git-off

git off handles large files in git repos
git clone https://noulin.net/git/git-off.git
Log | Files | Refs | README

web_identity_credentials.js (3797B)

      1 var AWS = require('../core');
      2 var STS = require('../../clients/sts');
      3 
      4 /**
      5  * Represents credentials retrieved from STS Web Identity Federation support.
      6  *
      7  * By default this provider gets credentials using the
      8  * {AWS.STS.assumeRoleWithWebIdentity} service operation. This operation
      9  * requires a `RoleArn` containing the ARN of the IAM trust policy for the
     10  * application for which credentials will be given. In addition, the
     11  * `WebIdentityToken` must be set to the token provided by the identity
     12  * provider. See {constructor} for an example on creating a credentials
     13  * object with proper `RoleArn` and `WebIdentityToken` values.
     14  *
     15  * ## Refreshing Credentials from Identity Service
     16  *
     17  * In addition to AWS credentials expiring after a given amount of time, the
     18  * login token from the identity provider will also expire. Once this token
     19  * expires, it will not be usable to refresh AWS credentials, and another
     20  * token will be needed. The SDK does not manage refreshing of the token value,
     21  * but this can be done through a "refresh token" supported by most identity
     22  * providers. Consult the documentation for the identity provider for refreshing
     23  * tokens. Once the refreshed token is acquired, you should make sure to update
     24  * this new token in the credentials object's {params} property. The following
     25  * code will update the WebIdentityToken, assuming you have retrieved an updated
     26  * token from the identity provider:
     27  *
     28  * ```javascript
     29  * AWS.config.credentials.params.WebIdentityToken = updatedToken;
     30  * ```
     31  *
     32  * Future calls to `credentials.refresh()` will now use the new token.
     33  *
     34  * @!attribute params
     35  *   @return [map] the map of params passed to
     36  *     {AWS.STS.assumeRoleWithWebIdentity}. To update the token, set the
     37  *     `params.WebIdentityToken` property.
     38  * @!attribute data
     39  *   @return [map] the raw data response from the call to
     40  *     {AWS.STS.assumeRoleWithWebIdentity}. Use this if you want to get
     41  *     access to other properties from the response.
     42  */
     43 AWS.WebIdentityCredentials = AWS.util.inherit(AWS.Credentials, {
     44   /**
     45    * Creates a new credentials object.
     46    * @param (see AWS.STS.assumeRoleWithWebIdentity)
     47    * @example Creating a new credentials object
     48    *   AWS.config.credentials = new AWS.WebIdentityCredentials({
     49    *     RoleArn: 'arn:aws:iam::1234567890:role/WebIdentity',
     50    *     WebIdentityToken: 'ABCDEFGHIJKLMNOP', // token from identity service
     51    *     RoleSessionName: 'web' // optional name, defaults to web-identity
     52    *   });
     53    * @see AWS.STS.assumeRoleWithWebIdentity
     54    */
     55   constructor: function WebIdentityCredentials(params) {
     56     AWS.Credentials.call(this);
     57     this.expired = true;
     58     this.params = params;
     59     this.params.RoleSessionName = this.params.RoleSessionName || 'web-identity';
     60     this.data = null;
     61   },
     62 
     63   /**
     64    * Refreshes credentials using {AWS.STS.assumeRoleWithWebIdentity}
     65    *
     66    * @callback callback function(err)
     67    *   Called when the STS service responds (or fails). When
     68    *   this callback is called with no error, it means that the credentials
     69    *   information has been loaded into the object (as the `accessKeyId`,
     70    *   `secretAccessKey`, and `sessionToken` properties).
     71    *   @param err [Error] if an error occurred, this value will be filled
     72    * @see get
     73    */
     74   refresh: function refresh(callback) {
     75     var self = this;
     76     self.createClients();
     77     if (!callback) callback = function(err) { if (err) throw err; };
     78 
     79     self.service.assumeRoleWithWebIdentity(function (err, data) {
     80       self.data = null;
     81       if (!err) {
     82         self.data = data;
     83         self.service.credentialsFrom(data, self);
     84       }
     85       callback(err);
     86     });
     87   },
     88 
     89   /**
     90    * @api private
     91    */
     92   createClients: function() {
     93     this.service = this.service || new STS({params: this.params});
     94   }
     95 
     96 });