@Test public void testConfigure() throws Exception { new STSCredentialsConfigurator(new DisabledX509TrustManager(), new DefaultX509KeyManager(), new DisabledPasswordCallback()).configure(new Host(new TestProtocol())); }
public Credentials configure(final Host host) throws LoginFailureException, LoginCanceledException { final Credentials credentials = new Credentials(host.getCredentials()); final Local file = LocalFactory.get(LocalFactory.get(LocalFactory.get(), ".aws"), "credentials"); final String profile = host.getCredentials().getUsername(); if(log.isDebugEnabled()) { log.debug(String.format("Look for profile name %s in %s", profile, file)); } if(!file.exists()) { log.warn("Missing configuration file ~/.aws/credentials. Skip auto configuration"); return host.getCredentials(); } final Map<String, Map<String, String>> allProfileProperties; try { allProfileProperties = new ProfilesConfigFileLoaderHelper() .parseProfileProperties(new Scanner(file.getInputStream(), StandardCharsets.UTF_8.name())); } catch(AccessDeniedException | IllegalArgumentException e) { log.warn(String.format("Failure reading %s", file), e); return credentials; } final Map<String, BasicProfile> profilesByName = new LinkedHashMap<String, BasicProfile>(); for(Map.Entry<String, Map<String, String>> entry : allProfileProperties.entrySet()) { String profileName = entry.getKey(); Map<String, String> properties = entry.getValue(); profilesByName.put(profileName, new BasicProfile(profileName, properties)); } final Map<String, BasicProfile> profiles = new AllProfiles(profilesByName).getProfiles(); final Optional<Map.Entry<String, BasicProfile>> optional = profiles.entrySet().stream().filter(new Predicate<Map.Entry<String, BasicProfile>>() { @Override public boolean test(final Map.Entry<String, BasicProfile> entry) { final String profileName = entry.getKey(); final BasicProfile basicProfile = entry.getValue(); final String awsAccessIdKey = basicProfile.getAwsAccessIdKey(); if(StringUtils.equals(profileName, profile) || StringUtils.equals(awsAccessIdKey, profile)) { if(log.isDebugEnabled()) { log.debug(String.format("Found matching profile %s", profile)); } return true; } return false; } }).findFirst(); if(optional.isPresent()) { final Map.Entry<String, BasicProfile> entry = optional.get(); final BasicProfile basicProfile = entry.getValue(); if(basicProfile.isRoleBasedProfile()) { if(log.isDebugEnabled()) { log.debug(String.format("Configure credentials from role based profile %s", basicProfile.getProfileName())); } if(StringUtils.isBlank(basicProfile.getRoleSourceProfile())) { throw new LoginFailureException(String.format("Missing source profile reference in profile %s", basicProfile.getProfileName())); } else if(!profiles.containsKey(basicProfile.getRoleSourceProfile())) { throw new LoginFailureException(String.format("Missing source profile with name %s", basicProfile.getRoleSourceProfile())); } else { final BasicProfile sourceProfile = profiles.get(basicProfile.getRoleSourceProfile()); final AWSSecurityTokenService service = this.getTokenService(host, host.getRegion(), sourceProfile.getAwsAccessIdKey(), sourceProfile.getAwsSecretAccessKey(), sourceProfile.getAwsSessionToken()); final String tokenCode; if(basicProfile.getProperties().containsKey("mfa_serial")) { tokenCode = prompt.prompt( host, LocaleFactory.localizedString("Provide additional login credentials", "Credentials"), String.format("%s %s", LocaleFactory.localizedString("Multi-Factor Authentication", "S3"), basicProfile.getProperties().get("mfa_serial")), new LoginOptions(host.getProtocol()) .password(true) .passwordPlaceholder(LocaleFactory.localizedString("MFA Authentication Code", "S3")) .keychain(false) ).getPassword(); } else { tokenCode = null; } final AssumeRoleRequest assumeRoleRequest = new AssumeRoleRequest() .withRoleArn(basicProfile.getRoleArn()) .withSerialNumber(basicProfile.getProperties().getOrDefault("mfa_serial", null)) .withTokenCode(tokenCode ) .withRoleSessionName(new AsciiRandomStringService().random()); if(log.isDebugEnabled()) { log.debug(String.format("Request %s from %s", assumeRoleRequest, service)); } try { final AssumeRoleResult assumeRoleResult = service.assumeRole(assumeRoleRequest); if(log.isDebugEnabled()) { log.debug(String.format("Set credentials from %s", assumeRoleResult)); } credentials.setUsername(assumeRoleResult.getCredentials().getAccessKeyId()); credentials.setPassword(assumeRoleResult.getCredentials().getSecretAccessKey()); credentials.setToken(assumeRoleResult.getCredentials().getSessionToken()); } catch(AWSSecurityTokenServiceException e) { throw new LoginFailureException(e.getErrorMessage(), e); } } } else { if(log.isDebugEnabled()) { log.debug(String.format("Configure credentials from basic profile %s", basicProfile.getProfileName())); } if(StringUtils.isNotBlank(basicProfile.getAwsSessionToken())) { if(log.isDebugEnabled()) { log.debug(String.format("Set session token credentials from profile %s", profile)); } credentials.setUsername(basicProfile.getAwsAccessIdKey()); credentials.setPassword(basicProfile.getAwsSecretAccessKey()); credentials.setToken(basicProfile.getAwsSessionToken()); } else { if(host.getProtocol().isTokenConfigurable()) { if(log.isDebugEnabled()) { log.debug(String.format("Get session token from credentials in profile %s", basicProfile.getProfileName())); } final AWSSecurityTokenService service = this.getTokenService(host, host.getRegion(), basicProfile.getAwsAccessIdKey(), basicProfile.getAwsSecretAccessKey(), basicProfile.getAwsSessionToken()); final GetSessionTokenRequest sessionTokenRequest = new GetSessionTokenRequest(); if(log.isDebugEnabled()) { log.debug(String.format("Request %s from %s", sessionTokenRequest, service)); } try { final GetSessionTokenResult sessionTokenResult = service.getSessionToken(sessionTokenRequest); if(log.isDebugEnabled()) { log.debug(String.format("Set credentials from %s", sessionTokenResult)); } credentials.setUsername(sessionTokenResult.getCredentials().getAccessKeyId()); credentials.setPassword(sessionTokenResult.getCredentials().getSecretAccessKey()); credentials.setToken(sessionTokenResult.getCredentials().getSessionToken()); } catch(AWSSecurityTokenServiceException e) { throw new LoginFailureException(e.getErrorMessage(), e); } } else { if(log.isDebugEnabled()) { log.debug(String.format("Set static credentials from profile %s", basicProfile.getProfileName())); } credentials.setUsername(basicProfile.getAwsAccessIdKey()); credentials.setPassword(basicProfile.getAwsSecretAccessKey()); } } } } return credentials; }
STSCredentialsConfigurator { public Credentials configure(final Host host) throws LoginFailureException, LoginCanceledException { final Credentials credentials = new Credentials(host.getCredentials()); final Local file = LocalFactory.get(LocalFactory.get(LocalFactory.get(), ".aws"), "credentials"); final String profile = host.getCredentials().getUsername(); if(log.isDebugEnabled()) { log.debug(String.format("Look for profile name %s in %s", profile, file)); } if(!file.exists()) { log.warn("Missing configuration file ~/.aws/credentials. Skip auto configuration"); return host.getCredentials(); } final Map<String, Map<String, String>> allProfileProperties; try { allProfileProperties = new ProfilesConfigFileLoaderHelper() .parseProfileProperties(new Scanner(file.getInputStream(), StandardCharsets.UTF_8.name())); } catch(AccessDeniedException | IllegalArgumentException e) { log.warn(String.format("Failure reading %s", file), e); return credentials; } final Map<String, BasicProfile> profilesByName = new LinkedHashMap<String, BasicProfile>(); for(Map.Entry<String, Map<String, String>> entry : allProfileProperties.entrySet()) { String profileName = entry.getKey(); Map<String, String> properties = entry.getValue(); profilesByName.put(profileName, new BasicProfile(profileName, properties)); } final Map<String, BasicProfile> profiles = new AllProfiles(profilesByName).getProfiles(); final Optional<Map.Entry<String, BasicProfile>> optional = profiles.entrySet().stream().filter(new Predicate<Map.Entry<String, BasicProfile>>() { @Override public