Adding functionality to config preferred authschemeProvider #6083

RanVaknin · 2025-05-02T20:07:35Z

Motivation and Context

Previously, when multiple auth schemes were available for an operation, the SDK would choose the first one defined in the service model. This PR implements the auth scheme preference configuration that allows users to specify their preferred authentication schemes in order of preference when multiple auth schemes are supported.

Example usage:

// Via client configuration in code
MyServiceClient client = MyServiceClient.builder()
    .authSchemeProvider(MyServiceAuthSchemeProvider.builder()
        .preferredAuthSchemes(Arrays.asList("sigv4", "sigv4a"))
        .build())
    .build();

// Via JVM properties:
// in code
System.setProperty("aws.authSchemePreference", "sigv4,sigv4a");
// or as a cmd line argument
java -Daws.authSchemePreference=sigv4,sigv4a -jar your-application.jar

// Via Environment variable:
export AWS_AUTH_SCHEME_PREFERENCE=sigv4,sigv4a

// Via AWS config file (~/.aws/config):
[default]
auth_scheme_preference = sigv4,sigv4a

Modifications

[Modified] client builders to read and apply auth scheme preferences
[Modified] the auth scheme resolution logic to respect user preferences while maintaining backward compatibility
[Added] AuthSchemePreferenceProvider class to resolve auth scheme preferences from various sources:
- Client configuration
- JVM system properties (aws.authSchemePreference)
- Environment variables (AWS_AUTH_SCHEME_PREFERENCE)
- AWS config file (auth_scheme_preference)
[Added] code generation support through PreferredAuthSchemeProviderSpec to generate service-specific auth scheme providers

Testing

AuthSchemePreferenceProviderTest verifies proper parsing of auth scheme preferences from different formats (spaces, tabs, etc.)
PreferredAuthSchemeProviderTest to test the reordering of auth schemes according to preferences
comprehensive test cases for preference resolution from multiple sources, verifying proper precedence:
Stubbed functional test with mock services to verify the selected auth scheme matches the expected preference in actual requests

...st/resources/software/amazon/awssdk/codegen/poet/auth/scheme/query-auth-scheme-provider.java

zoewangg · 2025-05-27T17:13:26Z

...st/resources/software/amazon/awssdk/codegen/poet/auth/scheme/query-auth-scheme-provider.java

+        return new QueryAuthSchemeProviderBuilder();
+    }
+
+    interface Builder {


Can we make it extend CopyableBuilder? https://github.com/aws/aws-sdk-java-v2/blob/master/docs/design/ClientConfiguration.md

Any updates on this?

Sorry I missed this comment earlier - I don't think we can do that without it being a breaking change. This would require adding the toBuilder method on the AuthSchemeProvider interface (and having it extend ToCopyableBuilder). This would be a breaking change to existing customer defined AuthSchemeProviders.

The original design suggested overloading the existing defaultProvider()method with a defaultProvider(List authSchemePreference) method instead of using a builder. Would that be preferable?

Will discuss offline in surface api review meeting.

...aws-core/src/main/java/software/amazon/awssdk/awscore/auth/AuthSchemePreferenceProvider.java

...rc/test/java/software/amazon/awssdk/services/multiauth/AuthSchemePreferenceProviderTest.java

...aws-core/src/main/java/software/amazon/awssdk/awscore/auth/AuthSchemePreferenceProvider.java

...in/java/software/amazon/awssdk/codegen/poet/auth/scheme/PreferredAuthSchemeProviderSpec.java

...rc/test/java/software/amazon/awssdk/services/multiauth/AuthSchemePreferenceProviderTest.java

...st/resources/software/amazon/awssdk/codegen/poet/auth/scheme/query-auth-scheme-provider.java

.../amazon/awssdk/codegen/poet/auth/scheme/query-endpoint-auth-params-auth-scheme-provider.java

...aws-core/src/main/java/software/amazon/awssdk/awscore/auth/AuthSchemePreferenceProvider.java

...in/java/software/amazon/awssdk/codegen/poet/auth/scheme/PreferredAuthSchemeProviderSpec.java

…adding coverage

...ces/software/amazon/awssdk/codegen/poet/auth/scheme/test-preferred-auth-scheme-provider.java

This reverts commit 141b9d6.

sonarqubecloud · 2025-05-29T21:19:34Z

Quality Gate passed

Issues
9 New issues
0 Accepted issues

Measures
0 Security Hotspots
97.6% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

zoewangg · 2025-05-30T00:15:05Z

...st/resources/software/amazon/awssdk/codegen/poet/auth/scheme/query-auth-scheme-provider.java

