Add support for SSO #1676
Assignees
Labels
enhancement
New feature or request
Comments
|
The issue is that reflection metadata were not kept. The issue you mention in the upstream repo would fix it. While I was adding both services (sso / sso oidc), I added GraalVM substitutions to avoid creating instances with reflection. Note that all profile provider require a sync http client implementation module (either URL or Apache). Be sure to add one of them, if you use async client for your own needs. |
Indeed, I had to add manually the dependencies for this. <dependency>
<groupId>io.quarkiverse.amazonservices</groupId>
<artifactId>quarkus-amazon-sts</artifactId>
</dependency>
<dependency>
<groupId>software.amazon.awssdk</groupId>
<artifactId>url-connection-client</artifactId> <!-- SSO sync client -->
</dependency>
<dependency>
<groupId>software.amazon.awssdk</groupId>
<artifactId>netty-nio-client</artifactId> <!-- STS async client -->
</dependency>
<dependency>
<groupId>io.quarkiverse.amazonservices</groupId>
<artifactId>quarkus-amazon-sso</artifactId>
</dependency>
<dependency>
<groupId>io.quarkiverse.amazonservices</groupId>
<artifactId>quarkus-amazon-ssooidc</artifactId>
</dependency>quarkus.sso.aws.region=eu-west-3
quarkus.sso.sync-client.type=url
quarkus.ssooidc.devservices.enabled=false
quarkus.sts.aws.region=eu-west-3
quarkus.sso.async-client.type=netty
quarkus.sts.devservices.enabled=falseIt works fine in JAR mode, just like before. But in native mode I have a different error now:
|
What is the content of your aws profile ? |
|
I cannot fully test because I don't have an AWS account. But, with your repro, I have this error which I guess, means I am not The fake profile |
|
You should have another warning log with the real exception. At least, the provider is correctly instantiated. BTW, you don't need to confire the sync client if you don't use it. |
Oh, that's true, I was just being sure it was the right one used when desperately trying to get it working.
I didn't see anything. Here's the full output: |
Actually no, because I found out it's this line of code : https://github.com/aws/aws-sdk-java-v2/blob/2.31.37/services/ssooidc/src/main/java/software/amazon/awssdk/services/ssooidc/SsoOidcTokenProvider.java#L221 When using So I guess it's here: https://github.com/aws/aws-sdk-java-v2/blob/master/services/ssooidc/src/main/java/software/amazon/awssdk/services/ssooidc/internal/OnDiskTokenManager.java#L66 Because otherwise, I would have a cause exception, but I don't have in my stacktrace. But why would the file being considered not existing in native mode? 🤔 |
Thank you for the analysis. The issue is that is evaluated at native image compilation to I will fix it in the extension to delay the class initialization at runtime. Meanwhile, if you can try with this addtional properties to see if there is other errors |
Perfect! It works now in native. Thank you very much for the details! |
|
Released in Quarkus Amazon BOM 3.6.0 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Uh oh!
There was an error while loading. Please reload this page.
I am migrating some Quarkus application to native.
I got a problem with one, which is using
ssoandssooidcdependencies (groupsoftware.amazon.awssdk) to authenticate the user in SSO (used mostly for testing native apps in local environment).I didn't see any "sso" module in this extension, so I guess it's a feature request, not a bug. It would be great if the extension could provide a SSO module to wrap AWS SDK dependencies (just like it's done now with STS, S3, etc.).
Here's a simple reproducer (just runs a
get-caller-identityrequest when it starts) : https://github.com/jdussouillez/quarkus-aws-sso-nativeStacktrace
Exception message (readable)
Unable to load credentials from any of the providers in the chain AwsCredentialsProviderChain( credentialsProviders=[ SystemPropertyCredentialsProvider(), EnvironmentVariableCredentialsProvider(), WebIdentityTokenCredentialsProvider(), ProfileCredentialsProvider( profileName=default, profileFile=ProfileFile( sections=[profiles, sso-session], profiles=[ Profile(name=default, properties=[sso_session, output, sso_role_name, region, sso_account_id]), Profile(name=ReadOnly, properties=[sso_session, output, sso_role_name, region, sso_account_id]), Profile(name=Admin, properties=[sso_session, output, sso_role_name, region, sso_account_id]) ] ) ), ContainerCredentialsProvider(), InstanceProfileCredentialsProvider() ] ) : [ SystemPropertyCredentialsProvider(): Unable to load credentials from system settings. Access key must be specified either via environment variable (AWS_ACCESS_KEY_ID) or system property (aws.accessKeyId)., EnvironmentVariableCredentialsProvider(): Unable to load credentials from system settings. Access key must be specified either via environment variable (AWS_ACCESS_KEY_ID) or system property (aws.accessKeyId)., WebIdentityTokenCredentialsProvider(): Either the environment variable AWS_WEB_IDENTITY_TOKEN_FILE or the javaproperty aws.webIdentityTokenFile must be set., ProfileCredentialsProvider( profileName=default, profileFile=ProfileFile( sections=[profiles, sso-session], profiles=[ Profile(name=default, properties=[sso_session, output, sso_role_name, region, sso_account_id]), Profile(name=ReadOnly, properties=[sso_session, output, sso_role_name, region, sso_account_id]), Profile(name=Admin, properties=[sso_session, output, sso_role_name, region, sso_account_id]) ] ) ): To use Sso related properties in the 'default' profile, the 'sso' service module must be on the class path., ContainerCredentialsProvider(): Cannot fetch credentials from container - neither AWS_CONTAINER_CREDENTIALS_FULL_URI or AWS_CONTAINER_CREDENTIALS_RELATIVE_URI environment variables are set., InstanceProfileCredentialsProvider(): Failed to load credentials from IMDS. ]Judging from the exception message, it seems the SSO service is not in the class path.
I tried to switch to CRT-based HTTP client, add reflection metadata for SSO dependency and playing with
initialize-at-run-timeoption, but so far nothing worked (what I tried is listed here)I found this post on SO that is very similar: https://stackoverflow.com/questions/79179322/quarkus-is-not-finding-some-aws-classes-when-trying-to-use-neptune
The text was updated successfully, but these errors were encountered: