yenfryherrerafeliz
commented
11 months ago Hi @tgoodsell-tempus, thanks for opening this issue. The credential provider fromWebToken is not intended to handle expiration, since it expects to always be provided with a valid token. Something you can do here is to add a custom credential provider where you handle when a token is expired and supply that custom implementation as the credential provider for the SDK client you will use. Here is a simple example:
import {GetCallerIdentityCommand, STSClient} from "@aws-sdk/client-sts";
import {fromWebToken} from "@aws-sdk/credential-providers";
async function main() {
const isExpired = (token) => {
// Check if token is expired
return true;
};
const myIdTokenGetter = async () => {
// Generate a new fresh token
return ''
};
let currentToken;
const stsClient = new STSClient({
credentials: async () => {
if (!currentToken || isExpired(currentToken)) {
currentToken = await myIdTokenGetter();
}
return await fromWebToken({
roleArn: "someARN",
webIdentityToken: currentToken,
roleSessionName: "sessionName",
durationSeconds: 900,
})();
},
region: 'us-east-1'
});
const testCmd = new GetCallerIdentityCommand({});
const resp = await stsClient.send(testCmd);
console.log(resp);
setInterval(() => {
stsClient.send(testCmd).then(data => {
console.log(data);
}).catch(err => {
console.error(err);
});
}, 900000)
}
await main();Please let me know if that helps!
Thanks!
tgoodsell-tempus
github-actions[bot]
Checkboxes for prior research
Describe the bug
Based on my experimentation and general lack of information on this in the docs:
The
fromWebTokenmethod in thecredential-providerspackage is unable to deal with the eventual expiration of an ID token. Since thetokenvalue is passed as astringinstead of a promise/function (or something else), the value is statically encoded into the configuration and is not detected or able to handle refreshing.Perhaps this function should be explicitly updated to take one of the aforementioned types, which would allow the user to fulfill with whatever logic / source they need to ensure a valid ID token is returned on each call.
Docs: https://docs.aws.amazon.com/AWSJavaScriptSDK/v3/latest/Package/-aws-sdk-credential-providers/#fromwebtoken
SDK version number
@aws-sdk/credential-providers@3.315.0
Which JavaScript Runtime is this issue in?
Node.js
Details of the browser/Node.js/ReactNative version
Node 20.6.1
Reproduction Steps
Observed Behavior
Basically we get errors like the following once the ID token expires:
Expected Behavior
Generally I would expect the interface which we provide our ID token to allow for some need for that value to change due to expiration or other reasons. I suppose we had expected that when feeding the function value instead of a string const or something it would take care of that, however that goes against the primitive
pass by valueconventions so that would be wrong to expect in reality.Possible Solution
Instead of using a primitive string input, something like a promise, function, generator, etc would be more useful for this. Something that the middleware would know to go call and fetch/retrieve a real token value from before it performs the AWS token refresh cycle. Outside of that, the logic on handling the ID token should probably still remain in the hands of the developer.
Additional Information/Context
No response