SSO

Table of Contents

• SSO
  • Client
  • Paginators

Client

class SSO.Client

A low-level client representing AWS Single Sign-On (SSO)

AWS Single Sign-On Portal is a web service that makes it easy for you to assign user access to AWS SSO resources such as the user portal. Users can get AWS account applications and roles assigned to them and get federated into the application.

For general information about AWS SSO, see What is AWS Single Sign-On? in the AWS SSO User Guide .

This API reference guide describes the AWS SSO Portal operations that you can call programatically and includes detailed information on data types and errors.

Note

AWS provides SDKs that consist of libraries and sample code for various programming languages and platforms, such as Java, Ruby, .Net, iOS, or Android. The SDKs provide a convenient way to create programmatic access to AWS SSO and other AWS services. For more information about the AWS SDKs, including how to download and install them, see Tools for Amazon Web Services .

import boto3

client = boto3.client('sso')

These are the available methods:

• can_paginate()
• get_paginator()
• get_role_credentials()
• get_waiter()
• list_account_roles()
• list_accounts()
• logout()

can_paginate(operation_name)

Check if an operation can be paginated.

Parameters

operation_name (string) -- The operation name. This is the same name as the method name on the client. For example, if the method name is create_foo, and you'd normally invoke the operation as client.create_foo(**kwargs), if the create_foo operation can be paginated, you can use the call client.get_paginator("create_foo").

Returns

True if the operation can be paginated, False otherwise.

get_paginator(operation_name)

Create a paginator for an operation.

Parameters

operation_name (string) -- The operation name. This is the same name as the method name on the client. For example, if the method name is create_foo, and you'd normally invoke the operation as client.create_foo(**kwargs), if the create_foo operation can be paginated, you can use the call client.get_paginator("create_foo").

Raises OperationNotPageableError

Raised if the operation is not pageable. You can use the client.can_paginate method to check if an operation is pageable.

Return type

L{botocore.paginate.Paginator}

Returns

A paginator object.

get_role_credentials(**kwargs)

Returns the STS short-term credentials for a given role name that is assigned to the user.

See also: AWS API Documentation

Request Syntax

response = client.get_role_credentials(
    roleName='string',
    accountId='string',
    accessToken='string'
)

Parameters

• roleName (string) --

  [REQUIRED]

  The friendly name of the role that is assigned to the user.

• accountId (string) --

  [REQUIRED]

  The identifier for the AWS account that is assigned to the user.

• accessToken (string) --

  [REQUIRED]

  The token issued by the CreateToken API call. For more information, see CreateToken in the AWS SSO OIDC API Reference Guide .

Return type

dict

Returns

Response Syntax

{
    'roleCredentials': {
        'accessKeyId': 'string',
        'secretAccessKey': 'string',
        'sessionToken': 'string',
        'expiration': 123
    }
}

Response Structure

• (dict) --

  • roleCredentials (dict) --

    The credentials for the role that is assigned to the user.

    • accessKeyId (string) --

      The identifier used for the temporary security credentials. For more information, see Using Temporary Security Credentials to Request Access to AWS Resources in the AWS IAM User Guide .

    • secretAccessKey (string) --

      The key that is used to sign the request. For more information, see Using Temporary Security Credentials to Request Access to AWS Resources in the AWS IAM User Guide .

    • sessionToken (string) --

      The token used for temporary credentials. For more information, see Using Temporary Security Credentials to Request Access to AWS Resources in the AWS IAM User Guide .

    • expiration (integer) --

      The date on which temporary security credentials expire.

Exceptions

• SSO.Client.exceptions.InvalidRequestException
• SSO.Client.exceptions.UnauthorizedException
• SSO.Client.exceptions.TooManyRequestsException
• SSO.Client.exceptions.ResourceNotFoundException

get_waiter(waiter_name)

Returns an object that can wait for some condition.

Parameters

waiter_name (str) -- The name of the waiter to get. See the waiters section of the service docs for a list of available waiters.

Returns

The specified waiter object.

Return type

botocore.waiter.Waiter

list_account_roles(**kwargs)

Lists all roles that are assigned to the user for a given AWS account.

See also: AWS API Documentation

Request Syntax

response = client.list_account_roles(
    nextToken='string',
    maxResults=123,
    accessToken='string',
    accountId='string'
)

Parameters

• nextToken (string) -- The page token from the previous response output when you request subsequent pages.
• maxResults (integer) -- The number of items that clients can request per page.
• accessToken (string) --

  [REQUIRED]

  The token issued by the CreateToken API call. For more information, see CreateToken in the AWS SSO OIDC API Reference Guide .

• accountId (string) --

  [REQUIRED]

  The identifier for the AWS account that is assigned to the user.

Return type

dict

Returns

Response Syntax

{
    'nextToken': 'string',
    'roleList': [
        {
            'roleName': 'string',
            'accountId': 'string'
        },
    ]
}

Response Structure

• (dict) --

  • nextToken (string) --

    The page token client that is used to retrieve the list of accounts.

  • roleList (list) --

    A paginated response with the list of roles and the next token if more results are available.

    • (dict) --

      Provides information about the role that is assigned to the user.

      • roleName (string) --

        The friendly name of the role that is assigned to the user.

      • accountId (string) --

        The identifier of the AWS account assigned to the user.

Exceptions

• SSO.Client.exceptions.InvalidRequestException
• SSO.Client.exceptions.UnauthorizedException
• SSO.Client.exceptions.TooManyRequestsException
• SSO.Client.exceptions.ResourceNotFoundException

list_accounts(**kwargs)

Lists all AWS accounts assigned to the user. These AWS accounts are assigned by the administrator of the account. For more information, see Assign User Access in the AWS SSO User Guide . This operation returns a paginated response.

See also: AWS API Documentation

Request Syntax

response = client.list_accounts(
    nextToken='string',
    maxResults=123,
    accessToken='string'
)

Parameters

• nextToken (string) -- (Optional) When requesting subsequent pages, this is the page token from the previous response output.
• maxResults (integer) -- This is the number of items clients can request per page.
• accessToken (string) --

  [REQUIRED]

  The token issued by the CreateToken API call. For more information, see CreateToken in the AWS SSO OIDC API Reference Guide .

Return type

dict

Returns

Response Syntax

{
    'nextToken': 'string',
    'accountList': [
        {
            'accountId': 'string',
            'accountName': 'string',
            'emailAddress': 'string'
        },
    ]
}

Response Structure

• (dict) --

  • nextToken (string) --

    The page token client that is used to retrieve the list of accounts.

  • accountList (list) --

    A paginated response with the list of account information and the next token if more results are available.

    • (dict) --

      Provides information about your AWS account.

      • accountId (string) --

        The identifier of the AWS account that is assigned to the user.

      • accountName (string) --

        The display name of the AWS account that is assigned to the user.

      • emailAddress (string) --

        The email address of the AWS account that is assigned to the user.

Exceptions

• SSO.Client.exceptions.InvalidRequestException
• SSO.Client.exceptions.UnauthorizedException
• SSO.Client.exceptions.TooManyRequestsException
• SSO.Client.exceptions.ResourceNotFoundException

logout(**kwargs)

Removes the client- and server-side session that is associated with the user.

See also: AWS API Documentation

Request Syntax

response = client.logout(
    accessToken='string'
)

Parameters

accessToken (string) --

[REQUIRED]

The token issued by the CreateToken API call. For more information, see CreateToken in the AWS SSO OIDC API Reference Guide .

Returns

None

Exceptions

• SSO.Client.exceptions.InvalidRequestException
• SSO.Client.exceptions.UnauthorizedException
• SSO.Client.exceptions.TooManyRequestsException

Paginators

The available paginators are:

• SSO.Paginator.ListAccountRoles
• SSO.Paginator.ListAccounts

class SSO.Paginator.ListAccountRoles

paginator = client.get_paginator('list_account_roles')

paginate(**kwargs)

Creates an iterator that will paginate through responses from SSO.Client.list_account_roles().

See also: AWS API Documentation

Request Syntax

response_iterator = paginator.paginate(
    accessToken='string',
    accountId='string',
    PaginationConfig={
        'MaxItems': 123,
        'PageSize': 123,
        'StartingToken': 'string'
    }
)

Parameters

• accessToken (string) --

  [REQUIRED]

  The token issued by the CreateToken API call. For more information, see CreateToken in the AWS SSO OIDC API Reference Guide .

• accountId (string) --

  [REQUIRED]

  The identifier for the AWS account that is assigned to the user.

• PaginationConfig (dict) --

  A dictionary that provides parameters to control pagination.

  • MaxItems (integer) --

    The total number of items to return. If the total number of items available is more than the value specified in max-items then a NextToken will be provided in the output that you can use to resume pagination.

  • PageSize (integer) --

    The size of each page.

  • StartingToken (string) --

    A token to specify where to start paginating. This is the NextToken from a previous response.

Return type

dict

Returns

Response Syntax

{
    'roleList': [
        {
            'roleName': 'string',
            'accountId': 'string'
        },
    ],
    'NextToken': 'string'
}

Response Structure

• (dict) --

  • roleList (list) --

    A paginated response with the list of roles and the next token if more results are available.

    • (dict) --

      Provides information about the role that is assigned to the user.

      • roleName (string) --

        The friendly name of the role that is assigned to the user.

      • accountId (string) --

        The identifier of the AWS account assigned to the user.

  • NextToken (string) --

    A token to resume pagination.

class SSO.Paginator.ListAccounts

paginator = client.get_paginator('list_accounts')

paginate(**kwargs)

Creates an iterator that will paginate through responses from SSO.Client.list_accounts().

See also: AWS API Documentation

Request Syntax

response_iterator = paginator.paginate(
    accessToken='string',
    PaginationConfig={
        'MaxItems': 123,
        'PageSize': 123,
        'StartingToken': 'string'
    }
)

Parameters

• accessToken (string) --

  [REQUIRED]

  The token issued by the CreateToken API call. For more information, see CreateToken in the AWS SSO OIDC API Reference Guide .

• PaginationConfig (dict) --

  A dictionary that provides parameters to control pagination.

  • MaxItems (integer) --

    The total number of items to return. If the total number of items available is more than the value specified in max-items then a NextToken will be provided in the output that you can use to resume pagination.

  • PageSize (integer) --

    The size of each page.

  • StartingToken (string) --

    A token to specify where to start paginating. This is the NextToken from a previous response.

Return type

dict

Returns

Response Syntax

{
    'accountList': [
        {
            'accountId': 'string',
            'accountName': 'string',
            'emailAddress': 'string'
        },
    ],
    'NextToken': 'string'
}

Response Structure

• (dict) --

  • accountList (list) --

    A paginated response with the list of account information and the next token if more results are available.

    • (dict) --

      Provides information about your AWS account.

      • accountId (string) --

        The identifier of the AWS account that is assigned to the user.

      • accountName (string) --

        The display name of the AWS account that is assigned to the user.

      • emailAddress (string) --

        The email address of the AWS account that is assigned to the user.

  • NextToken (string) --

    A token to resume pagination.