You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@reqsign.apache.org by "Xuanwo (via GitHub)" <gi...@apache.org> on 2026/10/02 17:33:17 UTC
[PR] feat(aws): refresh named SSO session access tokens [reqsign]
Xuanwo opened a new pull request, #903:
URL: https://github.com/apache/reqsign/pull/903
Closes #898.
Named SSO sessions now renew expired access tokens with the cached OIDC refresh token and client registration through `Context::http_send`. The provider retains the returned expiration and rotated refresh token before requesting role credentials, so a failed role exchange does not discard refresh state. Missing or expired registration and rejected refresh grants report an actionable login error; transient transport/service failures remain retryable. Legacy inline SSO configuration stays non-refreshable, and no interactive login is started.
Refreshed material lives only in the provider and its clones, coordinated by an async mutex and isolated by session, configuration source, cache path, region, and start URL. The AWS CLI cache is read but never written: independent providers/processes do not coordinate, and restarting requires usable on-disk refresh material. Once the memory token expires, a newer CLI login cache can replace it. This preserves the existing read-only runtime boundary without introducing filesystem writes inside the provider.
The AWS default chain now propagates SSO errors instead of silently falling through to another identity. `ProvideCredentialChain::push_with_error_propagation` makes that behavior explicit for custom chains while preserving existing chain insertion behavior.
This includes the named-session resolution and session-name cache selection prerequisite from #856; assume-role profile graphs remain outside this change. The SSO configuration loader is still local to this provider and should be integrated with the shared parser in #894 while preserving absent-versus-invalid SSO configuration semantics.
Deterministic tests use synthetic file readers, HTTP responses, a controlled clock, and gated concurrent calls. They cover repeated refresh and rotation, role-exchange failure, isolation, legacy behavior, redaction, and the default-chain error boundary. No real AWS account or developer SSO cache was used.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@reqsign.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@reqsign.apache.org
For additional commands, e-mail: commits-help@reqsign.apache.org
Re: [PR] feat(aws): refresh named SSO session access tokens [reqsign]
Posted by "Xuanwo (via GitHub)" <gi...@apache.org>.
Xuanwo merged PR #903:
URL: https://github.com/apache/reqsign/pull/903
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@reqsign.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@reqsign.apache.org
For additional commands, e-mail: commits-help@reqsign.apache.org