aws-sdk-core 3.232.0 → 3.239.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/CHANGELOG.md +65 -0
- data/VERSION +1 -1
- data/lib/aws-sdk-core/assume_role_credentials.rb +8 -8
- data/lib/aws-sdk-core/assume_role_web_identity_credentials.rb +2 -2
- data/lib/aws-sdk-core/credential_provider_chain.rb +71 -22
- data/lib/aws-sdk-core/ecs_credentials.rb +13 -13
- data/lib/aws-sdk-core/errors.rb +3 -0
- data/lib/aws-sdk-core/instance_profile_credentials.rb +7 -7
- data/lib/aws-sdk-core/login_credentials.rb +229 -0
- data/lib/aws-sdk-core/plugins/checksum_algorithm.rb +28 -14
- data/lib/aws-sdk-core/plugins/user_agent.rb +3 -1
- data/lib/aws-sdk-core/refreshing_credentials.rb +8 -11
- data/lib/aws-sdk-core/shared_config.rb +20 -0
- data/lib/aws-sdk-core/sso_credentials.rb +1 -1
- data/lib/aws-sdk-core.rb +4 -0
- data/lib/aws-sdk-signin/client.rb +604 -0
- data/lib/aws-sdk-signin/client_api.rb +119 -0
- data/lib/aws-sdk-signin/customizations.rb +1 -0
- data/lib/aws-sdk-signin/endpoint_parameters.rb +69 -0
- data/lib/aws-sdk-signin/endpoint_provider.rb +59 -0
- data/lib/aws-sdk-signin/endpoints.rb +20 -0
- data/lib/aws-sdk-signin/errors.rb +122 -0
- data/lib/aws-sdk-signin/plugins/endpoints.rb +77 -0
- data/lib/aws-sdk-signin/resource.rb +26 -0
- data/lib/aws-sdk-signin/types.rb +299 -0
- data/lib/aws-sdk-signin.rb +63 -0
- data/lib/aws-sdk-sso/client.rb +1 -1
- data/lib/aws-sdk-sso/endpoint_parameters.rb +4 -4
- data/lib/aws-sdk-sso.rb +1 -1
- data/lib/aws-sdk-ssooidc/client.rb +20 -7
- data/lib/aws-sdk-ssooidc/client_api.rb +5 -0
- data/lib/aws-sdk-ssooidc/endpoint_parameters.rb +4 -4
- data/lib/aws-sdk-ssooidc/errors.rb +10 -0
- data/lib/aws-sdk-ssooidc/types.rb +27 -15
- data/lib/aws-sdk-ssooidc.rb +1 -1
- data/lib/aws-sdk-sts/client.rb +136 -12
- data/lib/aws-sdk-sts/client_api.rb +72 -0
- data/lib/aws-sdk-sts/customizations.rb +0 -1
- data/lib/aws-sdk-sts/endpoint_parameters.rb +5 -5
- data/lib/aws-sdk-sts/errors.rb +64 -0
- data/lib/aws-sdk-sts/types.rb +175 -6
- data/lib/aws-sdk-sts.rb +1 -1
- data/lib/seahorse/client/h2/handler.rb +6 -1
- metadata +13 -1
|
@@ -0,0 +1,299 @@
|
|
|
1
|
+
# frozen_string_literal: true
|
|
2
|
+
|
|
3
|
+
# WARNING ABOUT GENERATED CODE
|
|
4
|
+
#
|
|
5
|
+
# This file is generated. See the contributing guide for more information:
|
|
6
|
+
# https://github.com/aws/aws-sdk-ruby/blob/version-3/CONTRIBUTING.md
|
|
7
|
+
#
|
|
8
|
+
# WARNING ABOUT GENERATED CODE
|
|
9
|
+
|
|
10
|
+
module Aws::Signin
|
|
11
|
+
module Types
|
|
12
|
+
|
|
13
|
+
# Error thrown for access denied scenarios with flexible HTTP status
|
|
14
|
+
# mapping
|
|
15
|
+
#
|
|
16
|
+
# Runtime HTTP Status Code Mapping:
|
|
17
|
+
#
|
|
18
|
+
# * HTTP 401 (Unauthorized): TOKEN\_EXPIRED, AUTHCODE\_EXPIRED
|
|
19
|
+
# * HTTP 403 (Forbidden): USER\_CREDENTIALS\_CHANGED,
|
|
20
|
+
# INSUFFICIENT\_PERMISSIONS
|
|
21
|
+
#
|
|
22
|
+
# The specific HTTP status code is determined at runtime based on the
|
|
23
|
+
# error enum value. Consumers should use the error field to determine
|
|
24
|
+
# the specific access denial reason.
|
|
25
|
+
#
|
|
26
|
+
# @!attribute [rw] error
|
|
27
|
+
# OAuth 2.0 error code indicating the specific type of access denial
|
|
28
|
+
# Can be TOKEN\_EXPIRED, AUTHCODE\_EXPIRED,
|
|
29
|
+
# USER\_CREDENTIALS\_CHANGED, or INSUFFICIENT\_PERMISSIONS
|
|
30
|
+
# @return [String]
|
|
31
|
+
#
|
|
32
|
+
# @!attribute [rw] message
|
|
33
|
+
# Detailed message explaining the access denial Provides specific
|
|
34
|
+
# information about why access was denied
|
|
35
|
+
# @return [String]
|
|
36
|
+
#
|
|
37
|
+
