7c7a1222d2
* Retrieve SAML Attribute by Name instead of relying on order which is too fragile * Handle case when SAML Attribute SessionDuration is not provided, as it is not a required attribute from SAML response When session duration not provided, AWS consider by default a duration of one hour as cited in the following documentation: "If this attribute is not present, then the credential last for one hour (the default value of the DurationSeconds parameter of the AssumeRoleWithSAML API)." https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_saml_assertions.html#saml_role-session-duration Traceback was: [...] File "/Users/benjamin.brabant/Projects/PERSO/moto/moto/sts/responses.py", line 79, in assume_role_with_saml role = sts_backend.assume_role_with_saml( File "/Users/benjamin.brabant/Projects/PERSO/moto/moto/sts/models.py", line 99, in assume_role_with_saml role = AssumedRole(**kwargs) TypeError: __init__() missing 1 required positional argument: 'duration' * Process saml xml namespaces properly instead of relying on textual prefix that can vary between identity providers * Handle when SAML response AttributeValue xml tag contains attributes that force xmltodict to build a dictionary as for complex types instead of directly returning string value Leverage force_cdata option of xmltodict parser that always return a complex dictionary even if xml tag contains only text and no attributes. * Improve existing test_assume_role_with_saml to be coherent with other assume_role_with_saml tests and remove dead code at the same time
40 lines
934 B
Python
40 lines
934 B
Python
import base64
|
|
import os
|
|
import random
|
|
import string
|
|
|
|
import six
|
|
|
|
ACCOUNT_SPECIFIC_ACCESS_KEY_PREFIX = "8NWMTLYQ"
|
|
ACCOUNT_SPECIFIC_ASSUMED_ROLE_ID_PREFIX = "3X42LBCD"
|
|
SESSION_TOKEN_PREFIX = "FQoGZXIvYXdzEBYaD"
|
|
DEFAULT_STS_SESSION_DURATION = 3600
|
|
|
|
|
|
def random_access_key_id():
|
|
return ACCOUNT_SPECIFIC_ACCESS_KEY_PREFIX + _random_uppercase_or_digit_sequence(8)
|
|
|
|
|
|
def random_secret_access_key():
|
|
return base64.b64encode(os.urandom(30)).decode()
|
|
|
|
|
|
def random_session_token():
|
|
return (
|
|
SESSION_TOKEN_PREFIX
|
|
+ base64.b64encode(os.urandom(266))[len(SESSION_TOKEN_PREFIX) :].decode()
|
|
)
|
|
|
|
|
|
def random_assumed_role_id():
|
|
return (
|
|
ACCOUNT_SPECIFIC_ASSUMED_ROLE_ID_PREFIX + _random_uppercase_or_digit_sequence(9)
|
|
)
|
|
|
|
|
|
def _random_uppercase_or_digit_sequence(length):
|
|
return "".join(
|
|
six.text_type(random.choice(string.ascii_uppercase + string.digits))
|
|
for _ in range(length)
|
|
)
|