Skip to content

Commit 0283ae5

Browse files
dkocherdkocher
committed
Add role ARN as parameter.
1 parent 67581fb commit 0283ae5

File tree

4 files changed

+35
-25
lines changed

4 files changed

+35
-25
lines changed

‎s3/src/main/java/ch/cyberduck/core/sts/STSAssumeRoleRequestInterceptor.java‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -51,10 +51,12 @@ public STSAssumeRoleRequestInterceptor(final Host host, final X509TrustManager t
5151
public TemporaryAccessTokens refresh(final Credentials credentials) throws BackgroundException {
5252
lock.lock();
5353
try {
54-
if(StringUtils.isNotBlank(new ProxyPreferencesReader(credentials, host).getProperty(Profile.STS_ROLE_ARN_PROPERTY_KEY, "s3.assumerole.rolearn"))) {
54+
final String arn = new ProxyPreferencesReader(host, credentials).getProperty(Profile.STS_ROLE_ARN_PROPERTY_KEY, "s3.assumerole.rolearn");
55+
log.debug("Use ARN {}", arn);
56+
if(StringUtils.isNotBlank(arn)) {
5557
log.debug("Retrieve temporary credentials with {}", credentials);
5658
// AssumeRoleRequest
57-
return tokens = this.assumeRole(credentials);
59+
return tokens = this.assumeRole(credentials, arn);
5860
}
5961
log.warn("Skip requesting tokens from token service for {}", credentials);
6062
return TemporaryAccessTokens.EMPTY;

‎s3/src/main/java/ch/cyberduck/core/sts/STSAssumeRoleWithWebIdentityRequestInterceptor.java‎

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,13 +18,16 @@
1818
import ch.cyberduck.core.Credentials;
1919
import ch.cyberduck.core.Host;
2020
import ch.cyberduck.core.LoginCallback;
21+
import ch.cyberduck.core.Profile;
2122
import ch.cyberduck.core.TemporaryAccessTokens;
2223
import ch.cyberduck.core.exception.BackgroundException;
2324
import ch.cyberduck.core.oauth.OAuth2RequestInterceptor;
25+
import ch.cyberduck.core.preferences.ProxyPreferencesReader;
2426
import ch.cyberduck.core.s3.S3CredentialsStrategy;
2527
import ch.cyberduck.core.ssl.X509KeyManager;
2628
import ch.cyberduck.core.ssl.X509TrustManager;
2729

30+
import org.apache.commons.lang3.StringUtils;
2831
import org.apache.http.HttpRequestInterceptor;
2932
import org.apache.logging.log4j.LogManager;
3033
import org.apache.logging.log4j.Logger;
@@ -43,21 +46,27 @@ public class STSAssumeRoleWithWebIdentityRequestInterceptor extends STSRequestIn
4346
* Handle authentication with OpenID connect retrieving token for STS
4447
*/
4548
private final OAuth2RequestInterceptor oauth;
49+
private final Host host;
4650

4751
public STSAssumeRoleWithWebIdentityRequestInterceptor(final OAuth2RequestInterceptor oauth, final Host host,
4852
final X509TrustManager trust, final X509KeyManager key,
4953
final LoginCallback prompt) {
5054
super(host, trust, key, prompt);
5155
this.oauth = oauth;
56+
this.host = host;
5257
}
5358

5459
@Override
5560
public TemporaryAccessTokens refresh(final Credentials credentials) throws BackgroundException {
5661
lock.lock();
5762
try {
58-
credentials.setOauth(oauth.refresh(credentials.getOauth()));
59-
log.debug("Retrieve temporary credentials with {}", credentials);
60-
return tokens = this.assumeRoleWithWebIdentity(credentials);
63+
final String arn = new ProxyPreferencesReader(host, credentials).getProperty(Profile.STS_ROLE_ARN_PROPERTY_KEY, "s3.assumerole.rolearn");
64+
log.debug("Use ARN {}", arn);
65+
if(StringUtils.isNotBlank(arn)) {
66+
return tokens = this.assumeRoleWithWebIdentity(oauth.refresh(credentials.getOauth()), arn);
67+
}
68+
log.warn("Skip requesting tokens from token service for {}", credentials);
69+
return TemporaryAccessTokens.EMPTY;
6170
}
6271
finally {
6372
lock.unlock();

‎s3/src/main/java/ch/cyberduck/core/sts/STSAuthorizationService.java‎

Lines changed: 15 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -102,13 +102,11 @@ public String getCallerIdentity(final Credentials credentials) throws Background
102102
}
103103
}
104104

105-
public TemporaryAccessTokens getSessionToken(final Credentials credentials) throws BackgroundException {
105+
public TemporaryAccessTokens getSessionToken(final Credentials credentials, final String mfaArn) throws BackgroundException {
106106
log.debug("Get session token with credentials {} for {}", credentials, bookmark);
107-
final PreferencesReader settings = new ProxyPreferencesReader(credentials, bookmark);
108107
// The purpose of the sts:GetSessionToken operation is to authenticate the user using MFA.
109108
final GetSessionTokenRequest request = new GetSessionTokenRequest()
110109
.withRequestCredentialsProvider(S3CredentialsStrategy.toCredentialsProvider(credentials));
111-
final String mfaArn = settings.getProperty(Profile.STS_MFA_ARN_PROPERTY_KEY);
112110
if(StringUtils.isNotBlank(mfaArn)) {
113111
log.debug("Found MFA ARN {} for {}", mfaArn, bookmark);
114112
request.setSerialNumber(mfaArn);
@@ -173,9 +171,9 @@ public TemporaryAccessTokens getSessionToken(final Credentials credentials) thro
173171
* @see Profile#STS_ROLE_ARN_PROPERTY_KEY
174172
* @see Profile#STS_MFA_ARN_PROPERTY_KEY
175173
*/
176-
public TemporaryAccessTokens assumeRole(final Credentials credentials) throws BackgroundException {
174+
public TemporaryAccessTokens assumeRole(final Credentials credentials, final String roleArn) throws BackgroundException {
177175
log.debug("Assume role with credentials {} for {}", credentials, bookmark);
178-
final PreferencesReader settings = new ProxyPreferencesReader(credentials, bookmark);
176+
final PreferencesReader settings = new ProxyPreferencesReader(bookmark, credentials);
179177
final AssumeRoleRequest request = new AssumeRoleRequest()
180178
.withRequestCredentialsProvider(S3CredentialsStrategy.toCredentialsProvider(credentials));
181179
if(StringUtils.isNotBlank(settings.getProperty("s3.assumerole.durationseconds", Profile.STS_DURATION_SECONDS_PROPERTY_KEY))) {
@@ -184,7 +182,6 @@ public TemporaryAccessTokens assumeRole(final Credentials credentials) throws Ba
184182
request.setTags(settings.getMap(Profile.STS_TAGS_PROPERTY_KEY).entrySet().stream().map(
185183
entry -> new Tag().withKey(entry.getKey()).withValue(entry.getValue())).collect(Collectors.toList())
186184
);
187-
final String roleArn = settings.getProperty(Profile.STS_ROLE_ARN_PROPERTY_KEY, "s3.assumerole.rolearn");
188185
if(StringUtils.isNotBlank(roleArn)) {
189186
log.debug("Found Role ARN {} for {}", roleArn, bookmark);
190187
request.setRoleArn(roleArn);
@@ -264,15 +261,15 @@ public TemporaryAccessTokens assumeRole(final Credentials credentials) throws Ba
264261
}
265262
}
266263

