Navigation

Table Of Contents

  1. Docs
  2. Available Services
  3. SSOOIDC

SSOOIDC

Table of Contents

Client

class SSOOIDC.Client

A low-level client representing AWS SSO OIDC:

import boto3

client = boto3.client('sso-oidc')

These are the available methods:

can_paginate(operation_name)

Check if an operation can be paginated.

Parameters
operation_name (string) -- The operation name. This is the same name as the method name on the client. For example, if the method name is create_foo, and you'd normally invoke the operation as client.create_foo(**kwargs), if the create_foo operation can be paginated, you can use the call client.get_paginator("create_foo").
Returns
True if the operation can be paginated, False otherwise.
create_token(**kwargs)

Creates and returns an access token for the authorized client. The access token issued will be used to fetch short-term credentials for the assigned roles in the AWS account.

See also: AWS API Documentation

Request Syntax

response = client.create_token(
    clientId='string',
    clientSecret='string',
    grantType='string',
    deviceCode='string',
    code='string',
    refreshToken='string',
    scope=[
        'string',
    ],
    redirectUri='string'
)
Parameters
  • clientId (string) --

    [REQUIRED]

    The unique identifier string for each client. This value should come from the persisted result of the RegisterClient API.

  • clientSecret (string) --

    [REQUIRED]

    A secret string generated for the client. This value should come from the persisted result of the RegisterClient API.

  • grantType (string) --

    [REQUIRED]

    Supports grant types for authorization code, refresh token, and device code request.

  • deviceCode (string) --

    [REQUIRED]

    Used only when calling this API for the device code grant type. This short-term code is used to identify this authentication attempt. This should come from an in-memory reference to the result of the StartDeviceAuthorization API.

  • code (string) -- The authorization code received from the authorization service. This parameter is required to perform an authorization grant request to get access to a token.
  • refreshToken (string) -- The token used to obtain an access token in the event that the access token is invalid or expired. This token is not issued by the service.
  • scope (list) --

    The list of scopes that is defined by the client. Upon authorization, this list is used to restrict permissions when granting an access token.

    • (string) --
  • redirectUri (string) -- The location of the application that will receive the authorization code. Users authorize the service to send the request to this location.
Return type

dict

Returns

Response Syntax

{
    'accessToken': 'string',
    'tokenType': 'string',
    'expiresIn': 123,
    'refreshToken': 'string',
    'idToken': 'string'
}

Response Structure

  • (dict) --

    • accessToken (string) --

      An opaque token to access AWS SSO resources assigned to a user.

    • tokenType (string) --

      Used to notify the client that the returned token is an access token. The supported type is BearerToken .

    • expiresIn (integer) --

      Indicates the time in seconds when an access token will expire.

    • refreshToken (string) --

      A token that, if present, can be used to refresh a previously issued access token that might have expired.

    • idToken (string) --

      The identifier of the user that associated with the access token, if present.

generate_presigned_url(ClientMethod, Params=None, ExpiresIn=3600, HttpMethod=None)

Generate a presigned url given a client, its method, and arguments

Parameters
  • ClientMethod (string) -- The client method to presign for
  • Params (dict) -- The parameters normally passed to ClientMethod.
  • ExpiresIn (int) -- The number of seconds the presigned url is valid for. By default it expires in an hour (3600 seconds)
  • HttpMethod (string) -- The http method to use on the generated url. By default, the http method is whatever is used in the method's model.
Returns

The presigned url

get_paginator(operation_name)

Create a paginator for an operation.

Parameters
operation_name (string) -- The operation name. This is the same name as the method name on the client. For example, if the method name is create_foo, and you'd normally invoke the operation as client.create_foo(**kwargs), if the create_foo operation can be paginated, you can use the call client.get_paginator("create_foo").
Raises OperationNotPageableError
Raised if the operation is not pageable. You can use the client.can_paginate method to check if an operation is pageable.
Return type
L{botocore.paginate.Paginator}
Returns
A paginator object.
get_waiter(waiter_name)

Returns an object that can wait for some condition.

Parameters
waiter_name (str) -- The name of the waiter to get. See the waiters section of the service docs for a list of available waiters.
Returns
The specified waiter object.
Return type
botocore.waiter.Waiter
register_client(**kwargs)

Registers a client with AWS SSO. This allows clients to initiate device authorization. The output should be persisted for reuse through many authentication requests.

See also: AWS API Documentation

Request Syntax

response = client.register_client(
    clientName='string',
    clientType='string',
    scopes=[
        'string',
    ]
)
Parameters
  • clientName (string) --

    [REQUIRED]

    The friendly name of the client.

  • clientType (string) --

    [REQUIRED]

    The type of client. The service supports only public as a client type. Anything other than public will be rejected by the service.

  • scopes (list) --

    The list of scopes that are defined by the client. Upon authorization, this list is used to restrict permissions when granting an access token.

    • (string) --
Return type

dict

Returns

Response Syntax

{
    'clientId': 'string',
    'clientSecret': 'string',
    'clientIdIssuedAt': 123,
    'clientSecretExpiresAt': 123,
    'authorizationEndpoint': 'string',
    'tokenEndpoint': 'string'
}

Response Structure

  • (dict) --

    • clientId (string) --

      The unique identifier string for each client. This client uses this identifier to get authenticated by the service in subsequent calls.

    • clientSecret (string) --

      A secret string generated for the client. The client will use this string to get authenticated by the service in subsequent calls.

    • clientIdIssuedAt (integer) --

      Indicates the time at which the clientId and clientSecret were issued.

    • clientSecretExpiresAt (integer) --

      Indicates the time at which the clientId and clientSecret will become invalid.

    • authorizationEndpoint (string) --

      The endpoint where the client can request authorization.

    • tokenEndpoint (string) --

      The endpoint where the client can get an access token.

start_device_authorization(**kwargs)

Initiates device authorization by requesting a pair of verification codes from the authorization service.

See also: AWS API Documentation

Request Syntax

response = client.start_device_authorization(
    clientId='string',
    clientSecret='string',
    startUrl='string'
)
Parameters
  • clientId (string) --

    [REQUIRED]

    The unique identifier string for the client that is registered with AWS SSO. This value should come from the persisted result of the RegisterClient API operation.

  • clientSecret (string) --

    [REQUIRED]

    A secret string that is generated for the client. This value should come from the persisted result of the RegisterClient API operation.

  • startUrl (string) --

    [REQUIRED]

    The URL for the AWS SSO user portal. For more information, see Using the User Portal in the AWS Single Sign-On User Guide .

Return type

dict

Returns

Response Syntax

{
    'deviceCode': 'string',
    'userCode': 'string',
    'verificationUri': 'string',
    'verificationUriComplete': 'string',
    'expiresIn': 123,
    'interval': 123
}

Response Structure

  • (dict) --

    • deviceCode (string) --

      The short-lived code that is used by the device when polling for a session token.

    • userCode (string) --

      A one-time user verification code. This is needed to authorize an in-use device.

    • verificationUri (string) --

      The URI of the verification page that takes the userCode to authorize the device.

    • verificationUriComplete (string) --

      An alternate URL that the client can use to automatically launch a browser. This process skips the manual step in which the user visits the verification page and enters their code.

    • expiresIn (integer) --

      Indicates the number of seconds in which the verification code will become invalid.

    • interval (integer) --

      Indicates the number of seconds the client must wait between attempts when polling for a session.

Paginators

The available paginators are:

SSO
SFN

Navigation

© Copyright 2019, Amazon Web Services, Inc. Created using Sphinx.