SSOOIDC

Table of Contents

• SSOOIDC
  • Client
  • Paginators

Client

class SSOOIDC.Client

A low-level client representing AWS SSO OIDC:

import boto3

client = boto3.client('sso-oidc')

These are the available methods:

• can_paginate()
• create_token()
• generate_presigned_url()
• get_paginator()
• get_waiter()
• register_client()
• start_device_authorization()

can_paginate(operation_name)

Check if an operation can be paginated.

Parameters

operation_name (string) -- The operation name. This is the same name as the method name on the client. For example, if the method name is create_foo, and you'd normally invoke the operation as client.create_foo(**kwargs), if the create_foo operation can be paginated, you can use the call client.get_paginator("create_foo").

Returns

True if the operation can be paginated, False otherwise.

create_token(**kwargs)

Creates and returns an access token for the authorized client. The access token issued will be used to fetch short-term credentials for the assigned roles in the AWS account.

See also: AWS API Documentation

Request Syntax

response = client.create_token(
    clientId='string',
    clientSecret='string',
    grantType='string',
    deviceCode='string',
    code='string',
    refreshToken='string',
    scope=[
        'string',
    ],
    redirectUri='string'
)

Parameters

• clientId (string) --

  [REQUIRED]

  The unique identifier string for each client. This value should come from the persisted result of the RegisterClient API.

• clientSecret (string) --

  [REQUIRED]

  A secret string generated for the client. This value should come from the persisted result of the RegisterClient API.

• grantType (string) --

  [REQUIRED]

  Supports grant types for authorization code, refresh token, and device code request.

• deviceCode (string) --

  [REQUIRED]

  Used only when calling this API for the device code grant type. This short-term code is used to identify this authentication attempt. This should come from an in-memory reference to the result of the StartDeviceAuthorization API.

• code (string) -- The authorization code received from the authorization service. This parameter is required to perform an authorization grant request to get access to a token.
• refreshToken (string) -- The token used to obtain an access token in the event that the access token is invalid or expired. This token is not issued by the service.
• scope (list) --

  The list of scopes that is defined by the client. Upon authorization, this list is used to restrict permissions when granting an access token.

  • (string) --
• redirectUri (string) -- The location of the application that will receive the authorization code. Users authorize the service to send the request to this location.

Return type

dict

Returns

Response Syntax

{
    'accessToken': 'string',
    'tokenType': 'string',
    'expiresIn': 123,
    'refreshToken': 'string',
    'idToken': 'string'
}

Response Structure

• (dict) --

  • accessToken (string) --

    An opaque token to access AWS SSO resources assigned to a user.

  • tokenType (string) --

    Used to notify the client that the returned token is an access token. The supported type is BearerToken .

  • expiresIn (integer) --

    Indicates the time in seconds when an access token will expire.

  • refreshToken (string) --

    A token that, if present, can be used to refresh a previously issued access token that might have expired.

  • idToken (string) --

    The identifier of the user that associated with the access token, if present.

Exceptions

• SSOOIDC.Client.exceptions.InvalidRequestException
• SSOOIDC.Client.exceptions.InvalidClientException
• SSOOIDC.Client.exceptions.InvalidGrantException
• SSOOIDC.Client.exceptions.UnauthorizedClientException
• SSOOIDC.Client.exceptions.UnsupportedGrantTypeException
• SSOOIDC.Client.exceptions.InvalidScopeException
• SSOOIDC.Client.exceptions.AuthorizationPendingException
• SSOOIDC.Client.exceptions.SlowDownException
• SSOOIDC.Client.exceptions.AccessDeniedException
• SSOOIDC.Client.exceptions.ExpiredTokenException
• SSOOIDC.Client.exceptions.InternalServerException

generate_presigned_url(ClientMethod, Params=None, ExpiresIn=3600, HttpMethod=None)

Generate a presigned url given a client, its method, and arguments

Parameters

• ClientMethod (string) -- The client method to presign for
• Params (dict) -- The parameters normally passed to ClientMethod.
• ExpiresIn (int) -- The number of seconds the presigned url is valid for. By default it expires in an hour (3600 seconds)
• HttpMethod (string) -- The http method to use on the generated url. By default, the http method is whatever is used in the method's model.

Returns

The presigned url

get_paginator(operation_name)

Create a paginator for an operation.

Parameters

operation_name (string) -- The operation name. This is the same name as the method name on the client. For example, if the method name is create_foo, and you'd normally invoke the operation as client.create_foo(**kwargs), if the create_foo operation can be paginated, you can use the call client.get_paginator("create_foo").

