Skip to content

Commit 41f4cc5

Browse files
author
awstools
committed
feat(client-verifiedpermissions): This release adds OpenIdConnect (OIDC) configuration support for IdentitySources, allowing for external IDPs to be used in authorization requests.
1 parent 9bed782 commit 41f4cc5

File tree

8 files changed

+1802
-103
lines changed

8 files changed

+1802
-103
lines changed

‎clients/client-verifiedpermissions/src/commands/CreateIdentitySourceCommand.ts‎

Lines changed: 47 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -36,31 +36,36 @@ export interface CreateIdentitySourceCommandInput extends CreateIdentitySourceIn
3636
export interface CreateIdentitySourceCommandOutput extends CreateIdentitySourceOutput, __MetadataBearer {}
3737

3838
/**
39-
* <p>Creates a reference to an Amazon Cognito user pool as an external identity provider (IdP).
39+
* <p>Adds an identity source to a policy store–an Amazon Cognito user pool or OpenID Connect
40+
* (OIDC) identity provider (IdP).
4041
* </p>
4142
* <p>After you create an identity source, you can use the identities provided by the IdP as proxies
42-
* for the principal in authorization queries that use the <a href="https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_IsAuthorizedWithToken.html">IsAuthorizedWithToken</a>
43-
* operation. These identities take the form of tokens that contain claims about the user,
44-
* such as IDs, attributes and group memberships. Amazon Cognito provides both identity tokens and
45-
* access tokens, and Verified Permissions can use either or both. Any combination of identity and access
46-
* tokens results in the same Cedar principal. Verified Permissions automatically translates the
47-
* information about the identities into the standard Cedar attributes that can be
48-
* evaluated by your policies. Because the Amazon Cognito identity and access tokens can contain
49-
* different information, the tokens you choose to use determine which principal attributes
50-
* are available to access when evaluating Cedar policies.</p>
43+
* for the principal in authorization queries that use the <a href="https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_IsAuthorizedWithToken.html">IsAuthorizedWithToken</a> or
44+
* <a href="https://docs.aws.amazon.com/verifiedpermissions/latest/apireference/API_BatchIsAuthorizedWithToken.html">BatchIsAuthorizedWithToken</a> API operations. These identities take the form
45+
* of tokens that contain claims about the user, such as IDs, attributes and group
46+
* memberships. Identity sources provide identity (ID) tokens and access tokens. Verified Permissions
47+
* derives information about your user and session from token claims. Access tokens provide
48+
* action <code>context</code> to your policies, and ID tokens provide principal
49+
* <code>Attributes</code>.</p>
5150
* <important>
52-
* <p>If you delete a Amazon Cognito user pool or user, tokens from that deleted pool or that deleted user continue to be usable until they expire.</p>
51+
* <p>Tokens from an identity source user continue to be usable until they expire.
52+
* Token revocation and resource deletion have no effect on the validity of a token in your policy store</p>
5353
* </important>
5454
* <note>
55-
* <p>To reference a user from this identity source in your Cedar policies, use the following
56-
* syntax.</p>
57-
* <p>
58-
* <i>IdentityType::"&lt;CognitoUserPoolIdentifier&gt;|&lt;CognitoClientId&gt;</i>
59-
* </p>
60-
* <p>Where <code>IdentityType</code> is the string that you provide to the
61-
* <code>PrincipalEntityType</code> parameter for this operation. The
62-
* <code>CognitoUserPoolId</code> and <code>CognitoClientId</code> are defined by
63-
* the Amazon Cognito user pool.</p>
55+
* <p>To reference a user from this identity source in your Cedar policies, refer to the
56+
* following syntax examples.</p>
57+
* <ul>
58+
* <li>
59+
* <p>Amazon Cognito user pool: <code>Namespace::[Entity type]::[User pool ID]|[user
60+
* principal attribute]</code>, for example
61+
* <code>MyCorp::User::us-east-1_EXAMPLE|a1b2c3d4-5678-90ab-cdef-EXAMPLE11111</code>.</p>
62+
* </li>
63+
* <li>
64+
* <p>OpenID Connect (OIDC) provider: <code>Namespace::[Entity
65+
* type]::[principalIdClaim]|[user principal attribute]</code>, for example
66+
* <code>MyCorp::User::MyOIDCProvider|a1b2c3d4-5678-90ab-cdef-EXAMPLE22222</code>.</p>
67+
* </li>
68+
* </ul>
6469
* </note>
6570
* <note>
6671
* <p>Verified Permissions is <i>
@@ -87,6 +92,28 @@ export interface CreateIdentitySourceCommandOutput extends CreateIdentitySourceO
8792
* groupEntityType: "STRING_VALUE", // required
8893
* },
8994
* },
95+
* openIdConnectConfiguration: { // OpenIdConnectConfiguration
96+
* issuer: "STRING_VALUE", // required
97+
* entityIdPrefix: "STRING_VALUE",
98+
* groupConfiguration: { // OpenIdConnectGroupConfiguration
99+
* groupClaim: "STRING_VALUE", // required
100+
* groupEntityType: "STRING_VALUE", // required
101+
* },
102+
* tokenSelection: { // OpenIdConnectTokenSelection Union: only one key present
103+
* accessTokenOnly: { // OpenIdConnectAccessTokenConfiguration
104+
* principalIdClaim: "STRING_VALUE",
105+
* audiences: [ // Audiences
106+
* "STRING_VALUE",
107+
* ],
108+
* },
109+
* identityTokenOnly: { // OpenIdConnectIdentityTokenConfiguration
110+
* principalIdClaim: "STRING_VALUE",
111+
* clientIds: [
112+
* "STRING_VALUE",
113+
* ],
114+
* },
115+
* },
116+
* },
90117
* },
91118
* principalEntityType: "STRING_VALUE",
92119
* };