# @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/AccessDeniedException AWS API Documentation
|
|
38
|
+
#
|
|
39
|
+
class AccessDeniedException < Struct.new(
|
|
40
|
+
:error,
|
|
41
|
+
:message)
|
|
42
|
+
SENSITIVE = []
|
|
43
|
+
include Aws::Structure
|
|
44
|
+
end
|
|
45
|
+
|
|
46
|
+
# AWS credentials structure containing temporary access credentials
|
|
47
|
+
#
|
|
48
|
+
# The scoped-down, 15 minute duration AWS credentials. Scoping down will
|
|
49
|
+
# be based on CLI policy (CLI team needs to create it). Similar to cloud
|
|
50
|
+
# shell implementation.
|
|
51
|
+
#
|
|
52
|
+
# @!attribute [rw] access_key_id
|
|
53
|
+
# AWS access key ID for temporary credentials
|
|
54
|
+
# @return [String]
|
|
55
|
+
#
|
|
56
|
+
# @!attribute [rw] secret_access_key
|
|
57
|
+
# AWS secret access key for temporary credentials
|
|
58
|
+
# @return [String]
|
|
59
|
+
#
|
|
60
|
+
# @!attribute [rw] session_token
|
|
61
|
+
# AWS session token for temporary credentials
|
|
62
|
+
# @return [String]
|
|
63
|
+
#
|
|
64
|
+
# @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/AccessToken AWS API Documentation
|
|
65
|
+
#
|
|
66
|
+
class AccessToken < Struct.new(
|
|
67
|
+
:access_key_id,
|
|
68
|
+
:secret_access_key,
|
|
69
|
+
:session_token)
|
|
70
|
+
SENSITIVE = []
|
|
71
|
+
include Aws::Structure
|
|
72
|
+
end
|
|
73
|
+
|
|
74
|
+
# Input structure for CreateOAuth2Token operation
|
|
75
|
+
#
|
|
76
|
+
# Contains flattened token operation inputs for both authorization code
|
|
77
|
+
# and refresh token flows. The operation type is determined by the
|
|
78
|
+
# grant\_type parameter in the request body.
|
|
79
|
+
#
|
|
80
|
+
# @!attribute [rw] token_input
|
|
81
|
+
# Flattened token operation inputs The specific operation is
|
|
82
|
+
# determined by grant\_type in the request body
|
|
83
|
+
# @return [Types::CreateOAuth2TokenRequestBody]
|
|
84
|
+
#
|
|
85
|
+
# @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/CreateOAuth2TokenRequest AWS API Documentation
|
|
86
|
+
#
|
|
87
|
+
class CreateOAuth2TokenRequest < Struct.new(
|
|
88
|
+
:token_input)
|
|
89
|
+
SENSITIVE = []
|
|
90
|
+
include Aws::Structure
|
|
91
|
+
end
|
|
92
|
+
|
|
93
|
+
# Request body payload for CreateOAuth2Token operation
|
|
94
|
+
#
|
|
95
|
+
# The operation type is determined by the grant\_type parameter:
|
|
96
|
+
#
|
|
97
|
+
# * grant\_type=authorization\_code: Requires code, redirect\_uri,
|
|
98
|
+
# code\_verifier
|
|
99
|
+
# * grant\_type=refresh\_token: Requires refresh\_token
|
|
100
|
+
#
|
|
101
|
+
# @!attribute [rw] client_id
|
|
102
|
+
# The client identifier (ARN) used during Sign-In onboarding Required
|
|
103
|
+
# for both authorization code and refresh token flows
|
|
104
|
+
# @return [String]
|
|
105
|
+
#
|
|
106
|
+
# @!attribute [rw] grant_type
|
|
107
|
+
# OAuth 2.0 grant type - determines which flow is used Must be
|
|
108
|
+
# "authorization\_code" or "refresh\_token"
|
|
109
|
+
# @return [String]
|
|
110
|
+
#
|
|
111
|
+
# @!attribute [rw] code
|
|
112
|
+
# The authorization code received from /v1/authorize Required only
|
|
113
|
+
# when grant\_type=authorization\_code
|
|
114
|
+
# @return [String]
|
|
115
|
+
#
|
|
116
|
+
# @!attribute [rw] redirect_uri
|
|
117
|
+
# The redirect URI that must match the original authorization request
|
|
118
|
+
# Required only when grant\_type=authorization\_code
|
|
119
|
+
# @return [String]
|
|
120
|
+
#
|
|
121
|
+
# @!attribute [rw] code_verifier
|
|
122
|
+
# PKCE code verifier to prove possession of the original code
|
|
123
|
+
# challenge Required only when grant\_type=authorization\_code
|
|
