Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SSO Provider using the wrong cache path if sso_session is set #739

Closed
stewartallen opened this issue Feb 14, 2023 · 3 comments
Closed

SSO Provider using the wrong cache path if sso_session is set #739

stewartallen opened this issue Feb 14, 2023 · 3 comments
Labels
bug This issue is a bug. p2 This is a standard priority issue

Comments

@stewartallen
Copy link

stewartallen commented Feb 14, 2023

Describe the bug

Hi!

It seems that Boto core was updated in boto/botocore@af86417 to cache SSO tokens based on the sso-session name if it's set. See the updated _generate_cache_key function. The rust SDK still uses the old method of just using the start_url and not the session name, see the sso_token_path function.

Expected Behavior

Find the correct cached SSO credentials.

Current Behavior

If your .aws/config contains a configured sso_session, which is recommended and promoted by the aws configure sso wizard. aws sso login --profile **** stores the cached SSO credentials in a file named after the hash of the session name. When loaded in rust, the cache is not found

`/Users/***/.aws/sso/cache/e7109c80c9aa657df146180817236f33d6854cc6.json`: No such file or directory (os error 2): No such file or directory (os error 2) (ProviderError(ProviderError { source: IoError { err: Os { code: 2, kind: NotFound, message: "No such file or directory" }, path: "/Users/***/.aws/sso/cache/e7109c80c9aa657df146180817236f33d6854cc6.json" } }))
2023-02-14T05:14:30.167Z WARN  [aws_config::meta::credentials::chain] provider failed to provide credentials provider=Profile error=an error occurred while loading credentials: an error occurred while loading credentials: failed to read `/Users/***/.aws/sso/cache/e7109c80c9aa657df146180817236f33d6854cc6.json`: No such file or directory (os error 2): No such file or directory (os error 2) (ProviderError(ProviderError { source: ProviderError(ProviderError { source: IoError { err: Os { code: 2, kind: NotFound, message: "No such file or directory" }, path: "/Users/***/.aws/sso/cache/e7109c80c9aa657df146180817236f33d6854cc6.json" } }) }))
Error: failed to construct request

Caused by:
    0: failed to load credentials from the credentials cache
    1: an error occurred while loading credentials
    2: an error occurred while loading credentials
    3: failed to read `/Users/***/.aws/sso/cache/e7109c80c9aa657df146180817236f33d6854cc6.json`: No such file or directory (os error 2)
    4: No such file or directory (os error 2)

Reproduction Steps

Create a .aws/config with a SSO profile and a configured sso_session. Use the aws cli to grab a token and then use a the Rust SDK DefaultCredentialsChain to load the token

Possible Solution

See the python code, sso_token_path needs to use the sso_session name if set.

