Skip to content

[Credentials Cache PR 5] Add IdentityProvider.invalidate #7108

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
alextwoods wants to merge 9 commits into
base: feature/master/credential_cache
Choose a base branch
from
Open

[Credentials Cache PR 5] Add IdentityProvider.invalidate #7108

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
f356108
feat(auth): Add IdentityProvider.invalidate() for credential cache in…
alextwoods Jul 7, 2026
511b5af
Minor cleanups
alextwoods Jul 7, 2026
bc4ac1e
More cleanups
alextwoods Jul 7, 2026
192c33f
Cleanups and fixes
alextwoods Jul 9, 2026
499a095
Switch to builder for SelectedAuthScheme instead of 4 arg constructor
alextwoods Jul 9, 2026
8a6d122
Fix types in codegen
alextwoods Jul 10, 2026
9b561b5
Fix failing SSO test
alextwoods Jul 10, 2026
6f0444d
PR Cleanups
alextwoods Jul 10, 2026
d7574c3
invalidate only the lastProvider when reuseLastProviderEnabled=true
alextwoods Jul 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions build-tools/src/main/resources/software/amazon/awssdk/spotbugs-suppressions.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -345,6 +345,7 @@
<Class name="~software\.amazon\.awssdk\.auth\.credentials\.internal\.HttpCredentialsLoader" />
<Class name="~software\.amazon\.awssdk\.auth\.credentials\.ContainerCredentialsProvider" />
<Class name="~software\.amazon\.awssdk\.auth\.credentials\.InstanceProfileCredentialsProvider" />
<Class name="~software\.amazon\.awssdk\.core\.internal\.http\.pipeline\.stages\.utils\.AuthErrorInvalidationHelper" />

<Class name="~software\.amazon\.awssdk\.messagemanager\.sns\.internal\.SnsHostProvider" />

Expand Down
3 changes: 1 addition & 2 deletions codegen/src/main/java/software/amazon/awssdk/codegen/poet/client/ClientClassUtils.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -564,8 +564,7 @@ static MethodSpec resolveEndpointMethod(AuthSchemeSpecUtils authSchemeSpecUtils,
authSchemeOption.nestedClass("Builder"));
b.addStatement("$1T rs = $1T.create(endpointParams.region().id())", regionSet);
b.addStatement("optionBuilder.putSignerProperty($T.REGION_SET, rs)", awsV4aHttpSigner);
b.addStatement("selectedAuthScheme = new $T(selectedAuthScheme.identity(), selectedAuthScheme.signer(), "
+ "optionBuilder.build())", SelectedAuthScheme.class);
b.addStatement("selectedAuthScheme = selectedAuthScheme.toBuilder().authSchemeOption(optionBuilder.build()).build()");
b.endControlFlow();
}

Expand Down
12 changes: 9 additions & 3 deletions ...en/src/main/java/software/amazon/awssdk/codegen/poet/rules/EndpointResolverUtilsSpec.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -602,7 +602,9 @@ private static CodeBlock copyV4EndpointSignerPropertiesToAuth() {
code.addStatement("option.putSignerProperty($T.SERVICE_SIGNING_NAME, v4AuthScheme.signingName())",
AwsV4HttpSigner.class);
code.endControlFlow();
code.addStatement("return new $T<>(selectedAuthScheme.identity(), selectedAuthScheme.signer(), option.build())",
code.addStatement("return $T.<T>builder().identity(selectedAuthScheme.identity())"
+ ".signer(selectedAuthScheme.signer()).authSchemeOption(option.build())"
+ ".identityProvider(selectedAuthScheme.identityProvider()).build()",
SelectedAuthScheme.class);
code.endControlFlow();
return code.build();
Expand Down Expand Up @@ -631,7 +633,9 @@ private CodeBlock copyV4aEndpointSignerPropertiesToAuth() {
code.addStatement("option.putSignerProperty($T.SERVICE_SIGNING_NAME, v4aAuthScheme.signingName())",
AwsV4aHttpSigner.class);
code.endControlFlow();
code.addStatement("return new $T<>(selectedAuthScheme.identity(), selectedAuthScheme.signer(), option.build())",
code.addStatement("return $T.<T>builder().identity(selectedAuthScheme.identity())"
+ ".signer(selectedAuthScheme.signer()).authSchemeOption(option.build())"