124
|
+
# @return [String]
|
|
125
|
+
#
|
|
126
|
+
# @!attribute [rw] refresh_token
|
|
127
|
+
# The refresh token returned from auth\_code redemption Required only
|
|
128
|
+
# when grant\_type=refresh\_token
|
|
129
|
+
# @return [String]
|
|
130
|
+
#
|
|
131
|
+
# @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/CreateOAuth2TokenRequestBody AWS API Documentation
|
|
132
|
+
#
|
|
133
|
+
class CreateOAuth2TokenRequestBody < Struct.new(
|
|
134
|
+
:client_id,
|
|
135
|
+
:grant_type,
|
|
136
|
+
:code,
|
|
137
|
+
:redirect_uri,
|
|
138
|
+
:code_verifier,
|
|
139
|
+
:refresh_token)
|
|
140
|
+
SENSITIVE = [:refresh_token]
|
|
141
|
+
include Aws::Structure
|
|
142
|
+
end
|
|
143
|
+
|
|
144
|
+
# Output structure for CreateOAuth2Token operation
|
|
145
|
+
#
|
|
146
|
+
# Contains flattened token operation outputs for both authorization code
|
|
147
|
+
# and refresh token flows. The response content depends on the
|
|
148
|
+
# grant\_type from the original request.
|
|
149
|
+
#
|
|
150
|
+
# @!attribute [rw] token_output
|
|
151
|
+
# Flattened token operation outputs The specific response fields
|
|
152
|
+
# depend on the grant\_type used in the request
|
|
153
|
+
# @return [Types::CreateOAuth2TokenResponseBody]
|
|
154
|
+
#
|
|
155
|
+
# @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/CreateOAuth2TokenResponse AWS API Documentation
|
|
156
|
+
#
|
|
157
|
+
class CreateOAuth2TokenResponse < Struct.new(
|
|
158
|
+
:token_output)
|
|
159
|
+
SENSITIVE = []
|
|
160
|
+
include Aws::Structure
|
|
161
|
+
end
|
|
162
|
+
|
|
163
|
+
# Response body payload for CreateOAuth2Token operation
|
|
164
|
+
#
|
|
165
|
+
# The response content depends on the grant\_type from the request:
|
|
166
|
+
#
|
|
167
|
+
# * grant\_type=authorization\_code: Returns all fields including
|
|
168
|
+
# refresh\_token and id\_token
|
|
169
|
+
# * grant\_type=refresh\_token: Returns access\_token, token\_type,
|
|
170
|
+
# expires\_in, refresh\_token (no id\_token)
|
|
171
|
+
#
|
|
172
|
+
# @!attribute [rw] access_token
|
|
173
|
+
# Scoped-down AWS credentials (15 minute duration) Present for both
|
|
174
|
+
# authorization code redemption and token refresh
|
|
175
|
+
# @return [Types::AccessToken]
|
|
176
|
+
#
|
|
177
|
+
# @!attribute [rw] token_type
|
|
178
|
+
# Token type indicating this is AWS SigV4 credentials Value is
|
|
179
|
+
# "aws\_sigv4" for both flows
|
|
180
|
+
# @return [String]
|
|
181
|
+
#
|
|
182
|
+
# @!attribute [rw] expires_in
|
|
183
|
+
# Time to expiry in seconds (maximum 900) Present for both
|
|
184
|
+
# authorization code redemption and token refresh
|
|
185
|
+
# @return [Integer]
|
|
186
|
+
#
|
|
187
|
+
# @!attribute [rw] refresh_token
|
|
188
|
+
# Encrypted refresh token with cnf.jkt (SHA-256 thumbprint of
|
|
189
|
+
# presented jwk) Always present in responses (required for both flows)
|
|
190
|
+
# @return [String]
|
|
191
|
+
#
|
|
192
|
+
# @!attribute [rw] id_token
|
|
193
|
+
# ID token containing user identity information Present only in
|
|
194
|
+
# authorization code redemption response
|
|
195
|
+
# (grant\_type=authorization\_code) Not included in token refresh
|
|
196
|
+
# responses
|
|
197
|
+
# @return [String]
|
|
198
|
+
#
|
|
199
|
+
# @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/CreateOAuth2TokenResponseBody AWS API Documentation
|
|
200
|
+
#
|
|
201
|
+
class CreateOAuth2TokenResponseBody < Struct.new(
|
|
202
|
+
:access_token,
|
|
203
|
+
:token_type,
|
|
204
|
+
:expires_in,
|
|
205
|
+
:refresh_token,
|
|
206
|
+
:id_token)
|
|
207
|
+
SENSITIVE = [:access_token, :refresh_token]