boolean test(final Map.Entry<String, BasicProfile> entry) { final String profileName = entry.getKey(); final BasicProfile basicProfile = entry.getValue(); final String awsAccessIdKey = basicProfile.getAwsAccessIdKey(); if(StringUtils.equals(profileName, profile) || StringUtils.equals(awsAccessIdKey, profile)) { if(log.isDebugEnabled()) { log.debug(String.format("Found matching profile %s", profile)); } return true; } return false; } }).findFirst(); if(optional.isPresent()) { final Map.Entry<String, BasicProfile> entry = optional.get(); final BasicProfile basicProfile = entry.getValue(); if(basicProfile.isRoleBasedProfile()) { if(log.isDebugEnabled()) { log.debug(String.format("Configure credentials from role based profile %s", basicProfile.getProfileName())); } if(StringUtils.isBlank(basicProfile.getRoleSourceProfile())) { throw new LoginFailureException(String.format("Missing source profile reference in profile %s", basicProfile.getProfileName())); } else if(!profiles.containsKey(basicProfile.getRoleSourceProfile())) { throw new LoginFailureException(String.format("Missing source profile with name %s", basicProfile.getRoleSourceProfile())); } else { final BasicProfile sourceProfile = profiles.get(basicProfile.getRoleSourceProfile()); final AWSSecurityTokenService service = this.getTokenService(host, host.getRegion(), sourceProfile.getAwsAccessIdKey(), sourceProfile.getAwsSecretAccessKey(), sourceProfile.getAwsSessionToken()); final String tokenCode; if(basicProfile.getProperties().containsKey("mfa_serial")) { tokenCode = prompt.prompt( host, LocaleFactory.localizedString("Provide additional login credentials", "Credentials"), String.format("%s %s", LocaleFactory.localizedString("Multi-Factor Authentication", "S3"), basicProfile.getProperties().get("mfa_serial")), new LoginOptions(host.getProtocol()) .password(true) .passwordPlaceholder(LocaleFactory.localizedString("MFA Authentication Code", "S3")) .keychain(false) ).getPassword(); } else { tokenCode = null; } final AssumeRoleRequest assumeRoleRequest = new AssumeRoleRequest() .withRoleArn(basicProfile.getRoleArn()) .withSerialNumber(basicProfile.getProperties().getOrDefault("mfa_serial", null)) .withTokenCode(tokenCode ) .withRoleSessionName(new AsciiRandomStringService().random()); if(log.isDebugEnabled()) { log.debug(String.format("Request %s from %s", assumeRoleRequest, service)); } try { final AssumeRoleResult assumeRoleResult = service.assumeRole(assumeRoleRequest); if(log.isDebugEnabled()) { log.debug(String.format("Set credentials from %s", assumeRoleResult)); } credentials.setUsername(assumeRoleResult.getCredentials().getAccessKeyId()); credentials.setPassword(assumeRoleResult.getCredentials().getSecretAccessKey()); credentials.setToken(assumeRoleResult.getCredentials().getSessionToken()); } catch(AWSSecurityTokenServiceException e) { throw new LoginFailureException(e.getErrorMessage(), e); } } } else { if(log.isDebugEnabled()) { log.debug(String.format("Configure credentials from basic profile %s", basicProfile.getProfileName())); } if(StringUtils.isNotBlank(basicProfile.getAwsSessionToken())) { if(log.isDebugEnabled()) { log.debug(String.format("Set session token credentials from profile %s", profile)); } credentials.setUsername(basicProfile.getAwsAccessIdKey()); credentials.setPassword(basicProfile.getAwsSecretAccessKey()); credentials.setToken(basicProfile.getAwsSessionToken()); } else { if(host.getProtocol().isTokenConfigurable()) { if(log.isDebugEnabled()) { log.debug(String.format("Get session token from credentials in profile %s", basicProfile.getProfileName())); } final AWSSecurityTokenService service = this.getTokenService(host, host.getRegion(), basicProfile.getAwsAccessIdKey(), basicProfile.getAwsSecretAccessKey(), basicProfile.getAwsSessionToken()); final GetSessionTokenRequest sessionTokenRequest = new GetSessionTokenRequest(); if(log.isDebugEnabled()) { log.debug(String.format("Request %s from %s", sessionTokenRequest, service)); } try { final GetSessionTokenResult sessionTokenResult = service.getSessionToken(sessionTokenRequest); if(log.isDebugEnabled()) { log.debug(String.format("Set credentials from %s", sessionTokenResult)); } credentials.setUsername(sessionTokenResult.getCredentials().getAccessKeyId()); credentials.setPassword(sessionTokenResult.getCredentials().getSecretAccessKey()); credentials.setToken(sessionTokenResult.getCredentials().getSessionToken()); } catch(AWSSecurityTokenServiceException e) { throw new LoginFailureException(e.getErrorMessage(), e); } } else { if(log.isDebugEnabled()) { log.debug(String.format("Set static credentials from profile %s", basicProfile.getProfileName())); } credentials.setUsername(basicProfile.getAwsAccessIdKey()); credentials.setPassword(basicProfile.getAwsSecretAccessKey()); } } } } return credentials; } }
STSCredentialsConfigurator { public Credentials configure(final Host host) throws LoginFailureException, LoginCanceledException { final Credentials credentials = new Credentials(host.getCredentials()); final Local file = LocalFactory.get(LocalFactory.get(LocalFactory.get(), ".aws"), "credentials"); final String profile = host.getCredentials().getUsername(); if(log.isDebugEnabled()) { log.debug(String.format("Look for profile name %s in %s", profile, file)); } if(!file.exists()) { log.warn("Missing configuration file ~/.aws/credentials. Skip auto configuration"); return host.getCredentials(); } final Map<String, Map<String, String>> allProfileProperties; try { allProfileProperties = new ProfilesConfigFileLoaderHelper() .parseProfileProperties(new Scanner(file.getInputStream(), StandardCharsets.UTF_8.name())); } catch(AccessDeniedException | IllegalArgumentException e) { log.warn(String.format("Failure reading %s", file), e); return credentials; } final Map<String, BasicProfile> profilesByName = new LinkedHashMap<String, BasicProfile>(); for(Map.Entry<String, Map<String, String>> entry : allProfileProperties.entrySet()) { String profileName = entry.getKey(); Map<String, String> properties = entry.getValue(); profilesByName.put(profileName, new BasicProfile(profileName, properties)); } final Map<String, BasicProfile> profiles = new AllProfiles(profilesByName).getProfiles(); final Optional<Map.Entry<String, BasicProfile>> optional = profiles.entrySet().stream().filter(new Predicate<Map.Entry<String, BasicProfile>>() { @Override public boolean test(final Map.Entry<String, BasicProfile> entry) { final String profileName = entry.getKey(); final BasicProfile basicProfile = entry.getValue(); final String awsAccessIdKey = basicProfile.getAwsAccessIdKey(); if(StringUtils.equals(profileName, profile) || StringUtils.equals(awsAccessIdKey, profile)) { if(log.isDebugEnabled()) { log.debug(String.format("Found matching profile %s", profile)); } return true; } return false; } }).findFirst(); if(optional.isPresent()) { final Map.Entry<String, BasicProfile> entry = optional.get(); final BasicProfile basicProfile = entry.getValue(); if(basicProfile.isRoleBasedProfile()) { if(log.isDebugEnabled()) { log.debug(String.format("Configure credentials from role based profile %s", basicProfile.getProfileName())); } if(StringUtils.isBlank(basicProfile.getRoleSourceProfile())) { throw new LoginFailureException(String.format("Missing source profile reference in profile %s", basicProfile.getProfileName())); } else if(!profiles.containsKey(basicProfile.getRoleSourceProfile())) { throw new LoginFailureException(String.format("Missing source profile with name %s", basicProfile.getRoleSourceProfile())); } else { final BasicProfile sourceProfile = profiles.get(basicProfile.getRoleSourceProfile()); final AWSSecurityTokenService service = this.getTokenService(host, host.getRegion(), sourceProfile.getAwsAccessIdKey(), sourceProfile.getAwsSecretAccessKey(), sourceProfile.getAwsSessionToken()); final String tokenCode; if(basicProfile.getProperties().containsKey("mfa_serial")) { tokenCode = prompt.prompt( host, LocaleFactory.localizedString("Provide additional login credentials", "Credentials"), String.format("%s %s", LocaleFactory.localizedString("Multi-Factor