feat(auth): add support for sso-session (#3317)

## Problem
Users are unable to use SSO configurations created by newer versions of the AWS CLI.

For example, `aws configure sso` might produce something like this:

```ini
[profile default]
sso_session = default
sso_account_id = 012345678910
sso_role_name = MyRole

[sso-session default]
sso_region = us-east-1
sso_start_url = https://d-xxxxxxxxx.awsapps.com/start
sso_registration_scopes = sso:account:access
```
Users should be able to select the `default` profile in the Toolkit.

## Solution

Support `sso-session` sections and the corresponding `sso_session` property.

This PR does not surface SSO sections in the UI. Only profiles are valid options.

Author: JadenSimon

.changes/next-release/Feature-446943a0-44eb-40c0-bf12-93c34cf8961b.json

@@ -0,0 +1,4 @@
+{
+	"type": "Feature",
+	"description": "auth: support `sso_session` for profiles in AWS shared ini files"
+}

src/credentials/credentialsUtilities.ts

@@ -9,12 +9,12 @@ const localize = nls.loadMessageBundle()
 import * as vscode from 'vscode'
 import { Credentials } from '@aws-sdk/types'
 import { authHelpUrl } from '../shared/constants'
-import { Profile } from '../shared/credentials/credentialsFile'
 import globals from '../shared/extensionGlobals'
 import { isCloud9 } from '../shared/extensionUtilities'
 import { messages, showMessageWithCancel, showViewLogsMessage } from '../shared/utilities/messages'
 import { Timeout, waitTimeout } from '../shared/utilities/timeoutUtils'
 import { fromExtensionManifest } from '../shared/settings'
+import { Profile } from './sharedCredentials'
 
 const credentialsTimeout = 300000 // 5 minutes
 const credentialsProgressDelay = 1000

src/credentials/providers/sharedCredentialsProvider.ts

@@ -10,18 +10,27 @@ import { ParsedIniData, SharedConfigFiles } from '@aws-sdk/shared-ini-file-loade
 import { chain } from '@aws-sdk/property-provider'
 import { fromInstanceMetadata, fromContainerMetadata } from '@aws-sdk/credential-provider-imds'
 import { fromEnv } from '@aws-sdk/credential-provider-env'
-import { Profile } from '../../shared/credentials/credentialsFile'
 import { getLogger } from '../../shared/logger'
 import { getStringHash } from '../../shared/utilities/textUtilities'
 import { getMfaTokenFromUser } from '../credentialsCreator'
 import { resolveProviderWithCancel } from '../credentialsUtilities'
 import { CredentialsProvider, CredentialsProviderType, CredentialsId } from './credentials'
 import { CredentialType } from '../../shared/telemetry/telemetry.gen'
-import { getMissingProps, hasProps } from '../../shared/utilities/tsUtils'
+import { assertHasProps, getMissingProps, hasProps } from '../../shared/utilities/tsUtils'
 import { DefaultStsClient } from '../../shared/clients/stsClient'
 import { SsoAccessTokenProvider } from '../sso/ssoAccessTokenProvider'
 import { SsoClient } from '../sso/clients'
 import { toRecord } from '../../shared/utilities/collectionUtils'
+import {
+    extractData,
+    getRequiredFields,
+    getSectionDataOrThrow,
+    getSectionOrThrow,
+    isProfileSection,
+    Profile,
+    Section,
+} from '../sharedCredentials'
+import { hasScopes, SsoProfile } from '../auth'
 
 const sharedCredentialProperties = {
     AWS_ACCESS_KEY_ID: 'aws_access_key_id',
@@ -37,6 +46,8 @@ const sharedCredentialProperties = {
     SSO_REGION: 'sso_region',
     SSO_ACCOUNT_ID: 'sso_account_id',
     SSO_ROLE_NAME: 'sso_role_name',
+    SSO_SESSION: 'sso_session',
+    SSO_REGISTRATION_SCOPES: 'sso_registration_scopes',
 } as const
 
 const credentialSources = {
@@ -55,6 +66,7 @@ function validateProfile(profile: Profile, ...props: string[]): string | undefin
 
 function isSsoProfile(profile: Profile): boolean {
     return (
+        hasProps(profile, sharedCredentialProperties.SSO_SESSION) ||
         hasProps(profile, sharedCredentialProperties.SSO_START_URL) ||
         hasProps(profile, sharedCredentialProperties.SSO_REGION) ||
         hasProps(profile, sharedCredentialProperties.SSO_ROLE_NAME) ||
@@ -66,20 +78,10 @@ function isSsoProfile(profile: Profile): boolean {
  * Represents one profile from the AWS Shared Credentials files.
  */
 export class SharedCredentialsProvider implements CredentialsProvider {
-    private readonly profile: Profile
+    private readonly section = getSectionOrThrow(this.sections, this.profileName, 'profile')
+    private readonly profile = extractData(this.section)
 