|
|
208
|
+
include Aws::Structure
|
|
209
|
+
end
|
|
210
|
+
|
|
211
|
+
# Error thrown when an internal server error occurs
|
|
212
|
+
#
|
|
213
|
+
# HTTP Status Code: 500 Internal Server Error
|
|
214
|
+
#
|
|
215
|
+
# Used for unexpected server-side errors that prevent request
|
|
216
|
+
# processing.
|
|
217
|
+
#
|
|
218
|
+
# @!attribute [rw] error
|
|
219
|
+
# OAuth 2.0 error code indicating server error Will be SERVER\_ERROR
|
|
220
|
+
# for internal server errors
|
|
221
|
+
# @return [String]
|
|
222
|
+
#
|
|
223
|
+
# @!attribute [rw] message
|
|
224
|
+
# Detailed message explaining the server error May include error
|
|
225
|
+
# details for debugging purposes
|
|
226
|
+
# @return [String]
|
|
227
|
+
#
|
|
228
|
+
# @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/InternalServerException AWS API Documentation
|
|
229
|
+
#
|
|
230
|
+
class InternalServerException < Struct.new(
|
|
231
|
+
:error,
|
|
232
|
+
:message)
|
|
233
|
+
SENSITIVE = []
|
|
234
|
+
include Aws::Structure
|
|
235
|
+
end
|
|
236
|
+
|
|
237
|
+
# Error thrown when rate limit is exceeded
|
|
238
|
+
#
|
|
239
|
+
# HTTP Status Code: 429 Too Many Requests
|
|
240
|
+
#
|
|
241
|
+
# Possible OAuth2ErrorCode values:
|
|
242
|
+
#
|
|
243
|
+
# * INVALID\_REQUEST: Rate limiting, too many requests, abuse prevention
|
|
244
|
+
#
|
|
245
|
+
# Possible causes:
|
|
246
|
+
#
|
|
247
|
+
# * Too many token requests from the same client
|
|
248
|
+
# * Rate limiting based on client\_id or IP address
|
|
249
|
+
# * Abuse prevention mechanisms triggered
|
|
250
|
+
# * Service protection against excessive token generation
|
|
251
|
+
#
|
|
252
|
+
# @!attribute [rw] error
|
|
253
|
+
# OAuth 2.0 error code indicating the specific type of error Will be
|
|
254
|
+
# INVALID\_REQUEST for rate limiting scenarios
|
|
255
|
+
# @return [String]
|
|
256
|
+
#
|
|
257
|
+
# @!attribute [rw] message
|
|
258
|
+
# Detailed message about the rate limiting May include retry-after
|
|
259
|
+
# information or rate limit details
|
|
260
|
+
# @return [String]
|
|
261
|
+
#
|
|
262
|
+
# @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/TooManyRequestsError AWS API Documentation
|
|
263
|
+
#
|
|
264
|
+
class TooManyRequestsError < Struct.new(
|
|
265
|
+
:error,
|
|
266
|
+
:message)
|
|
267
|
+
SENSITIVE = []
|
|
268
|
+
include Aws::Structure
|
|
269
|
+
end
|
|
270
|
+
|
|
271
|
+
# Error thrown when request validation fails
|
|
272
|
+
#
|
|
273
|
+
# HTTP Status Code: 400 Bad Request
|
|
274
|
+
#
|
|
275
|
+
# Used for request validation errors such as malformed parameters,
|
|
276
|
+
# missing required fields, or invalid parameter values.
|
|
277
|
+
#
|
|
278
|
+
# @!attribute [rw] error
|
|
279
|
+
# OAuth 2.0 error code indicating validation failure Will be
|
|
280
|
+
# INVALID\_REQUEST for validation errors
|
|
281
|
+
# @return [String]
|
|
282
|
+
#
|
|
283
|
+
# @!attribute [rw] message
|
|
284
|
+
# Detailed message explaining the validation failure Provides specific
|
|
285
|
+
# information about which validation failed
|
|
286
|
+
# @return [String]
|
|
287
|
+
#
|
|
288
|
+
# @see http://docs.aws.amazon.com/goto/WebAPI/signin-2023-01-01/ValidationException AWS API Documentation
|
|
289
|
+
#
|
|
290
|
+
class ValidationException < Struct.new(
|
|
291
|
+
:error,
|
|
292
|
+
:message)
|
|
293
|
+
SENSITIVE = []
|
|
294
|
+
include Aws::Structure
|
|
295
|
+
end
|
|
296
|
+
|
|
297
|
+
end
|
|
298
|
+
end
|
|
299
|
+
|
|
@@ -0,0 +1,63 @@
|
|
|
1
|
+
# frozen_string_literal: true
|
|
2
|
+
|
|
3
|
+
# WARNING ABOUT GENERATED CODE
|
|
4
|
+
#
|
|
5
|
+
# This file is generated. See the contributing guide for more information:
|
|
6
|
+
# https://github.com/aws/aws-sdk-ruby/blob/version-3/CONTRIBUTING.md
|
|
7
|
+
#
|
|
8
|
+
# WARNING ABOUT GENERATED CODE
|
|
9
|
+
|
|
10
|
+
|
|
11
|
+
unless Module.const_defined?(:Aws)
|
|
12
|
+
require 'aws-sdk-core'
|
|
13
|
+
require 'aws-sigv4'
|
|
14
|
+
end
|
|
15
|
+
|
|
16
|
+
Aws::Plugins::GlobalConfiguration.add_identifier(:signin)
|
|
17
|
+
|
|
18
|
+
# This module provides support for AWS Sign-In Service. This module is available in the
|
|
19
|
+
# `aws-sdk-core` gem.
|
|
20
|
+
#
|
|
21
|
+
# # Client
|
|
22
|
+
#
|
|
23
|
+
# The {Client} class provides one method for each API operation. Operation
|
|
24
|
+
# methods each accept a hash of request parameters and return a response
|
|
25
|
+
# structure.
|
|
26
|
+
#
|
|
27
|
+
# signin = Aws::Signin::Client.new
|
|
28
|
+
# resp = signin.create_o_auth_2_token(params)
|
|
29
|
+
#
|
|
30
|
+
# See {Client} for more information.
|
|
31
|
+
#
|
|
32
|
+
# # Errors
|
|
33
|
+
#
|
|
34
|
+
# Errors returned from AWS Sign-In Service are defined in the
|
|
35
|
+
# {Errors} module and all extend {Errors::ServiceError}.
|
|
36
|
+
#
|
|
37
|
+
# begin
|
|
38
|
+
# # do stuff
|
|
39
|
+
# rescue Aws::Signin::Errors::ServiceError
|
|
40
|
+
# # rescues all AWS Sign-In Service API errors
|
|
41
|
+
# end
|
|
42
|
+
#
|
|
43
|
+
# See {Errors} for more information.
|
|
44
|
+
#
|
|
45
|
+
# @!group service
|
|
46
|
+
module Aws::Signin
|
|
47
|
+
autoload :Types, 'aws-sdk-signin/types'
|
|
48
|
+
autoload :ClientApi, 'aws-sdk-signin/client_api'
|
|
49
|
+
module Plugins
|
|
50
|
+
autoload :Endpoints, 'aws-sdk-signin/plugins/endpoints.rb'
|
|
51
|
+
end
|
|
52
|
+
autoload :Client, 'aws-sdk-signin/client'
|
|
53
|
+
autoload :Errors, 'aws-sdk-signin/errors'
|
|
54
|
+
autoload :Resource, 'aws-sdk-signin/resource'
|
|
55
|
+
autoload :EndpointParameters, 'aws-sdk-signin/endpoint_parameters'
|
|
56
|
+
autoload :EndpointProvider, 'aws-sdk-signin/endpoint_provider'
|
|
57
|
+
autoload :Endpoints, 'aws-sdk-signin/endpoints'
|
|
58
|
+
|
|
59
|
+
GEM_VERSION = '3.239.2'
|
|
60
|
+
|
|
61
|
+
end
|
|
62
|
+
|
|
63
|
+
require_relative 'aws-sdk-signin/customizations'
|
data/lib/aws-sdk-sso/client.rb
CHANGED
|
@@ -13,22 +13,22 @@ module Aws::SSO
|
|
|
13
13
|
# @!attribute region
|
|
14
14
|
# The AWS region used to dispatch the request.
|
|
15
15
|
#
|
|
16
|
-
# @return [
|
|
16
|
+
# @return [string]
|
|
17
17
|
#
|
|
18
18
|
# @!attribute use_dual_stack
|
|
19
19
|
# When true, use the dual-stack endpoint. If the configured endpoint does not support dual-stack, dispatching the request MAY return an error.
|
|
20
20
|
#
|
|
21
|
-
# @return [
|
|
21
|
+
# @return [boolean]
|
|
22
22
|
#
|
|
23
23
|
# @!attribute use_fips
|
|
24
24
|
# When true, send this request to the FIPS-compliant regional endpoint. If the configured endpoint does not have a FIPS compliant endpoint, dispatching the request will return an error.