Additional Information/Context

No response

Version

├── aws-config v0.54.1
│   ├── aws-credential-types v0.54.1
│   │   ├── aws-smithy-async v0.54.2
│   │   ├── aws-smithy-types v0.54.2
│   ├── aws-http v0.54.1
│   │   ├── aws-credential-types v0.54.1 (*)
│   │   ├── aws-smithy-http v0.54.2
│   │   │   ├── aws-smithy-types v0.54.2 (*)
│   │   ├── aws-smithy-types v0.54.2 (*)
│   │   ├── aws-types v0.54.1
│   │   │   ├── aws-credential-types v0.54.1 (*)
│   │   │   ├── aws-smithy-async v0.54.2 (*)
│   │   │   ├── aws-smithy-client v0.54.2
│   │   │   │   ├── aws-smithy-async v0.54.2 (*)
│   │   │   │   ├── aws-smithy-http v0.54.2 (*)
│   │   │   │   ├── aws-smithy-http-tower v0.54.2
│   │   │   │   │   ├── aws-smithy-http v0.54.2 (*)
│   │   │   │   │   ├── aws-smithy-types v0.54.2 (*)
│   │   │   │   ├── aws-smithy-types v0.54.2 (*)
│   │   │   ├── aws-smithy-http v0.54.2 (*)
│   │   │   ├── aws-smithy-types v0.54.2 (*)
│   ├── aws-sdk-sso v0.24.0
│   │   ├── aws-credential-types v0.54.1 (*)
│   │   ├── aws-endpoint v0.54.1
│   │   │   ├── aws-smithy-http v0.54.2 (*)
│   │   │   ├── aws-smithy-types v0.54.2 (*)
│   │   │   ├── aws-types v0.54.1 (*)
│   │   ├── aws-http v0.54.1 (*)
│   │   ├── aws-sig-auth v0.54.1
│   │   │   ├── aws-credential-types v0.54.1 (*)
│   │   │   ├── aws-sigv4 v0.54.1
│   │   │   │   ├── aws-smithy-http v0.54.2 (*)
│   │   │   ├── aws-smithy-http v0.54.2 (*)
│   │   │   ├── aws-types v0.54.1 (*)
│   │   ├── aws-smithy-async v0.54.2 (*)
│   │   ├── aws-smithy-client v0.54.2 (*)
│   │   ├── aws-smithy-http v0.54.2 (*)
│   │   ├── aws-smithy-http-tower v0.54.2 (*)
│   │   ├── aws-smithy-json v0.54.2
│   │   │   └── aws-smithy-types v0.54.2 (*)
│   │   ├── aws-smithy-types v0.54.2 (*)
│   │   ├── aws-types v0.54.1 (*)
│   ├── aws-sdk-sts v0.24.0
│   │   ├── aws-credential-types v0.54.1 (*)
│   │   ├── aws-endpoint v0.54.1 (*)
│   │   ├── aws-http v0.54.1 (*)
│   │   ├── aws-sig-auth v0.54.1 (*)
│   │   ├── aws-smithy-async v0.54.2 (*)
│   │   ├── aws-smithy-client v0.54.2 (*)
│   │   ├── aws-smithy-http v0.54.2 (*)
│   │   ├── aws-smithy-http-tower v0.54.2 (*)
│   │   ├── aws-smithy-json v0.54.2 (*)
│   │   ├── aws-smithy-query v0.54.2
│   │   │   ├── aws-smithy-types v0.54.2 (*)
│   │   ├── aws-smithy-types v0.54.2 (*)
│   │   ├── aws-smithy-xml v0.54.2
│   │   ├── aws-types v0.54.1 (*)
│   ├── aws-smithy-async v0.54.2 (*)
│   ├── aws-smithy-client v0.54.2 (*)
│   ├── aws-smithy-http v0.54.2 (*)
│   ├── aws-smithy-http-tower v0.54.2 (*)
│   ├── aws-smithy-json v0.54.2 (*)
│   ├── aws-smithy-types v0.54.2 (*)
│   ├── aws-types v0.54.1 (*)
├── aws-sdk-cloudformation v0.24.0
│   ├── aws-credential-types v0.54.1 (*)
│   ├── aws-endpoint v0.54.1 (*)
│   ├── aws-http v0.54.1 (*)
│   ├── aws-sig-auth v0.54.1 (*)
│   ├── aws-smithy-async v0.54.2 (*)
│   ├── aws-smithy-client v0.54.2 (*)
│   ├── aws-smithy-http v0.54.2 (*)
│   ├── aws-smithy-http-tower v0.54.2 (*)
│   ├── aws-smithy-json v0.54.2 (*)
│   ├── aws-smithy-query v0.54.2 (*)
│   ├── aws-smithy-types v0.54.2 (*)
│   ├── aws-smithy-xml v0.54.2 (*)
│   ├── aws-types v0.54.1 (*)
├── aws-sdk-dynamodb v0.24.0
│   ├── aws-credential-types v0.54.1 (*)
│   ├── aws-endpoint v0.54.1 (*)
│   ├── aws-http v0.54.1 (*)
│   ├── aws-sig-auth v0.54.1 (*)
│   ├── aws-smithy-async v0.54.2 (*)
│   ├── aws-smithy-client v0.54.2 (*)
│   ├── aws-smithy-http v0.54.2 (*)
│   ├── aws-smithy-http-tower v0.54.2 (*)
│   ├── aws-smithy-json v0.54.2 (*)
│   ├── aws-smithy-types v0.54.2 (*)
│   ├── aws-types v0.54.1 (*)
├── aws-types v0.54.1 (*)
│   ├── aws-sdk-dynamodb v0.24.0 (*)
│   ├── aws-types v0.54.1 (*)


### Environment details (OS name and version, etc.)

Darwin zoidberg 20.6.0 Darwin Kernel Version 20.6.0: Fri Dec 16 00:35:00 PST 2022; root:xnu-7195.141.49~1/RELEASE_X86_64 x86_64

### Logs

_No response_
@stewartallen stewartallen added bug This issue is a bug. needs-triage This issue or PR still needs to be triaged. labels Feb 14, 2023
@Velfi Velfi removed the needs-triage This issue or PR still needs to be triaged. label Feb 14, 2023
@Velfi
Copy link
Contributor

Velfi commented Feb 14, 2023

Hey @stewartallen , thanks for submitting this issue. We'll add it to our backlog.

@Velfi Velfi added the p2 This is a standard priority issue label Feb 14, 2023
@ysaito1001
Copy link
Collaborator

Thanks for another data point. We keep track of it via #703.

Closing this issue as #699 is the original one requesting the feature.

@github-actions
Copy link

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug This issue is a bug. p2 This is a standard priority issue
Projects
None yet
Development

No branches or pull requests

3 participants