Authentication", "S3"), basicProfile.getProperties().get("mfa_serial")), new LoginOptions(host.getProtocol()) .password(true) .passwordPlaceholder(LocaleFactory.localizedString("MFA Authentication Code", "S3")) .keychain(false) ).getPassword(); } else { tokenCode = null; } final AssumeRoleRequest assumeRoleRequest = new AssumeRoleRequest() .withRoleArn(basicProfile.getRoleArn()) .withSerialNumber(basicProfile.getProperties().getOrDefault("mfa_serial", null)) .withTokenCode(tokenCode ) .withRoleSessionName(new AsciiRandomStringService().random()); if(log.isDebugEnabled()) { log.debug(String.format("Request %s from %s", assumeRoleRequest, service)); } try { final AssumeRoleResult assumeRoleResult = service.assumeRole(assumeRoleRequest); if(log.isDebugEnabled()) { log.debug(String.format("Set credentials from %s", assumeRoleResult)); } credentials.setUsername(assumeRoleResult.getCredentials().getAccessKeyId()); credentials.setPassword(assumeRoleResult.getCredentials().getSecretAccessKey()); credentials.setToken(assumeRoleResult.getCredentials().getSessionToken()); } catch(AWSSecurityTokenServiceException e) { throw new LoginFailureException(e.getErrorMessage(), e); } } } else { if(log.isDebugEnabled()) { log.debug(String.format("Configure credentials from basic profile %s", basicProfile.getProfileName())); } if(StringUtils.isNotBlank(basicProfile.getAwsSessionToken())) { if(log.isDebugEnabled()) { log.debug(String.format("Set session token credentials from profile %s", profile)); } credentials.setUsername(basicProfile.getAwsAccessIdKey()); credentials.setPassword(basicProfile.getAwsSecretAccessKey()); credentials.setToken(basicProfile.getAwsSessionToken()); } else { if(host.getProtocol().isTokenConfigurable()) { if(log.isDebugEnabled()) { log.debug(String.format("Get session token from credentials in profile %s", basicProfile.getProfileName())); } final AWSSecurityTokenService service = this.getTokenService(host, host.getRegion(), basicProfile.getAwsAccessIdKey(), basicProfile.getAwsSecretAccessKey(), basicProfile.getAwsSessionToken()); final GetSessionTokenRequest sessionTokenRequest = new GetSessionTokenRequest(); if(log.isDebugEnabled()) { log.debug(String.format("Request %s from %s", sessionTokenRequest, service)); } try { final GetSessionTokenResult sessionTokenResult = service.getSessionToken(sessionTokenRequest); if(log.isDebugEnabled()) { log.debug(String.format("Set credentials from %s", sessionTokenResult)); } credentials.setUsername(sessionTokenResult.getCredentials().getAccessKeyId()); credentials.setPassword(sessionTokenResult.getCredentials().getSecretAccessKey()); credentials.setToken(sessionTokenResult.getCredentials().getSessionToken()); } catch(AWSSecurityTokenServiceException e) { throw new LoginFailureException(e.getErrorMessage(), e); } } else { if(log.isDebugEnabled()) { log.debug(String.format("Set static credentials from profile %s", basicProfile.getProfileName())); } credentials.setUsername(basicProfile.getAwsAccessIdKey()); credentials.setPassword(basicProfile.getAwsSecretAccessKey()); } } } } return credentials; } STSCredentialsConfigurator(final X509TrustManager trust, final X509KeyManager key, final PasswordCallback prompt); }
STSCredentialsConfigurator { public Credentials configure(final Host host) throws LoginFailureException, LoginCanceledException { final Credentials credentials = new Credentials(host.getCredentials()); final Local file = LocalFactory.get(LocalFactory.get(LocalFactory.get(), ".aws"), "credentials"); final String profile = host.getCredentials().getUsername(); if(log.isDebugEnabled()) { log.debug(String.format("Look for profile name %s in %s", profile, file)); } if(!file.exists()) { log.warn("Missing configuration file ~/.aws/credentials. Skip auto configuration"); return host.getCredentials(); } final Map<String, Map<String, String>> allProfileProperties; try { allProfileProperties = new ProfilesConfigFileLoaderHelper() .parseProfileProperties(new Scanner(file.getInputStream(), StandardCharsets.UTF_8.name())); } catch(AccessDeniedException | IllegalArgumentException e) { log.warn(String.format("Failure reading %s", file), e); return credentials; } final Map<String, BasicProfile> profilesByName = new LinkedHashMap<String, BasicProfile>(); for(Map.Entry<String, Map<String, String>> entry : allProfileProperties.entrySet()) { String profileName = entry.getKey(); Map<String, String> properties = entry.getValue(); profilesByName.put(profileName, new BasicProfile(profileName, properties)); } final Map<String, BasicProfile> profiles = new AllProfiles(profilesByName).getProfiles(); final Optional<Map.Entry<String, BasicProfile>> optional = profiles.entrySet().stream().filter(new Predicate<Map.Entry<String, BasicProfile>>() { @Override public boolean test(final Map.Entry<String, BasicProfile> entry) { final String profileName = entry.getKey(); final BasicProfile basicProfile = entry.getValue(); final String awsAccessIdKey = basicProfile.getAwsAccessIdKey(); if(StringUtils.equals(profileName, profile) || StringUtils.equals(awsAccessIdKey, profile)) { if(log.isDebugEnabled()) { log.debug(String.format("Found matching profile %s", profile)); } return true; } return false; } }).findFirst(); if(optional.isPresent()) { final Map.Entry<String, BasicProfile> entry = optional.get(); final BasicProfile basicProfile = entry.getValue(); if(basicProfile.isRoleBasedProfile()) { if(log.isDebugEnabled()) { log.debug(String.format("Configure credentials from role based profile %s", basicProfile.getProfileName())); } if(StringUtils.isBlank(basicProfile.getRoleSourceProfile())) { throw new LoginFailureException(String.format("Missing source profile reference in profile %s", basicProfile.getProfileName())); } else if(!profiles.containsKey(basicProfile.getRoleSourceProfile())) { throw new LoginFailureException(String.format("Missing source profile with name %s", basicProfile.getRoleSourceProfile())); } else { final BasicProfile sourceProfile = profiles.get(basicProfile.getRoleSourceProfile()); final AWSSecurityTokenService service = this.getTokenService(host, host.getRegion(), sourceProfile.getAwsAccessIdKey(), sourceProfile.getAwsSecretAccessKey(), sourceProfile.getAwsSessionToken()); final String tokenCode; if(basicProfile.getProperties().containsKey("mfa_serial")) { tokenCode = prompt.prompt( host, LocaleFactory.localizedString("Provide additional login credentials", "Credentials"), String.format("%s %s", LocaleFactory.localizedString("Multi-Factor Authentication", "S3"), basicProfile.getProperties().get("mfa_serial")), new LoginOptions(host.getProtocol()) .password(true) .passwordPlaceholder(LocaleFactory.localizedString("MFA Authentication Code", "S3")) .keychain(false) ).getPassword(); } else { tokenCode = null; } final AssumeRoleRequest assumeRoleRequest = new AssumeRoleRequest() .withRoleArn(basicProfile.getRoleArn()) .withSerialNumber(basicProfile.getProperties().getOrDefault("mfa_serial", null)) .withTokenCode(tokenCode ) .withRoleSessionName(new AsciiRandomStringService().random()); if(log.isDebugEnabled()) { log.debug(String.format("Request %s from %s", assumeRoleRequest, service)); } try { final AssumeRoleResult assumeRoleResult = service.assumeRole(assumeRoleRequest); if(log.isDebugEnabled()) { log.debug(String.format("Set credentials from %s", assumeRoleResult)); } credentials.setUsername(assumeRoleResult.getCredentials().getAccessKeyId()); credentials.setPassword(assumeRoleResult.getCredentials().getSecretAccessKey()); credentials.setToken(assumeRoleResult.getCredentials().getSessionToken()); } catch(AWSSecurityTokenServiceException e) { throw new LoginFailureException(e.getErrorMessage(), e); } } } else { if(log.isDebugEnabled()) { log.debug(String.format("Configure credentials from basic profile %s", basicProfile.getProfileName())); } if(StringUtils.isNotBlank(basicProfile.getAwsSessionToken())) { if(log.isDebugEnabled()) { log.debug(String.format("Set session token credentials from profile %s", profile)); } credentials.setUsername(basicProfile.getAwsAccessIdKey()); credentials.setPassword(basicProfile.getAwsSecretAccessKey()); credentials.setToken(basicProfile.getAwsSessionToken()); } else { if(host.getProtocol().isTokenConfigurable()) { if(log.isDebugEnabled()) { log.debug(String.format("Get session token from credentials in profile %s", basicProfile.getProfileName())); } final AWSSecurityTokenService service = this.getTokenService(host, host.getRegion(), basicProfile.getAwsAccessIdKey(), basicProfile.getAwsSecretAccessKey(), basicProfile.getAwsSessionToken()); final GetSessionTokenRequest sessionTokenRequest = new GetSessionTokenRequest(); if(log.isDebugEnabled()) { log.debug(String.format("Request %s from %s", sessionTokenRequest, service)); } try { final GetSessionTokenResult sessionTokenResult = service.getSessionToken(sessionTokenRequest); if(log.isDebugEnabled()) { log.debug(String.format("Set credentials from %s", sessionTokenResult)); } credentials.setUsername(sessionTokenResult.getCredentials().getAccessKeyId()); credentials.setPassword(sessionTokenResult.getCredentials().getSecretAccessKey()); credentials.setToken(sessionTokenResult.getCredentials().getSessionToken()); } catch(AWSSecurityTokenServiceException e) { throw new LoginFailureException(e.getErrorMessage(), e); } } else { if(log.isDebugEnabled()) { log.debug(String.format("Set static credentials from profile %s", basicProfile.getProfileName())); } credentials.setUsername(basicProfile.getAwsAccessIdKey()); credentials.setPassword(basicProfile.getAwsSecretAccessKey()); } } } } return credentials; } STSCredentialsConfigurator(final X509TrustManager trust, final X509KeyManager key, final PasswordCallback prompt); Credentials configure(final Host host); }
STSCredentialsConfigurator { public Credentials configure(final Host host) throws LoginFailureException, LoginCanceledException { final Credentials credentials = new Credentials(host.getCredentials()); final Local file = LocalFactory.get(LocalFactory.get(LocalFactory.get(), ".aws"), "credentials"); final String profile = host.getCredentials().getUsername(); if(log.isDebugEnabled()) { log.debug(String.format("Look for profile name %s in %s", profile, file)); } if(!file.exists()) { log.warn("Missing configuration file ~/.aws/credentials. Skip auto configuration"); return host.getCredentials(); } final Map<String, Map<String, String>> allProfileProperties; try { allProfileProperties = new ProfilesConfigFileLoaderHelper() .parseProfileProperties(new Scanner(file.getInputStream(), StandardCharsets.UTF_8.name())); } catch(AccessDeniedException | IllegalArgumentException e) { log.warn(String.format("Failure reading %s", file), e); return credentials; } final Map<String, BasicProfile> profilesByName = new LinkedHashMap<String, BasicProfile>(); for(Map.Entry<String, Map<String, String>> entry : allProfileProperties.entrySet()) { String profileName = entry.getKey(); Map<String, String> properties = entry.getValue(); profilesByName.put(profileName, new BasicProfile(profileName, properties)); } final Map<String, BasicProfile> profiles = new AllProfiles(profilesByName).getProfiles(); final Optional<Map.Entry<String, BasicProfile>> optional = profiles.entrySet().stream().filter(new Predicate<Map.Entry<String, BasicProfile>>() { @Override public boolean test(final Map.Entry<String, BasicProfile> entry) { final String profileName = entry.getKey(); final BasicProfile basicProfile = entry.getValue(); final String awsAccessIdKey = basicProfile.getAwsAccessIdKey(); if(StringUtils.equals(profileName, profile) || StringUtils.equals(awsAccessIdKey, profile)) { if(log.isDebugEnabled()) { log.debug(String.format("Found matching profile %s", profile)); } return true; } return false; } }).findFirst(); if(optional.isPresent()) { final Map.Entry<String, BasicProfile> entry = optional.get(); final BasicProfile basicProfile = entry.getValue(); if(basicProfile.isRoleBasedProfile()) { if(log.isDebugEnabled()) { log.debug(String.format("Configure credentials from role based profile %s", basicProfile.getProfileName())); } if(StringUtils.isBlank(basicProfile.getRoleSourceProfile())) { throw new LoginFailureException(String.format("Missing source profile reference