|
|
25
25
|
#
|
|
26
|
-
# @return [
|
|
26
|
+
# @return [boolean]
|
|
27
27
|
#
|
|
28
28
|
# @!attribute endpoint
|
|
29
29
|
# Override the endpoint used to send this request
|
|
30
30
|
#
|
|
31
|
-
# @return [
|
|
31
|
+
# @return [string]
|
|
32
32
|
#
|
|
33
33
|
EndpointParameters = Struct.new(
|
|
34
34
|
:region,
|
data/lib/aws-sdk-sso.rb
CHANGED
|
@@ -523,10 +523,9 @@ module Aws::SSOOIDC
|
|
|
523
523
|
# [1]: https://docs.aws.amazon.com/singlesignon/latest/OIDCAPIReference/Welcome.html
|
|
524
524
|
#
|
|
525
525
|
# @option params [Array<String>] :scope
|
|
526
|
-
# The list of scopes for which authorization is requested.
|
|
527
|
-
#
|
|
528
|
-
#
|
|
529
|
-
# that are configured for the client during the call to RegisterClient.
|
|
526
|
+
# The list of scopes for which authorization is requested. This
|
|
527
|
+
# parameter has no effect; the access token will always include all
|
|
528
|
+
# scopes configured during client registration.
|
|
530
529
|
#
|
|
531
530
|
# @option params [String] :redirect_uri
|
|
532
531
|
# Used only when calling this API for the Authorization Code grant type.
|
|
@@ -615,12 +614,26 @@ module Aws::SSOOIDC
|
|
|
615
614
|
req.send_request(options)
|
|
616
615
|
end
|
|
617
616
|
|
|
618
|
-
# Creates and returns access and refresh tokens for
|
|
619
|
-
# applications that are authenticated using IAM
|
|
617
|
+
# Creates and returns access and refresh tokens for authorized client
|
|
618
|
+
# applications that are authenticated using any IAM entity, such as a
|
|
619
|
+
# service role or user. These tokens might contain defined scopes that
|
|
620
|
+
# specify permissions such as `read:profile` or `write:data`. Through
|
|
621
|
+
# downscoping, you can use the scopes parameter to request tokens with
|
|
622
|
+
# reduced permissions compared to the original client application's
|
|
623
|
+
# permissions or, if applicable, the refresh token's scopes. The access
|
|
620
624
|
# token can be used to fetch short-lived credentials for the assigned
|
|
621
625
|
# Amazon Web Services accounts or to access application APIs using
|
|
622
626
|
# `bearer` authentication.
|
|
623
627
|
#
|
|
628
|
+
# <note markdown="1"> This API is used with Signature Version 4. For more information, see
|
|
629
|
+
# [Amazon Web Services Signature Version 4 for API Requests][1].
|
|
630
|
+
#
|
|
631
|
+
# </note>
|
|
632
|
+
#
|
|
633
|
+
#
|
|
634
|
+
#
|
|
635
|
+
# [1]: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv.html
|
|
636
|
+
#
|
|
624
637
|
# @option params [required, String] :client_id
|
|
625
638
|
# The unique identifier string for the client or application. This value
|
|
626
639
|
# is an application ARN that has OAuth grants configured.
|
|
@@ -1068,7 +1081,7 @@ module Aws::SSOOIDC
|
|
|
1068
1081
|
tracer: tracer
|
|
1069
1082
|
)
|
|
1070
1083
|
context[:gem_name] = 'aws-sdk-core'
|
|
1071
|
-
context[:gem_version] = '3.
|
|
1084
|
+
context[:gem_version] = '3.239.2'
|
|
1072
1085
|
Seahorse::Client::Request.new(handlers, context)
|
|
1073
1086
|
end
|
|
1074
1087
|
|
|
@@ -15,6 +15,7 @@ module Aws::SSOOIDC
|
|
|
15
15
|
include Seahorse::Model
|
|
16
16
|
|
|
17
17
|
AccessDeniedException = Shapes::StructureShape.new(name: 'AccessDeniedException')
|
|
18
|
+
AccessDeniedExceptionReason = Shapes::StringShape.new(name: 'AccessDeniedExceptionReason')
|
|
18
19
|
AccessToken = Shapes::StringShape.new(name: 'AccessToken')
|
|
19
20
|
ArnType = Shapes::StringShape.new(name: 'ArnType')
|
|
20
21
|
Assertion = Shapes::StringShape.new(name: 'Assertion')
|
|
@@ -46,6 +47,7 @@ module Aws::SSOOIDC
|
|
|
46
47
|
InvalidGrantException = Shapes::StructureShape.new(name: 'InvalidGrantException')
|
|
47
48
|
InvalidRedirectUriException = Shapes::StructureShape.new(name: 'InvalidRedirectUriException')
|
|
48
49
|
InvalidRequestException = Shapes::StructureShape.new(name: 'InvalidRequestException')
