AWS SSO OIDC

Creates and returns an access token for the authorized client. The access token issued will be used to fetch short-term credentials for the assigned roles in the AWS account.

See also: AWS API Documentation

Request Syntax

client.create_token(
    clientId='string',
    clientSecret='string',
    grantType='string',
    deviceCode='string',
    code='string',
    refreshToken='string',
    scope=[
        'string',
    ],
    redirectUri='string'
)

type clientId:

string

param clientId:

[REQUIRED]

The unique identifier string for each client. This value should come from the persisted result of the RegisterClient API.

type clientSecret:

string

param clientSecret:

[REQUIRED]

A secret string generated for the client. This value should come from the persisted result of the RegisterClient API.

type grantType:

string

param grantType:

[REQUIRED]

Supports grant types for authorization code, refresh token, and device code request.

type deviceCode:

string

param deviceCode:

[REQUIRED]

Used only when calling this API for the device code grant type. This short-term code is used to identify this authentication attempt. This should come from an in-memory reference to the result of the StartDeviceAuthorization API.

type code:

string

param code:

The authorization code received from the authorization service. This parameter is required to perform an authorization grant request to get access to a token.

type refreshToken:

string

param refreshToken:

The token used to obtain an access token in the event that the access token is invalid or expired. This token is not issued by the service.

type scope:

list

param scope:

The list of scopes that is defined by the client. Upon authorization, this list is used to restrict permissions when granting an access token.

• (string) --

type redirectUri:

string

param redirectUri:

The location of the application that will receive the authorization code. Users authorize the service to send the request to this location.

rtype:

dict

returns:

Response Syntax

{
    'accessToken': 'string',
    'tokenType': 'string',
    'expiresIn': 123,
    'refreshToken': 'string',
    'idToken': 'string'
}

Response Structure

• (dict) --

  • accessToken (string) --

    An opaque token to access AWS SSO resources assigned to a user.

  • tokenType (string) --

    Used to notify the client that the returned token is an access token. The supported type is BearerToken.

  • expiresIn (integer) --

    Indicates the time in seconds when an access token will expire.

  • refreshToken (string) --

    A token that, if present, can be used to refresh a previously issued access token that might have expired.

  • idToken (string) --

    The identifier of the user that associated with the access token, if present.

Initiates device authorization by requesting a pair of verification codes from the authorization service.

See also: AWS API Documentation

Request Syntax

client.start_device_authorization(
    clientId='string',
    clientSecret='string',
    startUrl='string'
)

type clientId:

string

param clientId:

[REQUIRED]

The unique identifier string for the client that is registered with AWS SSO. This value should come from the persisted result of the RegisterClient API operation.

type clientSecret:

string

param clientSecret:

[REQUIRED]

A secret string that is generated for the client. This value should come from the persisted result of the RegisterClient API operation.

type startUrl:

string

param startUrl:

[REQUIRED]

The URL for the AWS SSO user portal. For more information, see Using the User Portal in the AWS Single Sign-On User Guide.

rtype:

dict

returns:

Response Syntax

{
    'deviceCode': 'string',
    'userCode': 'string',
    'verificationUri': 'string',
    'verificationUriComplete': 'string',
    'expiresIn': 123,
    'interval': 123
}

Response Structure

• (dict) --

  • deviceCode (string) --

    The short-lived code that is used by the device when polling for a session token.

  • userCode (string) --

    A one-time user verification code. This is needed to authorize an in-use device.

  • verificationUri (string) --

    The URI of the verification page that takes the userCode to authorize the device.

  • verificationUriComplete (string) --

    An alternate URL that the client can use to automatically launch a browser. This process skips the manual step in which the user visits the verification page and enters their code.

  • expiresIn (integer) --

    Indicates the number of seconds in which the verification code will become invalid.

  • interval (integer) --

    Indicates the number of seconds the client must wait between attempts when polling for a session.

Registers a client with AWS SSO. This allows clients to initiate device authorization. The output should be persisted for reuse through many authentication requests.

See also: AWS API Documentation

Request Syntax

client.register_client(
    clientName='string',
    clientType='string',
    scopes=[
        'string',
    ]
)

type clientName:

string

param clientName:

[REQUIRED]

The friendly name of the client.

type clientType:

string

param clientType:

[REQUIRED]

The type of client. The service supports only public as a client type. Anything other than public will be rejected by the service.

type scopes:

list

param scopes:

The list of scopes that are defined by the client. Upon authorization, this list is used to restrict permissions when granting an access token.

• (string) --

rtype:

dict

returns:

Response Syntax

{
    'clientId': 'string',
    'clientSecret': 'string',
    'clientIdIssuedAt': 123,
    'clientSecretExpiresAt': 123,
    'authorizationEndpoint': 'string',
    'tokenEndpoint': 'string'
}

Response Structure

• (dict) --

  • clientId (string) --

    The unique identifier string for each client. This client uses this identifier to get authenticated by the service in subsequent calls.

  • clientSecret (string) --

    A secret string generated for the client. The client will use this string to get authenticated by the service in subsequent calls.

  • clientIdIssuedAt (integer) --

    Indicates the time at which the clientId and clientSecret were issued.

  • clientSecretExpiresAt (integer) --

    Indicates the time at which the clientId and clientSecret will become invalid.

  • authorizationEndpoint (string) --

    The endpoint where the client can request authorization.

  • tokenEndpoint (string) --

    The endpoint where the client can get an access token.