-    public constructor(
-        private readonly profileName: string,
-        private readonly allSharedCredentialProfiles: Map<string, Profile>
-    ) {
-        const profile = this.allSharedCredentialProfiles.get(profileName)
-
-        if (!profile) {
-            throw new Error(`Profile not found: ${profileName}`)
-        }
-
-        this.profile = profile
-    }
+    public constructor(private readonly profileName: string, private readonly sections: Section[]) {}
 
     public getCredentialsId(): CredentialsId {
         return {
@@ -139,6 +141,37 @@ export class SharedCredentialsProvider implements CredentialsProvider {
         return true
     }
 
+    private getProfile(name: string) {
+        return getSectionDataOrThrow(this.sections, name, 'profile')
+    }
+
+    private getSsoProfileFromProfile(): SsoProfile & { identifier?: string } {
+        const defaultRegion = this.getDefaultRegion() ?? 'us-east-1'
+        const sessionName = this.profile[sharedCredentialProperties.SSO_SESSION]
+        if (sessionName === undefined) {
+            assertHasProps(this.profile, sharedCredentialProperties.SSO_START_URL)
+
+            return {
+                type: 'sso',
+                scopes: ['sso:account:access'],
+                startUrl: this.profile[sharedCredentialProperties.SSO_START_URL],
+                ssoRegion: this.profile[sharedCredentialProperties.SSO_REGION] ?? defaultRegion,
+            }
+        }
+
+        const sessionData = getSectionDataOrThrow(this.sections, sessionName, 'sso-session')
+        const scopes = sessionData[sharedCredentialProperties.SSO_REGISTRATION_SCOPES]
+        assertHasProps(sessionData, sharedCredentialProperties.SSO_START_URL)
+
+        return {
+            type: 'sso',
+            identifier: sessionName,
+            scopes: scopes?.split(',').map(s => s.trim()),
+            startUrl: sessionData[sharedCredentialProperties.SSO_START_URL],
+            ssoRegion: sessionData[sharedCredentialProperties.SSO_REGION] ?? defaultRegion,
+        }
+    }
+
     /**
      * Returns undefined if the Profile is valid, else a string indicating what is invalid
      */
@@ -161,13 +194,7 @@ export class SharedCredentialsProvider implements CredentialsProvider {
                 sharedCredentialProperties.AWS_SECRET_ACCESS_KEY
             )
         } else if (isSsoProfile(this.profile)) {
-            return validateProfile(
-                this.profile,
-                sharedCredentialProperties.SSO_START_URL,
-                sharedCredentialProperties.SSO_REGION,
-                sharedCredentialProperties.SSO_ROLE_NAME,
-                sharedCredentialProperties.SSO_ACCOUNT_ID
-            )
+            return undefined
         } else {
             return 'not supported by the Toolkit'
         }
@@ -191,7 +218,7 @@ export class SharedCredentialsProvider implements CredentialsProvider {
 
         const source = new SharedCredentialsProvider(
             this.profile[sharedCredentialProperties.SOURCE_PROFILE]!,
-            this.allSharedCredentialProfiles
+            this.sections
         )
         const creds = await source.getCredentials()
         loadedCreds[this.profile[sharedCredentialProperties.SOURCE_PROFILE]!] = {
@@ -252,13 +279,13 @@ export class SharedCredentialsProvider implements CredentialsProvider {
             profilesTraversed.push(profileName)
 
             // Missing reference
-            if (!this.allSharedCredentialProfiles.has(profileName)) {
+            if (!this.sections.find(s => s.name === profileName && s.type === 'profile')) {
                 return `Shared Credentials Profile ${profileName} not found. Reference chain: ${profilesTraversed.join(
                     ' -> '
                 )}`
             }
 
-            profile = this.allSharedCredentialProfiles.get(profileName)!
+            profile = this.getProfile(profileName)
         }
     }
 
@@ -315,31 +342,44 @@ export class SharedCredentialsProvider implements CredentialsProvider {
             return this.makeSharedIniFileCredentialsProvider(loadedCreds)
         }
 
-        if (hasProps(this.profile, sharedCredentialProperties.SSO_START_URL)) {
-            logger.verbose(
-                `Profile ${this.profileName} contains ${sharedCredentialProperties.SSO_START_URL} - treating as SSO Credentials`
-            )
-
-            const region = this.profile[sharedCredentialProperties.SSO_REGION]!
-            const startUrl = this.profile[sharedCredentialProperties.SSO_START_URL]!
-            const accountId = this.profile[sharedCredentialProperties.SSO_ACCOUNT_ID]!
-            const roleName = this.profile[sharedCredentialProperties.SSO_ROLE_NAME]!
-            const tokenProvider = new SsoAccessTokenProvider({ region, startUrl })
-            const client = SsoClient.create(region, tokenProvider)
-
-            return async () => {
-                if ((await tokenProvider.getToken()) === undefined) {
-                    await tokenProvider.createToken()
-                }
+        if (isSsoProfile(this.profile)) {
+            logger.verbose(`Profile ${this.profileName} is an SSO profile - treating as SSO Credentials`)
 