+        return new QueryAuthSchemeProviderBuilder();
+    }
+
+    interface Builder {


Any updates on this?

zoewangg · 2025-05-30T00:15:19Z

...st/resources/software/amazon/awssdk/codegen/poet/auth/scheme/query-auth-scheme-provider.java

+    }
+
+    @SdkInternalApi
+    final class QueryAuthSchemeProviderBuilder implements Builder {


Any updates on this?

zoewangg · 2025-05-30T00:31:18Z

...es/software/amazon/awssdk/codegen/poet/auth/scheme/query-auth-scheme-preferred-provider.java

+        List<AuthSchemeOption> authSchemes = new ArrayList<>();
+        authSchemePreference.forEach(preferredSchemeId -> {
+            candidateAuthSchemes
+                .stream()
+                .filter(candidate -> {
+                    String candidateSchemeName = candidate.schemeId().contains("#") ? candidate.schemeId().split("#")[1]
+                                                                                    : candidate.schemeId();
+                    return candidateSchemeName.equals(preferredSchemeId);
+                }).findFirst().ifPresent(authSchemes::add);
+        });
+        candidateAuthSchemes.forEach(candidate -> {
+            if (!authSchemes.contains(candidate)) {
+                authSchemes.add(candidate);
+            }
+        });


This doesn't seem to be very efficient O(n * m). Is that a concern?

Dismissing to unblock the change since I'm OOTO.

RanVaknin added 2 commits May 4, 2025 19:22

Adding functionality to config preferred authschemeProvider

fc6d3e6

adding test coverage

f18fcc2

RanVaknin force-pushed the rvaknin/auth-schem-preference-config branch from 362e5f3 to f18fcc2 Compare May 5, 2025 02:22

RanVaknin and others added 10 commits May 4, 2025 19:57

fix formatting checkstyle

72b1386

Added changelog

39dc9e4

Adding test coverage

f31aa2a

Merge branch 'master' into rvaknin/auth-schem-preference-config

c20030b

Merge branch 'master' into rvaknin/auth-schem-preference-config

17240db

Use SdkSystemSetting for both env and system

a0094ed

Add profiles to service pom

f46a773

Fix test

6ae2294

Fix protocol test dependencies

4ae9a44

Remove dependency on profiles (use option get in generated code instead)

a9e1a08

alextwoods mentioned this pull request May 23, 2025

Add Environment Token support #6130

Draft

12 tasks

alextwoods added 3 commits May 23, 2025 12:27

Fix checkstyle

73e0564

Move AuthSchemePreferenceProvider out of internal module

e20c041

More checkstyle fixes

cb2d5a0

RanVaknin marked this pull request as ready for review May 26, 2025 04:51

RanVaknin requested a review from a team as a code owner May 26, 2025 04:51

zoewangg previously requested changes May 28, 2025

View reviewed changes

L-Applin requested changes May 28, 2025

View reviewed changes

RanVaknin and others added 5 commits May 29, 2025 02:44

Fixing comments, adding fixture file, renaming provider to resolver, …

fa17dcf

…adding coverage

Remove unused import

9c0980b

Add codegen test for preferred auth scheme provider

141b9d6

Check for empty string

491e3cf

Add more documentation

e915d3e

RanVaknin commented May 29, 2025

View reviewed changes

...ces/software/amazon/awssdk/codegen/poet/auth/scheme/test-preferred-auth-scheme-provider.java Outdated Show resolved Hide resolved

Revert "Add codegen test for preferred auth scheme provider"

729abbb

This reverts commit 141b9d6.

zoewangg reviewed May 30, 2025

View reviewed changes

Adding functionality to config preferred authschemeProvider #6083

Are you sure you want to change the base?

Adding functionality to config preferred authschemeProvider #6083

Uh oh!

Conversation

RanVaknin commented May 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Motivation and Context

Example usage:

Modifications

Testing

Uh oh!

Uh oh!

zoewangg May 27, 2025

Choose a reason for hiding this comment

Uh oh!

zoewangg May 30, 2025

Choose a reason for hiding this comment

Uh oh!

alextwoods May 30, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sonarqubecloud bot commented May 29, 2025

Quality Gate passed

Uh oh!

zoewangg May 30, 2025

Choose a reason for hiding this comment

Uh oh!

zoewangg May 30, 2025

Choose a reason for hiding this comment

Uh oh!

zoewangg May 30, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

RanVaknin commented May 2, 2025 •

edited

Loading