Raises OperationNotPageableError

Raised if the operation is not pageable. You can use the client.can_paginate method to check if an operation is pageable.

Return type

L{botocore.paginate.Paginator}

Returns

A paginator object.

get_waiter(waiter_name)

Returns an object that can wait for some condition.

Parameters

waiter_name (str) -- The name of the waiter to get. See the waiters section of the service docs for a list of available waiters.

Returns

The specified waiter object.

Return type

botocore.waiter.Waiter

register_client(**kwargs)

Registers a client with AWS SSO. This allows clients to initiate device authorization. The output should be persisted for reuse through many authentication requests.

See also: AWS API Documentation

Request Syntax

response = client.register_client(
    clientName='string',
    clientType='string',
    scopes=[
        'string',
    ]
)

Parameters

• clientName (string) --

  [REQUIRED]

  The friendly name of the client.

• clientType (string) --

  [REQUIRED]

  The type of client. The service supports only public as a client type. Anything other than public will be rejected by the service.

• scopes (list) --

  The list of scopes that are defined by the client. Upon authorization, this list is used to restrict permissions when granting an access token.

  • (string) --

Return type

dict

Returns

Response Syntax

{
    'clientId': 'string',
    'clientSecret': 'string',
    'clientIdIssuedAt': 123,
    'clientSecretExpiresAt': 123,
    'authorizationEndpoint': 'string',
    'tokenEndpoint': 'string'
}

Response Structure

• (dict) --

  • clientId (string) --

    The unique identifier string for each client. This client uses this identifier to get authenticated by the service in subsequent calls.

  • clientSecret (string) --

    A secret string generated for the client. The client will use this string to get authenticated by the service in subsequent calls.

  • clientIdIssuedAt (integer) --

    Indicates the time at which the clientId and clientSecret were issued.

  • clientSecretExpiresAt (integer) --

    Indicates the time at which the clientId and clientSecret will become invalid.

  • authorizationEndpoint (string) --

    The endpoint where the client can request authorization.

  • tokenEndpoint (string) --

    The endpoint where the client can get an access token.

Exceptions

• SSOOIDC.Client.exceptions.InvalidRequestException
• SSOOIDC.Client.exceptions.InvalidScopeException
• SSOOIDC.Client.exceptions.InvalidClientMetadataException
• SSOOIDC.Client.exceptions.InternalServerException

start_device_authorization(**kwargs)

Initiates device authorization by requesting a pair of verification codes from the authorization service.

See also: AWS API Documentation

Request Syntax

response = client.start_device_authorization(
    clientId='string',
    clientSecret='string',
    startUrl='string'
)

Parameters

• clientId (string) --

  [REQUIRED]

  The unique identifier string for the client that is registered with AWS SSO. This value should come from the persisted result of the RegisterClient API operation.

• clientSecret (string) --

  [REQUIRED]

  A secret string that is generated for the client. This value should come from the persisted result of the RegisterClient API operation.

• startUrl (string) --

  [REQUIRED]

  The URL for the AWS SSO user portal. For more information, see Using the User Portal in the AWS Single Sign-On User Guide .

Return type

dict

Returns

Response Syntax

{
    'deviceCode': 'string',
    'userCode': 'string',
    'verificationUri': 'string',
    'verificationUriComplete': 'string',
    'expiresIn': 123,
    'interval': 123
}

Response Structure

• (dict) --

  • deviceCode (string) --

    The short-lived code that is used by the device when polling for a session token.

  • userCode (string) --

    A one-time user verification code. This is needed to authorize an in-use device.

  • verificationUri (string) --

    The URI of the verification page that takes the userCode to authorize the device.

  • verificationUriComplete (string) --

    An alternate URL that the client can use to automatically launch a browser. This process skips the manual step in which the user visits the verification page and enters their code.

  • expiresIn (integer) --

    Indicates the number of seconds in which the verification code will become invalid.

  • interval (integer) --

    Indicates the number of seconds the client must wait between attempts when polling for a session.

Exceptions

• SSOOIDC.Client.exceptions.InvalidRequestException
• SSOOIDC.Client.exceptions.InvalidClientException
• SSOOIDC.Client.exceptions.UnauthorizedClientException
• SSOOIDC.Client.exceptions.SlowDownException
• SSOOIDC.Client.exceptions.InternalServerException

Paginators

The available paginators are: