Merge pull request #107 from kouk/stsfederation

STS get_federation_token support

moto/sts/models.py

@@ -4,9 +4,11 @@ from moto.core.utils import iso_8601_datetime
 
 
 class Token(object):
-    def __init__(self, duration):
+    def __init__(self, duration, name=None, policy=None):
         now = datetime.datetime.now()
         self.expiration = now + datetime.timedelta(seconds=duration)
+        self.name = name
+        self.policy = None
 
     @property
     def expiration_ISO8601(self):
@@ -32,6 +34,10 @@ class STSBackend(BaseBackend):
         token = Token(duration=duration)
         return token
 
+    def get_federation_token(self, name, duration, policy):
+        token = Token(duration=duration, name=name, policy=policy)
+        return token
+
     def assume_role(self, **kwargs):
         role = AssumedRole(**kwargs)
         return role

moto/sts/responses.py

@@ -12,6 +12,15 @@ class TokenResponse(BaseResponse):
         template = Template(GET_SESSION_TOKEN_RESPONSE)
         return template.render(token=token)
 
+    def get_federation_token(self):
+        duration = int(self.querystring.get('DurationSeconds', [43200])[0])
+        policy = self.querystring.get('Policy', [None])[0]
+        name = self.querystring.get('Name')[0]
+        token = sts_backend.get_federation_token(
+            duration=duration, name=name, policy=policy)
+        template = Template(GET_FEDERATION_TOKEN_RESPONSE)
+        return template.render(token=token)
+
     def assume_role(self):
         role_session_name = self.querystring.get('RoleSessionName')[0]
         role_arn = self.querystring.get('RoleArn')[0]
@@ -46,6 +55,27 @@ GET_SESSION_TOKEN_RESPONSE = """<GetSessionTokenResponse xmlns="https://sts.amaz
 </GetSessionTokenResponse>"""
 
 
+GET_FEDERATION_TOKEN_RESPONSE = """<GetFederationTokenResponse xmlns="https://sts.amazonaws.com/doc/
+2011-06-15/">
+  <GetFederationTokenResult>
+    <Credentials>
+      <SessionToken>AQoDYXdzEPT//////////wEXAMPLEtc764bNrC9SAPBSM22wDOk4x4HIZ8j4FZTwdQWLWsKWHGBuFqwAeMicRXmxfpSPfIeoIYRqTflfKD8YUuwthAx7mSEI/qkPpKPi/kMcGdQrmGdeehM4IC1NtBmUpp2wUE8phUZampKsburEDy0KPkyQDYwT7WZ0wq5VSXDvp75YU9HFvlRd8Tx6q6fE8YQcHNVXAkiY9q6d+xo0rKwT38xVqr7ZD0u0iPPkUL64lIZbqBAz+scqKmlzm8FDrypNC9Yjc8fPOLn9FX9KSYvKTr4rvx3iSIlTJabIQwj2ICCR/oLxBA==</SessionToken>
+      <SecretAccessKey>wJalrXUtnFEMI/K7MDENG/bPxRfiCYzEXAMPLEKEY</SecretAccessKey>
+      <Expiration>{{ token.expiration_ISO8601 }}</Expiration>
+      <AccessKeyId>AKIAIOSFODNN7EXAMPLE</AccessKeyId>
+    </Credentials>
+    <FederatedUser>
+      <Arn>arn:aws:sts::123456789012:federated-user/{{ token.name }}</Arn>
+      <FederatedUserId>123456789012:{{ token.name }}</FederatedUserId>
+    </FederatedUser>
+    <PackedPolicySize>6</PackedPolicySize>
+  </GetFederationTokenResult>
+  <ResponseMetadata>
+    <RequestId>c6104cbe-af31-11e0-8154-cbc7ccf896c7</RequestId>
+  </ResponseMetadata>
+</GetFederationTokenResponse>"""
+
+
 ASSUME_ROLE_RESPONSE = """<AssumeRoleResponse xmlns="https://sts.amazonaws.com/doc/
 2011-06-15/">
   <AssumeRoleResult>

tests/test_sts/test_server.py

@@ -15,3 +15,13 @@ def test_sts_get_session_token():
     res.status_code.should.equal(200)
     res.data.should.contain("SessionToken")
     res.data.should.contain("AccessKeyId")
+
+
+def test_sts_get_federation_token():
+    backend = server.create_backend_app("sts")
+    test_client = backend.test_client()
+
+    res = test_client.get('/?Action=GetFederationToken&Name=Bob')
+    res.status_code.should.equal(200)
+    res.data.should.contain("SessionToken")
+    res.data.should.contain("AccessKeyId")

tests/test_sts/test_sts.py

@@ -19,6 +19,20 @@ def test_get_session_token():
     token.secret_key.should.equal("wJalrXUtnFEMI/K7MDENG/bPxRfiCYzEXAMPLEKEY")
 
 
+@freeze_time("2012-01-01 12:00:00")
+@mock_sts
+def test_get_federation_token():
+    conn = boto.connect_sts()
+    token = conn.get_federation_token(duration=123, name="Bob")
+
+    token.credentials.expiration.should.equal('2012-01-01T12:02:03Z')
+    token.credentials.session_token.should.equal("AQoDYXdzEPT//////////wEXAMPLEtc764bNrC9SAPBSM22wDOk4x4HIZ8j4FZTwdQWLWsKWHGBuFqwAeMicRXmxfpSPfIeoIYRqTflfKD8YUuwthAx7mSEI/qkPpKPi/kMcGdQrmGdeehM4IC1NtBmUpp2wUE8phUZampKsburEDy0KPkyQDYwT7WZ0wq5VSXDvp75YU9HFvlRd8Tx6q6fE8YQcHNVXAkiY9q6d+xo0rKwT38xVqr7ZD0u0iPPkUL64lIZbqBAz+scqKmlzm8FDrypNC9Yjc8fPOLn9FX9KSYvKTr4rvx3iSIlTJabIQwj2ICCR/oLxBA==")
+    token.credentials.access_key.should.equal("AKIAIOSFODNN7EXAMPLE")
+    token.credentials.secret_key.should.equal("wJalrXUtnFEMI/K7MDENG/bPxRfiCYzEXAMPLEKEY")
+    token.federated_user_arn.should.equal("arn:aws:sts::123456789012:federated-user/Bob")
+    token.federated_user_id.should.equal("123456789012:Bob")
+
+
 @freeze_time("2012-01-01 12:00:00")
 @mock_sts
 def test_assume_role():