+ ".identityProvider(selectedAuthScheme.identityProvider()).build()",
SelectedAuthScheme.class);
code.endControlFlow();
return code.build();
Expand All @@ -656,7 +660,9 @@ private CodeBlock copyS3ExpressEndpointSignerPropertiesToAuth() {
code.addStatement("option.putSignerProperty($T.SERVICE_SIGNING_NAME, s3ExpressAuthScheme.signingName())",
AwsV4HttpSigner.class);
code.endControlFlow();
code.addStatement("return new $T<>(selectedAuthScheme.identity(), selectedAuthScheme.signer(), option.build())",
code.addStatement("return $T.<T>builder().identity(selectedAuthScheme.identity())"
+ ".signer(selectedAuthScheme.signer()).authSchemeOption(option.build())"
+ ".identityProvider(selectedAuthScheme.identityProvider()).build()",
SelectedAuthScheme.class);
code.endControlFlow();
return code.build();
Expand Down
3 changes: 1 addition & 2 deletions ...are/amazon/awssdk/codegen/poet/client/test-unsigned-payload-trait-async-client-class.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1080,8 +1080,7 @@ private Endpoint resolveEndpoint(SdkRequest request, ExecutionAttributes executi
AuthSchemeOption.Builder optionBuilder = selectedAuthScheme.authSchemeOption().toBuilder();
RegionSet rs = RegionSet.create(endpointParams.region().id());
optionBuilder.putSignerProperty(AwsV4aHttpSigner.REGION_SET, rs);
selectedAuthScheme = new SelectedAuthScheme(selectedAuthScheme.identity(), selectedAuthScheme.signer(),
optionBuilder.build());
selectedAuthScheme = selectedAuthScheme.toBuilder().authSchemeOption(optionBuilder.build()).build();
}
executionAttributes.putAttribute(SdkInternalExecutionAttribute.SELECTED_AUTH_SCHEME, selectedAuthScheme);
}
Expand Down
3 changes: 1 addition & 2 deletions ...ware/amazon/awssdk/codegen/poet/client/test-unsigned-payload-trait-sync-client-class.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -965,8 +965,7 @@ private Endpoint resolveEndpoint(SdkRequest request, ExecutionAttributes executi
AuthSchemeOption.Builder optionBuilder = selectedAuthScheme.authSchemeOption().toBuilder();
RegionSet rs = RegionSet.create(endpointParams.region().id());
optionBuilder.putSignerProperty(AwsV4aHttpSigner.REGION_SET, rs);
selectedAuthScheme = new SelectedAuthScheme(selectedAuthScheme.identity(), selectedAuthScheme.signer(),
optionBuilder.build());
selectedAuthScheme = selectedAuthScheme.toBuilder().authSchemeOption(optionBuilder.build()).build();
}
executionAttributes.putAttribute(SdkInternalExecutionAttribute.SELECTED_AUTH_SCHEME, selectedAuthScheme);
}
Expand Down
4 changes: 2 additions & 2 deletions ...ources/software/amazon/awssdk/codegen/poet/rules/endpoint-resolve-interceptor-preSra.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -177,7 +177,7 @@ private <T extends Identity> SelectedAuthScheme<T> authSchemeWithEndpointSignerP
if (v4AuthScheme.signingName() != null) {
option.putSignerProperty(AwsV4HttpSigner.SERVICE_SIGNING_NAME, v4AuthScheme.signingName());
}
return new SelectedAuthScheme<>(selectedAuthScheme.identity(), selectedAuthScheme.signer(), option.build());
return SelectedAuthScheme.<T>builder().identity(selectedAuthScheme.identity()).signer(selectedAuthScheme.signer()).authSchemeOption(option.build()).identityProvider(selectedAuthScheme.identityProvider()).build();
}
if (endpointAuthScheme instanceof SigV4aAuthScheme) {
SigV4aAuthScheme v4aAuthScheme = (SigV4aAuthScheme) endpointAuthScheme;
Expand All @@ -191,7 +191,7 @@ private <T extends Identity> SelectedAuthScheme<T> authSchemeWithEndpointSignerP
if (v4aAuthScheme.signingName() != null) {
option.putSignerProperty(AwsV4aHttpSigner.SERVICE_SIGNING_NAME, v4aAuthScheme.signingName());
}
return new SelectedAuthScheme<>(selectedAuthScheme.identity(), selectedAuthScheme.signer(), option.build());
