search

capless / warrant

Python library for using AWS Cognito. With support for SRP.
Apache License 2.0
468 stars 192 forks source link

By default the auth in `~/.aws` is loaded #80

Open balloob opened 6 years ago

balloob commented 6 years ago

Warrant will use the default boto configuration which is to load credentials from ~/.aws. Not all requests to Cognito require requests to be signed in. Examples of these are register, authenticate, forgot password, confirm forgot password.

Botocore will blow up with a NoCredentialsError exception if ~/.aws doesn't exist:

  File "/Users/paulus/dev/python/home-assistant/lib/python3.6/site-packages/warrant/__init__.py", line 289, in authenticate
    tokens = aws.authenticate_user()
  File "/Users/paulus/dev/python/home-assistant/lib/python3.6/site-packages/warrant/aws_srp.py", line 187, in authenticate_user
    ClientId=self.client_id
  File "/Users/paulus/dev/python/home-assistant/lib/python3.6/site-packages/botocore/client.py", line 251, in _api_call
    return self._make_api_call(operation_name, kwargs)
  File "/Users/paulus/dev/python/home-assistant/lib/python3.6/site-packages/botocore/client.py", line 526, in _make_api_call
    operation_model, request_dict)
  File "/Users/paulus/dev/python/home-assistant/lib/python3.6/site-packages/botocore/endpoint.py", line 141, in make_request
    return self._send_request(request_dict, operation_model)
  File "/Users/paulus/dev/python/home-assistant/lib/python3.6/site-packages/botocore/endpoint.py", line 166, in _send_request
    request = self.create_request(request_dict, operation_model)
  File "/Users/paulus/dev/python/home-assistant/lib/python3.6/site-packages/botocore/endpoint.py", line 150, in create_request
    operation_name=operation_model.name)
  File "/Users/paulus/dev/python/home-assistant/lib/python3.6/site-packages/botocore/hooks.py", line 227, in emit
    return self._emit(event_name, kwargs)
  File "/Users/paulus/dev/python/home-assistant/lib/python3.6/site-packages/botocore/hooks.py", line 210, in _emit
    response = handler(**kwargs)
  File "/Users/paulus/dev/python/home-assistant/lib/python3.6/site-packages/botocore/signers.py", line 90, in handler
    return self.sign(operation_name, request)
  File "/Users/paulus/dev/python/home-assistant/lib/python3.6/site-packages/botocore/signers.py", line 147, in sign
    auth.add_auth(request)
  File "/Users/paulus/dev/python/home-assistant/lib/python3.6/site-packages/botocore/auth.py", line 316, in add_auth
    raise NoCredentialsError
botocore.exceptions.NoCredentialsError: Unable to locate credentials

We can set the cognito client to use unsigned requests for the user facing APIs (make account, reset password). I tried adding this in https://github.com/capless/warrant/pull/59 however ran into a problem where the admin tests actually rely on this.

I can't run the tests locally and the PR has since been reverted 😞

rileypeterson commented 6 years ago

What is the solution for this?

balloob commented 6 years ago

Since the PR got reverted and I am unable to fix the code myself without being able to run the tests, I can't open a PR that would be ok to merge. You will have to patch the used client yourself. This is how Home Assistant does it

kyhau commented 6 years ago

We experienced this issue with the authenticate call. For workaround,

(1) Put [default] in .aws/credentials with empty access key values to avoid the exception. 

[default]
aws_access_key_id=
aws_secret_access_key=

(2) Or, passing dummy access_key and secret_key when calling Cognito()

user = Cognito(
            userpool,
            userpool_appclientid,
            user_pool_region="xxx",
            username="xxx",
            access_key="dummy_not_used",
            secret_key="dummy_not_used",
        )

It would be great to have this fixed :)

dwright213 commented 5 years ago

Khau's post would be a really nice addition to the docs, under "authentication", I think.