|
|
50
|
+
InvalidRequestExceptionReason = Shapes::StringShape.new(name: 'InvalidRequestExceptionReason')
|
|
49
51
|
InvalidRequestRegionException = Shapes::StructureShape.new(name: 'InvalidRequestRegionException')
|
|
50
52
|
InvalidScopeException = Shapes::StructureShape.new(name: 'InvalidScopeException')
|
|
51
53
|
Location = Shapes::StringShape.new(name: 'Location')
|
|
@@ -69,6 +71,7 @@ module Aws::SSOOIDC
|
|
|
69
71
|
UserCode = Shapes::StringShape.new(name: 'UserCode')
|
|
70
72
|
|
|
71
73
|
AccessDeniedException.add_member(:error, Shapes::ShapeRef.new(shape: Error, location_name: "error"))
|
|
74
|
+
AccessDeniedException.add_member(:reason, Shapes::ShapeRef.new(shape: AccessDeniedExceptionReason, location_name: "reason"))
|
|
72
75
|
AccessDeniedException.add_member(:error_description, Shapes::ShapeRef.new(shape: ErrorDescription, location_name: "error_description"))
|
|
73
76
|
AccessDeniedException.struct_class = Types::AccessDeniedException
|
|
74
77
|
|
|
@@ -147,6 +150,7 @@ module Aws::SSOOIDC
|
|
|
147
150
|
InvalidRedirectUriException.struct_class = Types::InvalidRedirectUriException
|
|
148
151
|
|
|
149
152
|
InvalidRequestException.add_member(:error, Shapes::ShapeRef.new(shape: Error, location_name: "error"))
|
|
153
|
+
InvalidRequestException.add_member(:reason, Shapes::ShapeRef.new(shape: InvalidRequestExceptionReason, location_name: "reason"))
|
|
150
154
|
InvalidRequestException.add_member(:error_description, Shapes::ShapeRef.new(shape: ErrorDescription, location_name: "error_description"))
|
|
151
155
|
InvalidRequestException.struct_class = Types::InvalidRequestException
|
|
152
156
|
|
|
@@ -282,6 +286,7 @@ module Aws::SSOOIDC
|
|
|
282
286
|
o.errors << Shapes::ShapeRef.new(shape: InternalServerException)
|
|
283
287
|
o.errors << Shapes::ShapeRef.new(shape: InvalidRedirectUriException)
|
|
284
288
|
o.errors << Shapes::ShapeRef.new(shape: UnsupportedGrantTypeException)
|
|
289
|
+
o.errors << Shapes::ShapeRef.new(shape: SlowDownException)
|
|
285
290
|
end)
|
|
286
291
|
|
|
287
292
|
api.add_operation(:start_device_authorization, Seahorse::Model::Operation.new.tap do |o|
|
|
@@ -13,22 +13,22 @@ module Aws::SSOOIDC
|
|
|
13
13
|
# @!attribute region
|
|
14
14
|
# The AWS region used to dispatch the request.
|
|
15
15
|
#
|
|
16
|
-
# @return [
|
|
16
|
+
# @return [string]
|
|
17
17
|
#
|
|
18
18
|
# @!attribute use_dual_stack
|
|
19
19
|
# When true, use the dual-stack endpoint. If the configured endpoint does not support dual-stack, dispatching the request MAY return an error.
|
|
20
20
|
#
|
|
21
|
-
# @return [
|
|
21
|
+
# @return [boolean]
|
|
22
22
|
#
|
|
23
23
|
# @!attribute use_fips
|
|
24
24
|
# When true, send this request to the FIPS-compliant regional endpoint. If the configured endpoint does not have a FIPS compliant endpoint, dispatching the request will return an error.
|
|
25
25
|
#
|
|
26
|
-
# @return [
|
|
26
|
+
# @return [boolean]
|
|
27
27
|
#
|
|
28
28
|
# @!attribute endpoint
|
|
29
29
|
# Override the endpoint used to send this request
|
|
30
30
|
#
|
|
31
|
-
# @return [
|
|
31
|
+
# @return [string]
|
|
32
32
|
#
|
|
33
33
|
EndpointParameters = Struct.new(
|
|
34
34
|
:region,
|
|
@@ -62,6 +62,11 @@ module Aws::SSOOIDC
|
|
|
62
62
|
@data[:error]
|
|
63
63
|
end
|
|
64
64
|
|
|
65
|
+
# @return [String]
|
|
66
|
+
def reason
|
|
67
|
+
@data[:reason]
|
|
68
|
+
end
|
|
69
|
+
|
|
65
70
|
# @return [String]
|
|
66
71
|
def error_description
|
|
67
72
|
@data[:error_description]
|
|
@@ -222,6 +227,11 @@ module Aws::SSOOIDC
|
|
|
222
227
|
@data[:error]
|
|
223
228
|
end
|
|
224
229
|
|
|
230
|
+
# @return [String]
|
|
231
|
+
def reason
|
|
232
|
+
@data[:reason]
|
|
233
|
+
end
|
|
234
|
+
|
|
225
235
|
# @return [String]
|
|
226
236
|
def error_description
|
|
227
237
|
@data[:error_description]