return SelectedAuthScheme.<T>builder().identity(selectedAuthScheme.identity()).signer(selectedAuthScheme.signer()).authSchemeOption(option.build()).identityProvider(selectedAuthScheme.identityProvider()).build();
}
throw new IllegalArgumentException("Endpoint auth scheme '" + endpointAuthScheme.name()
+ "' cannot be mapped to the SDK auth scheme. Was it declared in the service's model?");
Expand Down
7 changes: 3 additions & 4 deletions ...mazon/awssdk/codegen/poet/rules/endpoint-resolve-interceptor-with-endpointsbasedauth.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -81,8 +81,7 @@ public SdkRequest modifyRequest(Context.ModifyRequest context, ExecutionAttribut
AuthSchemeOption.Builder optionBuilder = selectedAuthScheme.authSchemeOption().toBuilder();
RegionSet regionSet = RegionSet.create(endpointParams.region().id());
optionBuilder.putSignerProperty(AwsV4aHttpSigner.REGION_SET, regionSet);
selectedAuthScheme = new SelectedAuthScheme(selectedAuthScheme.identity(), selectedAuthScheme.signer(),
optionBuilder.build());
selectedAuthScheme = selectedAuthScheme.toBuilder().authSchemeOption(optionBuilder.build()).build();
}
executionAttributes.putAttribute(SdkInternalExecutionAttribute.SELECTED_AUTH_SCHEME, selectedAuthScheme);
}
Expand Down Expand Up @@ -172,7 +171,7 @@ private <T extends Identity> SelectedAuthScheme<T> authSchemeWithEndpointSignerP
if (v4AuthScheme.signingName() != null) {
option.putSignerProperty(AwsV4HttpSigner.SERVICE_SIGNING_NAME, v4AuthScheme.signingName());
}
return new SelectedAuthScheme<>(selectedAuthScheme.identity(), selectedAuthScheme.signer(), option.build());
return SelectedAuthScheme.<T>builder().identity(selectedAuthScheme.identity()).signer(selectedAuthScheme.signer()).authSchemeOption(option.build()).identityProvider(selectedAuthScheme.identityProvider()).build();
}
if (endpointAuthScheme instanceof SigV4aAuthScheme) {
SigV4aAuthScheme v4aAuthScheme = (SigV4aAuthScheme) endpointAuthScheme;
Expand All @@ -188,7 +187,7 @@ private <T extends Identity> SelectedAuthScheme<T> authSchemeWithEndpointSignerP
if (v4aAuthScheme.signingName() != null) {
option.putSignerProperty(AwsV4aHttpSigner.SERVICE_SIGNING_NAME, v4aAuthScheme.signingName());
}
return new SelectedAuthScheme<>(selectedAuthScheme.identity(), selectedAuthScheme.signer(), option.build());
return SelectedAuthScheme.<T>builder().identity(selectedAuthScheme.identity()).signer(selectedAuthScheme.signer()).authSchemeOption(option.build()).identityProvider(selectedAuthScheme.identityProvider()).build();
}
throw new IllegalArgumentException("Endpoint auth scheme '" + endpointAuthScheme.name()
+ "' cannot be mapped to the SDK auth scheme. Was it declared in the service's model?");
Expand Down
7 changes: 3 additions & 4 deletions ...e/amazon/awssdk/codegen/poet/rules/endpoint-resolve-interceptor-with-multiauthsigv4a.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,8 +70,7 @@ public SdkRequest modifyRequest(Context.ModifyRequest context, ExecutionAttribut
AuthSchemeOption.Builder optionBuilder = selectedAuthScheme.authSchemeOption().toBuilder();
RegionSet regionSet = RegionSet.create(endpointParams.region().id());
optionBuilder.putSignerProperty(AwsV4aHttpSigner.REGION_SET, regionSet);
selectedAuthScheme = new SelectedAuthScheme(selectedAuthScheme.identity(), selectedAuthScheme.signer(),
optionBuilder.build());
selectedAuthScheme = selectedAuthScheme.toBuilder().authSchemeOption(optionBuilder.build()).build();
}
executionAttributes.putAttribute(SdkInternalExecutionAttribute.SELECTED_AUTH_SCHEME, selectedAuthScheme);
}
Expand Down Expand Up @@ -135,7 +134,7 @@ private <T extends Identity> SelectedAuthScheme<T> authSchemeWithEndpointSignerP
if (v4AuthScheme.signingName() != null) {
option.putSignerProperty(AwsV4HttpSigner.SERVICE_SIGNING_NAME, v4AuthScheme.signingName());
}
return new SelectedAuthScheme<>(selectedAuthScheme.identity(), selectedAuthScheme.signer(), option.build());