-                return client.getRoleCredentials({ accountId, roleName })
-            }
+            return this.makeSsoCredentaislProvider()
         }
 
         logger.error(`Profile ${this.profileName} did not contain any supported properties`)
         throw new Error(`Shared Credentials profile ${this.profileName} is not supported`)
     }
 
+    private makeSsoCredentaislProvider() {
+        const ssoProfile = this.getSsoProfileFromProfile()
+        if (!hasScopes(ssoProfile, ['sso:account:access'])) {
+            throw new Error(`Session for "${this.profileName}" is missing required scope: sso:account:access`)
+        }
+
+        const region = ssoProfile.ssoRegion
+        const tokenProvider = new SsoAccessTokenProvider({ ...ssoProfile, region })
+        const client = SsoClient.create(region, tokenProvider)
+
+        return async () => {
+            if ((await tokenProvider.getToken()) === undefined) {
+                await tokenProvider.createToken()
+            }
+
+            const data = getRequiredFields(
+                this.section,
+                sharedCredentialProperties.SSO_ACCOUNT_ID,
+                sharedCredentialProperties.SSO_ROLE_NAME
+            )
+
+            return client.getRoleCredentials({
+                accountId: data[sharedCredentialProperties.SSO_ACCOUNT_ID],
+                roleName: data[sharedCredentialProperties.SSO_ROLE_NAME],
+            })
+        }
+    }
+
     private makeSharedIniFileCredentialsProvider(loadedCreds?: ParsedIniData): AWS.CredentialProvider {
         const assumeRole = async (credentials: AWS.Credentials, params: AssumeRoleParams) => {
             const region = this.getDefaultRegion() ?? 'us-east-1'
@@ -356,7 +396,11 @@ export class SharedCredentialsProvider implements CredentialsProvider {
         // Our credentials logic merges profiles from the credentials and config files but SDK v3 does not
         // This can cause odd behavior where the Toolkit can switch to a profile but not authenticate with it
         // So the workaround is to do give the SDK the merged profiles directly
-        const profiles = toRecord(this.allSharedCredentialProfiles.keys(), k => this.allSharedCredentialProfiles.get(k))
+        const profileSections = this.sections.filter(isProfileSection)
+        const profiles = toRecord(
+            profileSections.map(s => s.name),
+            k => this.getProfile(k)
+        )
 
         return fromIni({
             profile: this.profileName,

src/credentials/providers/sharedCredentialsProviderFactory.ts

@@ -8,7 +8,7 @@ import { getLogger, Logger } from '../../shared/logger'
 import {
     getConfigFilename,
     getCredentialsFilename,
-    loadSharedCredentialsProfiles,
+    loadSharedCredentialsSections,
     updateAwsSdkLoadConfigEnvVar,
 } from '../sharedCredentials'
 import { CredentialsProviderType } from './credentials'
@@ -51,24 +51,25 @@ export class SharedCredentialsProviderFactory extends BaseCredentialsProviderFac
     private async loadSharedCredentialsProviders(): Promise<void> {
         this.resetProviders()
 
-        this.logger.verbose('Loading all Shared Credentials Profiles')
-        const allCredentialProfiles = await loadSharedCredentialsProfiles()
+        this.logger.verbose('Loading all Shared Credentials Sections')
+        const result = await loadSharedCredentialsSections()
+        if (result.errors.length > 0) {
+            const errors = result.errors.map(e => e.message).join('\t\n')
+            getLogger().verbose(`credentials: errors occurred while parsing:\n%s`, errors)
+        }
+
         this.loadedCredentialsModificationMillis = await this.getLastModifiedMillis(getCredentialsFilename())
         this.loadedConfigModificationMillis = await this.getLastModifiedMillis(getConfigFilename())
         await updateAwsSdkLoadConfigEnvVar()
 
-        const profileNames = Array.from(allCredentialProfiles.keys())
-        getLogger().verbose(`credentials: found profiles: ${profileNames}`)
-        for (const profileName of profileNames) {
-            const profile = allCredentialProfiles.get(profileName)
-            if (!profile) {
-                continue
+        getLogger().verbose(`credentials: found sections: ${result.sections.map(s => `${s.type}:${s.name}`)}`)
+        for (const section of result.sections) {
+            if (section.type === 'profile') {
+                await this.addProviderIfValid(
+                    section.name,
+                    new SharedCredentialsProvider(section.name, result.sections)
+                )
             }
-
-            await this.addProviderIfValid(
-                profileName,
-                new SharedCredentialsProvider(profileName, allCredentialProfiles)
-            )
         }
     }