267-
public TemporaryAccessTokens assumeRoleWithSAML(final Credentials credentials) throws BackgroundException {
268-
log.debug("Assume role with SAML with credentials {} for {}", credentials, bookmark);
269-
final PreferencesReader settings = new ProxyPreferencesReader(credentials, bookmark);
270-
final AssumeRoleWithSAMLRequest request = new AssumeRoleWithSAMLRequest().withSAMLAssertion(credentials.getToken());
264+
public TemporaryAccessTokens assumeRoleWithSAML(final String samlAssertion, final String roleArn) throws BackgroundException {
265+
log.debug("Assume role with SAML with assertion {} for {}", samlAssertion, bookmark);
266+
final PreferencesReader settings = HostPreferencesFactory.get(bookmark);
267+
final AssumeRoleWithSAMLRequest request = new AssumeRoleWithSAMLRequest().withSAMLAssertion(samlAssertion)
268+
.withRequestCredentialsProvider(new AWSStaticCredentialsProvider(new AnonymousAWSCredentials()));
271269
if(StringUtils.isNotBlank(settings.getProperty("s3.assumerole.durationseconds", Profile.STS_DURATION_SECONDS_PROPERTY_KEY))) {
272270
request.setDurationSeconds(PreferencesReader.toInteger(settings.getProperty("s3.assumerole.durationseconds", Profile.STS_DURATION_SECONDS_PROPERTY_KEY)));
273271
}
274272
request.setPolicy(settings.getProperty("s3.assumerole.policy"));
275-
final String roleArn = settings.getProperty(Profile.STS_ROLE_ARN_PROPERTY_KEY, "s3.assumerole.rolearn");
276273
if(StringUtils.isNotBlank(roleArn)) {
277274
log.debug("Found Role ARN {} for {}", roleArn, bookmark);
278275
request.setRoleArn(roleArn);
@@ -293,21 +290,21 @@ public TemporaryAccessTokens assumeRoleWithSAML(final Credentials credentials) t
293290
/**
294291
* Assume role with web identity token
295292
*
296-
* @param credentials OIDC tokens
293+
* @param oauth OIDC tokens
297294
* @return Temporary access tokens for the assumed role
298295
*/
299-
public TemporaryAccessTokens assumeRoleWithWebIdentity(final Credentials credentials) throws BackgroundException {
300-
log.debug("Assume role with web identity with credentials {} for {}", credentials, bookmark);
301-
final PreferencesReader settings = new ProxyPreferencesReader(credentials, bookmark);
302-
final AssumeRoleWithWebIdentityRequest request = new AssumeRoleWithWebIdentityRequest();
296+
public TemporaryAccessTokens assumeRoleWithWebIdentity(final OAuthTokens oauth, final String roleArn) throws BackgroundException {
297+
log.debug("Assume role with web identity {} for {}", oauth, bookmark);
298+
final PreferencesReader settings = HostPreferencesFactory.get(bookmark);
299+
final AssumeRoleWithWebIdentityRequest request = new AssumeRoleWithWebIdentityRequest()
300+
.withRequestCredentialsProvider(new AWSStaticCredentialsProvider(new AnonymousAWSCredentials()));
303301
log.debug("Assume role with OIDC Id token for {}", bookmark);
304-
final String webIdentityToken = this.getWebIdentityToken(credentials.getOauth());
302+
final String webIdentityToken = this.getWebIdentityToken(oauth);
305303
request.setWebIdentityToken(webIdentityToken);
306304
if(StringUtils.isNotBlank(settings.getProperty("s3.assumerole.durationseconds", Profile.STS_DURATION_SECONDS_PROPERTY_KEY))) {
307305
request.setDurationSeconds(PreferencesReader.toInteger(settings.getProperty("s3.assumerole.durationseconds", Profile.STS_DURATION_SECONDS_PROPERTY_KEY)));
308306
}
309307
request.setPolicy(settings.getProperty("s3.assumerole.policy"));
310-
final String roleArn = settings.getProperty(Profile.STS_ROLE_ARN_PROPERTY_KEY, "s3.assumerole.rolearn");
311308
if(StringUtils.isNotBlank(roleArn)) {
312309
request.setRoleArn(roleArn);
313310
}

‎s3/src/main/java/ch/cyberduck/core/sts/STSGetSessionTokenRequestInterceptor.java‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -52,10 +52,12 @@ public STSGetSessionTokenRequestInterceptor(final Host host, final X509TrustMana
5252
public TemporaryAccessTokens refresh(final Credentials credentials) throws BackgroundException {
5353
lock.lock();
5454
try {
55-
if(StringUtils.isNotBlank(new ProxyPreferencesReader(credentials, host).getProperty(Profile.STS_MFA_ARN_PROPERTY_KEY))) {
55+
final String arn = new ProxyPreferencesReader(host, credentials).getProperty(Profile.STS_MFA_ARN_PROPERTY_KEY);
56+
log.debug("Use ARN {}", arn);
57+
if(StringUtils.isNotBlank(arn)) {
5658
log.debug("Retrieve temporary credentials with {}", credentials);
5759
// GetSessionToken
58-
return tokens = this.getSessionToken(credentials);
60+
return tokens = this.getSessionToken(credentials, arn);
5961
}
6062
log.warn("Skip requesting tokens from token service for {}", credentials);
6163
return TemporaryAccessTokens.EMPTY;

0 commit comments

Comments
 (0)