These changes enable the Gateway to work with Q Business Apps integrated with Identity Center (IdC).
The gateway registers the Amazon Q Business Microsoft Teams Gateway as an OpenID Connect (OIDC) app with Okta (or other OIDC compliant Identity Providers).
This registration allows the gateway to invoke the Q Business ChatSync API on behalf of the end-user.
The gateway provisions an OIDC callback handler for the Identity Provider (IdP) to return an authorization code after the end-user authenticates using the authorization grant flow.
The callback handler exchanges the authorization code for IAM session credentials through a series of interactions with the IdP, IdC, and AWS Security Token Service (STS).
The IAM session credentials, which are short-lived (15-minute duration), are encrypted and stored in a DynamoDB table along with the refresh token from the IdP.
The IAM session credentials are then used to invoke the Q Business ChatSync and PutFeedback APIs.
If the IAM session credentials expire, the refresh token from the IdP is used to obtain new IAM session credentials without requiring the end-user to sign in again.
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.
Issue #: https://github.com/aws-samples/amazon-q-teams-gateway/issues/19
Description of changes:
These changes enable the Gateway to work with Q Business Apps integrated with Identity Center (IdC).
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.