in profile %s", basicProfile.getProfileName())); } else if(!profiles.containsKey(basicProfile.getRoleSourceProfile())) { throw new LoginFailureException(String.format("Missing source profile with name %s", basicProfile.getRoleSourceProfile())); } else { final BasicProfile sourceProfile = profiles.get(basicProfile.getRoleSourceProfile()); final AWSSecurityTokenService service = this.getTokenService(host, host.getRegion(), sourceProfile.getAwsAccessIdKey(), sourceProfile.getAwsSecretAccessKey(), sourceProfile.getAwsSessionToken()); final String tokenCode; if(basicProfile.getProperties().containsKey("mfa_serial")) { tokenCode = prompt.prompt( host, LocaleFactory.localizedString("Provide additional login credentials", "Credentials"), String.format("%s %s", LocaleFactory.localizedString("Multi-Factor Authentication", "S3"), basicProfile.getProperties().get("mfa_serial")), new LoginOptions(host.getProtocol()) .password(true) .passwordPlaceholder(LocaleFactory.localizedString("MFA Authentication Code", "S3")) .keychain(false) ).getPassword(); } else { tokenCode = null; } final AssumeRoleRequest assumeRoleRequest = new AssumeRoleRequest() .withRoleArn(basicProfile.getRoleArn()) .withSerialNumber(basicProfile.getProperties().getOrDefault("mfa_serial", null)) .withTokenCode(tokenCode ) .withRoleSessionName(new AsciiRandomStringService().random()); if(log.isDebugEnabled()) { log.debug(String.format("Request %s from %s", assumeRoleRequest, service)); } try { final AssumeRoleResult assumeRoleResult = service.assumeRole(assumeRoleRequest); if(log.isDebugEnabled()) { log.debug(String.format("Set credentials from %s", assumeRoleResult)); } credentials.setUsername(assumeRoleResult.getCredentials().getAccessKeyId()); credentials.setPassword(assumeRoleResult.getCredentials().getSecretAccessKey()); credentials.setToken(assumeRoleResult.getCredentials().getSessionToken()); } catch(AWSSecurityTokenServiceException e) { throw new LoginFailureException(e.getErrorMessage(), e); } } } else { if(log.isDebugEnabled()) { log.debug(String.format("Configure credentials from basic profile %s", basicProfile.getProfileName())); } if(StringUtils.isNotBlank(basicProfile.getAwsSessionToken())) { if(log.isDebugEnabled()) { log.debug(String.format("Set session token credentials from profile %s", profile)); } credentials.setUsername(basicProfile.getAwsAccessIdKey()); credentials.setPassword(basicProfile.getAwsSecretAccessKey()); credentials.setToken(basicProfile.getAwsSessionToken()); } else { if(host.getProtocol().isTokenConfigurable()) { if(log.isDebugEnabled()) { log.debug(String.format("Get session token from credentials in profile %s", basicProfile.getProfileName())); } final AWSSecurityTokenService service = this.getTokenService(host, host.getRegion(), basicProfile.getAwsAccessIdKey(), basicProfile.getAwsSecretAccessKey(), basicProfile.getAwsSessionToken()); final GetSessionTokenRequest sessionTokenRequest = new GetSessionTokenRequest(); if(log.isDebugEnabled()) { log.debug(String.format("Request %s from %s", sessionTokenRequest, service)); } try { final GetSessionTokenResult sessionTokenResult = service.getSessionToken(sessionTokenRequest); if(log.isDebugEnabled()) { log.debug(String.format("Set credentials from %s", sessionTokenResult)); } credentials.setUsername(sessionTokenResult.getCredentials().getAccessKeyId()); credentials.setPassword(sessionTokenResult.getCredentials().getSecretAccessKey()); credentials.setToken(sessionTokenResult.getCredentials().getSessionToken()); } catch(AWSSecurityTokenServiceException e) { throw new LoginFailureException(e.getErrorMessage(), e); } } else { if(log.isDebugEnabled()) { log.debug(String.format("Set static credentials from profile %s", basicProfile.getProfileName())); } credentials.setUsername(basicProfile.getAwsAccessIdKey()); credentials.setPassword(basicProfile.getAwsSecretAccessKey()); } } } } return credentials; } STSCredentialsConfigurator(final X509TrustManager trust, final X509KeyManager key, final PasswordCallback prompt); Credentials configure(final Host host);  }