter | |||
AdfsCredentialsProviderFactory.failedLogin=Failed login. Could not obtain SAML Assertion from ADFS SignOn Page POST response: \n''{0}'' | |||
AdfsCredentialsProviderFactory.getSamlAssertionFailed=Failed to get Saml Assertion due to exception: ''{0}'' |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
AdfsCredentialsProviderFactory.getSamlAssertionFailed=Failed to get Saml Assertion due to exception: ''{0}'' | |
AdfsCredentialsProviderFactory.getSamlAssertionFailed=Failed to get SAML Assertion due to exception: ''{0}'' |
* Configuration Profiles (aws#711) Co-authored-by: sergiyvamz <[email protected]> * chore(deps): bump org.testcontainers:postgresql from 1.19.1 to 1.19.2 (aws#743) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump io.vertx:vertx-stack-depchain from 4.4.6 to 4.5.0 (aws#745) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump org.testcontainers:junit-jupiter from 1.19.1 to 1.19.2 (aws#747) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump io.opentelemetry:opentelemetry-api from 1.31.0 to 1.32.0 (aws#746) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump com.fasterxml.jackson.core:jackson-databind from 2.15.3 to 2.16.0 (aws#744) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Disable failing integration test for PG driver (aws#742) * Configuration Profiles documentation (aws#738) * feat: Autoregister a target driver (aws#748) * chore: reduce log level for intentionally ignored exceptions (aws#751) * chore(deps): bump org.testcontainers:mariadb from 1.19.1 to 1.19.3 (aws#756) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump software.amazon.awssdk:secretsmanager from 2.21.21 to 2.21.31 (aws#762) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump io.opentelemetry:opentelemetry-sdk from 1.31.0 to 1.32.0 (aws#758) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump org.testcontainers:postgresql from 1.19.2 to 1.19.3 (aws#757) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump org.testcontainers:junit-jupiter from 1.19.2 to 1.19.3 (aws#759) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * feat: node fastest response time strategy (aws#755) * chore: update changelog and versioning for version 2.3.1 (aws#754) * chore(deps): bump org.testcontainers:testcontainers from 1.19.1 to 1.19.3 (aws#771) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump org.mariadb.jdbc:mariadb-java-client from 3.3.0 to 3.3.1 (aws#767) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump org.apache.poi:poi-ooxml from 5.2.4 to 5.2.5 (aws#769) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump software.amazon.awssdk:secretsmanager from 2.21.31 to 2.21.38 (aws#772) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump software.amazon.awssdk:rds from 2.21.11 to 2.21.38 (aws#773) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump software.amazon.awssdk:rds from 2.21.38 to 2.21.42 (aws#776) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump org.postgresql:postgresql from 42.6.0 to 42.7.1 (aws#778) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump software.amazon.awssdk:secretsmanager from 2.21.38 to 2.21.43 (aws#781) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump io.opentelemetry:opentelemetry-exporter-otlp from 1.32.0 to 1.33.0 (aws#777) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix: use existing entries to update the round robin cache (aws#739) * set hostId in HostSpec (aws#782) * docs: update HikariCP example to include configuring the datasource with a JDBC URL (aws#749) * Enhanced host monitoring plugin ver.2 (aws#764) * Fix: expose AuroraInitialConnectionStrategyPlugin with a plugin code (aws#784) * feat: FederatedAuthConnectionPlugin (aws#741) * chore: replace synchronized with locks in AwsCredentialsManager (aws#785) * docs: FederatedAuthPlugin (aws#787) Co-authored-by: Karen <[email protected]> * chore(deps): bump io.opentelemetry:opentelemetry-sdk-metrics from 1.32.0 to 1.33.0 (aws#792) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump software.amazon.awssdk:ec2 from 2.21.12 to 2.22.1 (aws#795) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump io.opentelemetry:opentelemetry-api from 1.32.0 to 1.33.0 (aws#794) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump org.junit.jupiter:junit-jupiter-params from 5.10.0 to 5.10.1 (aws#793) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Improve efm2 failure detection timing (aws#797) * chore: update versioning and changelog (aws#791) * fix: SqlMethodAnalyzer to handle empty SQL query and not throw IndexOutOfBoundsException (aws#798) * Add documentation for read/write splitting Spring limitations (aws#800) * Add example code for Read/Write Splitting sample (aws#765) * fix: restructuring try blocks in dialects for exception handling (aws#799) * chore(deps): bump software.amazon.awssdk:secretsmanager from 2.21.43 to 2.22.5 (aws#802) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump io.vertx:vertx-stack-depchain from 4.5.0 to 4.5.1 (aws#803) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump com.amazonaws:aws-xray-recorder-sdk-core from 2.14.0 to 2.15.0 (aws#804) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * fix: add missing log message (aws#801) Co-authored-by: Bruno Paiva Lima da Silva <[email protected]> * fix: making a variable volatile in RdsHostListProvider (aws#806) * chore(deps): bump software.amazon.awssdk:ec2 from 2.22.1 to 2.22.9 (aws#808) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump io.opentelemetry:opentelemetry-sdk from 1.32.0 to 1.33.0 (aws#809) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump org.postgresql:postgresql from 42.6.0 to 42.7.1 (aws#810) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump tj-actions/changed-files from 37 to 41 in /.github/workflows (aws#811) * transfer session state during failover (aws#814) * feat: Session state transfer redesign (aws#821) * chore(deps): bump software.amazon.awssdk:rds from 2.21.42 to 2.22.13 (aws#822) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump software.amazon.awssdk:sts from 2.21.42 to 2.22.13 (aws#823) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump com.fasterxml.jackson.core:jackson-databind from 2.16.0 to 2.16.1 (aws#818) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump com.github.spotbugs from 5.2.+ to 6.0.6 (aws#820) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * Improve Multi-AZ cluster detection (aws#824) --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: Bruno Paiva Lima da Silva <[email protected]> Co-authored-by: sergiyvamz <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: sergiyvamz <[email protected]> Co-authored-by: Karen <[email protected]> Co-authored-by: crystall-bitquill <[email protected]> Co-authored-by: aaronchung-bitquill <[email protected]> Co-authored-by: congoamz <[email protected]>
Summary
Description
Implement a new connection plugin for Federated Authentication. Currently, supports SAML authentication through ADFS. and authorization by assuming an AWS IAM role.
Additional Reviewers
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.