return SelectedAuthScheme.<T>builder().identity(selectedAuthScheme.identity()).signer(selectedAuthScheme.signer()).authSchemeOption(option.build()).identityProvider(selectedAuthScheme.identityProvider()).build();
}
if (endpointAuthScheme instanceof SigV4aAuthScheme) {
SigV4aAuthScheme v4aAuthScheme = (SigV4aAuthScheme) endpointAuthScheme;
Expand All @@ -151,7 +150,7 @@ private <T extends Identity> SelectedAuthScheme<T> authSchemeWithEndpointSignerP
if (v4aAuthScheme.signingName() != null) {
option.putSignerProperty(AwsV4aHttpSigner.SERVICE_SIGNING_NAME, v4aAuthScheme.signingName());
}
return new SelectedAuthScheme<>(selectedAuthScheme.identity(), selectedAuthScheme.signer(), option.build());
return SelectedAuthScheme.<T>builder().identity(selectedAuthScheme.identity()).signer(selectedAuthScheme.signer()).authSchemeOption(option.build()).identityProvider(selectedAuthScheme.identityProvider()).build();
}
throw new IllegalArgumentException("Endpoint auth scheme '" + endpointAuthScheme.name()
+ "' cannot be mapped to the SDK auth scheme. Was it declared in the service's model?");
Expand Down
4 changes: 2 additions & 2 deletions ...tware/amazon/awssdk/codegen/poet/rules/endpoint-resolve-interceptor-with-stringarray.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -144,7 +144,7 @@ private <T extends Identity> SelectedAuthScheme<T> authSchemeWithEndpointSignerP
if (v4AuthScheme.signingName() != null) {
option.putSignerProperty(AwsV4HttpSigner.SERVICE_SIGNING_NAME, v4AuthScheme.signingName());
}
return new SelectedAuthScheme<>(selectedAuthScheme.identity(), selectedAuthScheme.signer(), option.build());
return SelectedAuthScheme.<T>builder().identity(selectedAuthScheme.identity()).signer(selectedAuthScheme.signer()).authSchemeOption(option.build()).identityProvider(selectedAuthScheme.identityProvider()).build();
}
if (endpointAuthScheme instanceof SigV4aAuthScheme) {
SigV4aAuthScheme v4aAuthScheme = (SigV4aAuthScheme) endpointAuthScheme;
Expand All @@ -158,7 +158,7 @@ private <T extends Identity> SelectedAuthScheme<T> authSchemeWithEndpointSignerP
if (v4aAuthScheme.signingName() != null) {
option.putSignerProperty(AwsV4aHttpSigner.SERVICE_SIGNING_NAME, v4aAuthScheme.signingName());
}
return new SelectedAuthScheme<>(selectedAuthScheme.identity(), selectedAuthScheme.signer(), option.build());
return SelectedAuthScheme.<T>builder().identity(selectedAuthScheme.identity()).signer(selectedAuthScheme.signer()).authSchemeOption(option.build()).identityProvider(selectedAuthScheme.identityProvider()).build();
}
throw new IllegalArgumentException("Endpoint auth scheme '" + endpointAuthScheme.name()
+ "' cannot be mapped to the SDK auth scheme. Was it declared in the service's model?");
Expand Down
4 changes: 2 additions & 2 deletions ...est/resources/software/amazon/awssdk/codegen/poet/rules/endpoint-resolve-interceptor.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -163,7 +163,7 @@ private <T extends Identity> SelectedAuthScheme<T> authSchemeWithEndpointSignerP
if (v4AuthScheme.signingName() != null) {
option.putSignerProperty(AwsV4HttpSigner.SERVICE_SIGNING_NAME, v4AuthScheme.signingName());
}
return new SelectedAuthScheme<>(selectedAuthScheme.identity(), selectedAuthScheme.signer(), option.build());
return SelectedAuthScheme.<T>builder().identity(selectedAuthScheme.identity()).signer(selectedAuthScheme.signer()).authSchemeOption(option.build()).identityProvider(selectedAuthScheme.identityProvider()).build();
}
if (endpointAuthScheme instanceof SigV4aAuthScheme) {
SigV4aAuthScheme v4aAuthScheme = (SigV4aAuthScheme) endpointAuthScheme;
Expand All @@ -177,7 +177,7 @@ private <T extends Identity> SelectedAuthScheme<T> authSchemeWithEndpointSignerP
if (v4aAuthScheme.signingName() != null) {
option.putSignerProperty(AwsV4aHttpSigner.SERVICE_SIGNING_NAME, v4aAuthScheme.signingName());