‎clients/client-verifiedpermissions/src/commands/GetIdentitySourceCommand.ts‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -74,6 +74,26 @@ export interface GetIdentitySourceCommandOutput extends GetIdentitySourceOutput,
7474
* // groupEntityType: "STRING_VALUE",
7575
* // },
7676
* // },
77+
* // openIdConnectConfiguration: { // OpenIdConnectConfigurationDetail
78+
* // issuer: "STRING_VALUE", // required
79+
* // entityIdPrefix: "STRING_VALUE",
80+
* // groupConfiguration: { // OpenIdConnectGroupConfigurationDetail
81+
* // groupClaim: "STRING_VALUE", // required
82+
* // groupEntityType: "STRING_VALUE", // required
83+
* // },
84+
* // tokenSelection: { // OpenIdConnectTokenSelectionDetail Union: only one key present
85+
* // accessTokenOnly: { // OpenIdConnectAccessTokenConfigurationDetail
86+
* // principalIdClaim: "STRING_VALUE",
87+
* // audiences: [ // Audiences
88+
* // "STRING_VALUE",
89+
* // ],
90+
* // },
91+
* // identityTokenOnly: { // OpenIdConnectIdentityTokenConfigurationDetail
92+
* // principalIdClaim: "STRING_VALUE",
93+
* // clientIds: "<ClientIds>",
94+
* // },
95+
* // },
96+
* // },
7797
* // },
7898
* // };
7999
*

‎clients/client-verifiedpermissions/src/commands/IsAuthorizedWithTokenCommand.ts‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,8 @@ export interface IsAuthorizedWithTokenCommandOutput extends IsAuthorizedWithToke
4949
* <p>Verified Permissions validates each token that is specified in a request by checking its expiration
5050
* date and its signature.</p>
5151
* <important>
52-
* <p>If you delete a Amazon Cognito user pool or user, tokens from that deleted pool or that deleted user continue to be usable until they expire.</p>
52+
* <p>Tokens from an identity source user continue to be usable until they expire.
53+
* Token revocation and resource deletion have no effect on the validity of a token in your policy store</p>
5354
* </important>
5455
* @example
5556
* Use a bare-bones client and the command you need to make an API call.

‎clients/client-verifiedpermissions/src/commands/ListIdentitySourcesCommand.ts‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,26 @@ export interface ListIdentitySourcesCommandOutput extends ListIdentitySourcesOut
8484
* // groupEntityType: "STRING_VALUE",
8585
* // },
8686
* // },
87+
* // openIdConnectConfiguration: { // OpenIdConnectConfigurationItem
88+
* // issuer: "STRING_VALUE", // required
89+
* // entityIdPrefix: "STRING_VALUE",
90+
* // groupConfiguration: { // OpenIdConnectGroupConfigurationItem
91+
* // groupClaim: "STRING_VALUE", // required
92+
* // groupEntityType: "STRING_VALUE", // required
93+
* // },
94+
* // tokenSelection: { // OpenIdConnectTokenSelectionItem Union: only one key present
95+
* // accessTokenOnly: { // OpenIdConnectAccessTokenConfigurationItem
96+
* // principalIdClaim: "STRING_VALUE",
97+
* // audiences: [ // Audiences
98+
* // "STRING_VALUE",
99+
* // ],
100+
* // },
101+
* // identityTokenOnly: { // OpenIdConnectIdentityTokenConfigurationItem
102+
* // principalIdClaim: "STRING_VALUE",
103+
* // clientIds: "<ClientIds>",
104+
* // },
105+
* // },
106+
* // },
87107
* // },
88108
* // },
89109
* // ],

‎clients/client-verifiedpermissions/src/commands/UpdateIdentitySourceCommand.ts‎

Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ export interface UpdateIdentitySourceCommandInput extends UpdateIdentitySourceIn
3636
export interface UpdateIdentitySourceCommandOutput extends UpdateIdentitySourceOutput, __MetadataBearer {}
3737

3838
/**
39-
* <p>Updates the specified identity source to use a new identity provider (IdP) source, or to change
39+
* <p>Updates the specified identity source to use a new identity provider (IdP), or to change
4040
* the mapping of identities from the IdP to a different principal entity type.</p>
4141
* <note>
4242
* <p>Verified Permissions is <i>
@@ -63,6 +63,28 @@ export interface UpdateIdentitySourceCommandOutput extends UpdateIdentitySourceO
6363
* groupEntityType: "STRING_VALUE", // required
6464
* },
6565
* },
66+
* openIdConnectConfiguration: { // UpdateOpenIdConnectConfiguration
67+
* issuer: "STRING_VALUE", // required
68+
* entityIdPrefix: "STRING_VALUE",
69+
* groupConfiguration: { // UpdateOpenIdConnectGroupConfiguration
70+
* groupClaim: "STRING_VALUE", // required
71+
* groupEntityType: "STRING_VALUE", // required
72+
* },
73+
* tokenSelection: { // UpdateOpenIdConnectTokenSelection Union: only one key present
74+
* accessTokenOnly: { // UpdateOpenIdConnectAccessTokenConfiguration
75+
* principalIdClaim: "STRING_VALUE",
76+
* audiences: [ // Audiences
77+
* "STRING_VALUE",
78+
* ],
79+
* },
80+
* identityTokenOnly: { // UpdateOpenIdConnectIdentityTokenConfiguration
81+
* principalIdClaim: "STRING_VALUE",
82+
* clientIds: [
83+
* "STRING_VALUE",
84+
* ],
85+
* },
86+
* },
87+
* },
6688
* },
6789
* principalEntityType: "STRING_VALUE",
6890
* };

0 commit comments

Comments
 (0)