|
|
@@ -17,6 +17,10 @@ module Aws::SSOOIDC
|
|
|
17
17
|
# `access_denied`.
|
|
18
18
|
# @return [String]
|
|
19
19
|
#
|
|
20
|
+
# @!attribute [rw] reason
|
|
21
|
+
# A string that uniquely identifies a reason for the error.
|
|
22
|
+
# @return [String]
|
|
23
|
+
#
|
|
20
24
|
# @!attribute [rw] error_description
|
|
21
25
|
# Human-readable text providing additional information, used to assist
|
|
22
26
|
# the client developer in understanding the error that occurred.
|
|
@@ -26,6 +30,7 @@ module Aws::SSOOIDC
|
|
|
26
30
|
#
|
|
27
31
|
class AccessDeniedException < Struct.new(
|
|
28
32
|
:error,
|
|
33
|
+
:reason,
|
|
29
34
|
:error_description)
|
|
30
35
|
SENSITIVE = []
|
|
31
36
|
include Aws::Structure
|
|
@@ -54,14 +59,20 @@ module Aws::SSOOIDC
|
|
|
54
59
|
end
|
|
55
60
|
|
|
56
61
|
# This structure contains Amazon Web Services-specific parameter
|
|
57
|
-
# extensions
|
|
58
|
-
#
|
|
62
|
+
# extensions and the [identity context][1].
|
|
63
|
+
#
|
|
64
|
+
#
|
|
65
|
+
#
|
|
66
|
+
# [1]: https://docs.aws.amazon.com/singlesignon/latest/userguide/trustedidentitypropagation-overview.html
|
|
59
67
|
#
|
|
60
68
|
# @!attribute [rw] identity_context
|
|
61
|
-
#
|
|
62
|
-
#
|
|
63
|
-
#
|
|
64
|
-
#
|
|
69
|
+
# The trusted context assertion is signed and encrypted by STS. It
|
|
70
|
+
# provides access to `sts:identity_context` claim in the `idToken`
|
|
71
|
+
# without JWT parsing
|
|
72
|
+
#
|
|
73
|
+
# Identity context comprises information that Amazon Web Services
|
|
74
|
+
# services use to make authorization decisions when they receive
|
|
75
|
+
# requests.
|
|
65
76
|
# @return [String]
|
|
66
77
|
#
|
|
67
78
|
# @see http://docs.aws.amazon.com/goto/WebAPI/sso-oidc-2019-06-10/AwsAdditionalDetails AWS API Documentation
|
|
@@ -122,11 +133,9 @@ module Aws::SSOOIDC
|
|
|
122
133
|
# @return [String]
|
|
123
134
|
#
|
|
124
135
|
# @!attribute [rw] scope
|
|
125
|
-
# The list of scopes for which authorization is requested.
|
|
126
|
-
#
|
|
127
|
-
#
|
|
128
|
-
# scopes that are configured for the client during the call to
|
|
129
|
-
# RegisterClient.
|
|
136
|
+
# The list of scopes for which authorization is requested. This
|
|
137
|
+
# parameter has no effect; the access token will always include all
|
|
138
|
+
# scopes configured during client registration.
|
|
130
139
|
# @return [Array<String>]
|
|
131
140
|
#
|
|
132
141
|
# @!attribute [rw] redirect_uri
|
|
@@ -376,10 +385,8 @@ module Aws::SSOOIDC
|
|
|
376
385
|
# @return [Array<String>]
|
|
377
386
|
#
|
|
378
387
|
# @!attribute [rw] aws_additional_details
|
|
379
|
-
# A structure containing information from
|
|
380
|
-
#
|
|
381
|
-
# `idToken`. This provides direct access to identity information
|
|
382
|
-
# without requiring JWT parsing.
|
|
388
|
+
# A structure containing information from IAM Identity Center managed
|
|
389
|
+
# user and group information.
|
|
383
390
|
# @return [Types::AwsAdditionalDetails]
|
|
384
391
|
#
|
|
385
392
|
# @see http://docs.aws.amazon.com/goto/WebAPI/sso-oidc-2019-06-10/CreateTokenWithIAMResponse AWS API Documentation
|
|
@@ -538,6 +545,10 @@ module Aws::SSOOIDC
|
|
|
538
545
|
# `invalid_request`.
|
|
539
546
|
# @return [String]
|
|
540
547
|
#
|
|
548
|
+
# @!attribute [rw] reason
|
|
549
|
+
# A string that uniquely identifies a reason for the error.
|
|
550
|
+
# @return [String]
|
|
551
|
+
#
|
|
541
552
|
# @!attribute [rw] error_description
|
|
542
553
|
# Human-readable text providing additional information, used to assist
|
|
543
554
|
# the client developer in understanding the error that occurred.
|
|
@@ -547,6 +558,7 @@ module Aws::SSOOIDC
|
|
|
547
558
|
#
|
|
548
559
|
class InvalidRequestException < Struct.new(
|
|
549
560
|
:error,
|
|
561
|
+
:reason,
|
|
550
562
|
:error_description)
|
|
551
563
|
SENSITIVE = []
|
|
552
564
|
include Aws::Structure
|