}
return new SelectedAuthScheme<>(selectedAuthScheme.identity(), selectedAuthScheme.signer(), option.build());
return SelectedAuthScheme.<T>builder().identity(selectedAuthScheme.identity()).signer(selectedAuthScheme.signer()).authSchemeOption(option.build()).identityProvider(selectedAuthScheme.identityProvider()).build();
}
throw new IllegalArgumentException("Endpoint auth scheme '" + endpointAuthScheme.name()
+ "' cannot be mapped to the SDK auth scheme. Was it declared in the service's model?");
Expand Down
4 changes: 2 additions & 2 deletions ...are/amazon/awssdk/codegen/poet/rules/endpoint-resolver-utils-with-endpointsbasedauth.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -101,7 +101,7 @@ public static <T extends Identity> SelectedAuthScheme<T> authSchemeWithEndpointS
if (v4AuthScheme.signingName() != null) {
option.putSignerProperty(AwsV4HttpSigner.SERVICE_SIGNING_NAME, v4AuthScheme.signingName());
}
return new SelectedAuthScheme<>(selectedAuthScheme.identity(), selectedAuthScheme.signer(), option.build());
return SelectedAuthScheme.<T>builder().identity(selectedAuthScheme.identity()).signer(selectedAuthScheme.signer()).authSchemeOption(option.build()).identityProvider(selectedAuthScheme.identityProvider()).build();
}
if (endpointAuthScheme instanceof SigV4aAuthScheme) {
SigV4aAuthScheme v4aAuthScheme = (SigV4aAuthScheme) endpointAuthScheme;
Expand All @@ -117,7 +117,7 @@ public static <T extends Identity> SelectedAuthScheme<T> authSchemeWithEndpointS
if (v4aAuthScheme.signingName() != null) {
option.putSignerProperty(AwsV4aHttpSigner.SERVICE_SIGNING_NAME, v4aAuthScheme.signingName());
}
return new SelectedAuthScheme<>(selectedAuthScheme.identity(), selectedAuthScheme.signer(), option.build());
return SelectedAuthScheme.<T>builder().identity(selectedAuthScheme.identity()).signer(selectedAuthScheme.signer()).authSchemeOption(option.build()).identityProvider(selectedAuthScheme.identityProvider()).build();
}
throw new IllegalArgumentException("Endpoint auth scheme '" + endpointAuthScheme.name()
+ "' cannot be mapped to the SDK auth scheme. Was it declared in the service's model?");
Expand Down
4 changes: 2 additions & 2 deletions ...ftware/amazon/awssdk/codegen/poet/rules/endpoint-resolver-utils-with-multiauthsigv4a.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,7 +64,7 @@ public static <T extends Identity> SelectedAuthScheme<T> authSchemeWithEndpointS
if (v4AuthScheme.signingName() != null) {
option.putSignerProperty(AwsV4HttpSigner.SERVICE_SIGNING_NAME, v4AuthScheme.signingName());
}
return new SelectedAuthScheme<>(selectedAuthScheme.identity(), selectedAuthScheme.signer(), option.build());
return SelectedAuthScheme.<T>builder().identity(selectedAuthScheme.identity()).signer(selectedAuthScheme.signer()).authSchemeOption(option.build()).identityProvider(selectedAuthScheme.identityProvider()).build();
}
if (endpointAuthScheme instanceof SigV4aAuthScheme) {
SigV4aAuthScheme v4aAuthScheme = (SigV4aAuthScheme) endpointAuthScheme;
Expand All @@ -80,7 +80,7 @@ public static <T extends Identity> SelectedAuthScheme<T> authSchemeWithEndpointS
if (v4aAuthScheme.signingName() != null) {
option.putSignerProperty(AwsV4aHttpSigner.SERVICE_SIGNING_NAME, v4aAuthScheme.signingName());
}
return new SelectedAuthScheme<>(selectedAuthScheme.identity(), selectedAuthScheme.signer(), option.build());
return SelectedAuthScheme.<T>builder().identity(selectedAuthScheme.identity()).signer(selectedAuthScheme.signer()).authSchemeOption(option.build()).identityProvider(selectedAuthScheme.identityProvider()).build();
}
throw new IllegalArgumentException("Endpoint auth scheme '" + endpointAuthScheme.name()
+ "' cannot be mapped to the SDK auth scheme. Was it declared in the service's model?");
Expand Down
Loading
Loading