Table of Contents
SSO.
Client
¶A low-level client representing AWS Single Sign-On (SSO)
AWS IAM Identity Center (successor to AWS Single Sign-On) Portal is a web service that makes it easy for you to assign user access to IAM Identity Center resources such as the AWS access portal. Users can get AWS account applications and roles assigned to them and get federated into the application.
Note
Although AWS Single Sign-On was renamed, the sso
and identitystore
API namespaces will continue to retain their original name for backward compatibility purposes. For more information, see IAM Identity Center rename .
This reference guide describes the IAM Identity Center Portal operations that you can call programatically and includes detailed information on data types and errors.
Note
AWS provides SDKs that consist of libraries and sample code for various programming languages and platforms, such as Java, Ruby, .Net, iOS, or Android. The SDKs provide a convenient way to create programmatic access to IAM Identity Center and other AWS services. For more information about the AWS SDKs, including how to download and install them, see Tools for Amazon Web Services .
import boto3
client = boto3.client('sso')
These are the available methods:
can_paginate()
close()
get_paginator()
get_role_credentials()
get_waiter()
list_account_roles()
list_accounts()
logout()
can_paginate
(operation_name)¶Check if an operation can be paginated.
create_foo
, and you'd normally invoke the
operation as client.create_foo(**kwargs)
, if the
create_foo
operation can be paginated, you can use the
call client.get_paginator("create_foo")
.True
if the operation can be paginated,
False
otherwise.close
()¶Closes underlying endpoint connections.
get_paginator
(operation_name)¶Create a paginator for an operation.
create_foo
, and you'd normally invoke the
operation as client.create_foo(**kwargs)
, if the
create_foo
operation can be paginated, you can use the
call client.get_paginator("create_foo")
.client.can_paginate
method to
check if an operation is pageable.get_role_credentials
(**kwargs)¶Returns the STS short-term credentials for a given role name that is assigned to the user.
See also: AWS API Documentation
Request Syntax
response = client.get_role_credentials(
roleName='string',
accountId='string',
accessToken='string'
)
[REQUIRED]
The friendly name of the role that is assigned to the user.
[REQUIRED]
The identifier for the AWS account that is assigned to the user.
[REQUIRED]
The token issued by the CreateToken
API call. For more information, see CreateToken in the IAM Identity Center OIDC API Reference Guide .
dict
Response Syntax
{
'roleCredentials': {
'accessKeyId': 'string',
'secretAccessKey': 'string',
'sessionToken': 'string',
'expiration': 123
}
}
Response Structure
(dict) --
roleCredentials (dict) --
The credentials for the role that is assigned to the user.
accessKeyId (string) --
The identifier used for the temporary security credentials. For more information, see Using Temporary Security Credentials to Request Access to AWS Resources in the AWS IAM User Guide .
secretAccessKey (string) --
The key that is used to sign the request. For more information, see Using Temporary Security Credentials to Request Access to AWS Resources in the AWS IAM User Guide .
sessionToken (string) --
The token used for temporary credentials. For more information, see Using Temporary Security Credentials to Request Access to AWS Resources in the AWS IAM User Guide .
expiration (integer) --
The date on which temporary security credentials expire.
Exceptions
SSO.Client.exceptions.InvalidRequestException
SSO.Client.exceptions.UnauthorizedException
SSO.Client.exceptions.TooManyRequestsException
SSO.Client.exceptions.ResourceNotFoundException
get_waiter
(waiter_name)¶Returns an object that can wait for some condition.
list_account_roles
(**kwargs)¶Lists all roles that are assigned to the user for a given AWS account.
See also: AWS API Documentation
Request Syntax
response = client.list_account_roles(
nextToken='string',
maxResults=123,
accessToken='string',
accountId='string'
)
[REQUIRED]
The token issued by the CreateToken
API call. For more information, see CreateToken in the IAM Identity Center OIDC API Reference Guide .
[REQUIRED]
The identifier for the AWS account that is assigned to the user.
dict
Response Syntax
{
'nextToken': 'string',
'roleList': [
{
'roleName': 'string',
'accountId': 'string'
},
]
}
Response Structure
(dict) --
nextToken (string) --
The page token client that is used to retrieve the list of accounts.
roleList (list) --
A paginated response with the list of roles and the next token if more results are available.
(dict) --
Provides information about the role that is assigned to the user.
roleName (string) --
The friendly name of the role that is assigned to the user.
accountId (string) --
The identifier of the AWS account assigned to the user.
Exceptions
SSO.Client.exceptions.InvalidRequestException
SSO.Client.exceptions.UnauthorizedException
SSO.Client.exceptions.TooManyRequestsException
SSO.Client.exceptions.ResourceNotFoundException
list_accounts
(**kwargs)¶Lists all AWS accounts assigned to the user. These AWS accounts are assigned by the administrator of the account. For more information, see Assign User Access in the IAM Identity Center User Guide . This operation returns a paginated response.
See also: AWS API Documentation
Request Syntax
response = client.list_accounts(
nextToken='string',
maxResults=123,
accessToken='string'
)
[REQUIRED]
The token issued by the CreateToken
API call. For more information, see CreateToken in the IAM Identity Center OIDC API Reference Guide .
dict
Response Syntax
{
'nextToken': 'string',
'accountList': [
{
'accountId': 'string',
'accountName': 'string',
'emailAddress': 'string'
},
]
}
Response Structure
(dict) --
nextToken (string) --
The page token client that is used to retrieve the list of accounts.
accountList (list) --
A paginated response with the list of account information and the next token if more results are available.
(dict) --
Provides information about your AWS account.
accountId (string) --
The identifier of the AWS account that is assigned to the user.
accountName (string) --
The display name of the AWS account that is assigned to the user.
emailAddress (string) --
The email address of the AWS account that is assigned to the user.
Exceptions
SSO.Client.exceptions.InvalidRequestException
SSO.Client.exceptions.UnauthorizedException
SSO.Client.exceptions.TooManyRequestsException
SSO.Client.exceptions.ResourceNotFoundException
logout
(**kwargs)¶Removes the locally stored SSO tokens from the client-side cache and sends an API call to the IAM Identity Center service to invalidate the corresponding server-side IAM Identity Center sign in session.
Note
If a user uses IAM Identity Center to access the AWS CLI, the user’s IAM Identity Center sign in session is used to obtain an IAM session, as specified in the corresponding IAM Identity Center permission set. More specifically, IAM Identity Center assumes an IAM role in the target account on behalf of the user, and the corresponding temporary AWS credentials are returned to the client.
After user logout, any existing IAM role sessions that were created by using IAM Identity Center permission sets continue based on the duration configured in the permission set. For more information, see User authentications in the IAM Identity Center User Guide .
See also: AWS API Documentation
Request Syntax
response = client.logout(
accessToken='string'
)
[REQUIRED]
The token issued by the CreateToken
API call. For more information, see CreateToken in the IAM Identity Center OIDC API Reference Guide .
Exceptions
SSO.Client.exceptions.InvalidRequestException
SSO.Client.exceptions.UnauthorizedException
SSO.Client.exceptions.TooManyRequestsException
The available paginators are:
SSO.Paginator.
ListAccountRoles
¶paginator = client.get_paginator('list_account_roles')
paginate
(**kwargs)¶Creates an iterator that will paginate through responses from SSO.Client.list_account_roles()
.
See also: AWS API Documentation
Request Syntax
response_iterator = paginator.paginate(
accessToken='string',
accountId='string',
PaginationConfig={
'MaxItems': 123,
'PageSize': 123,
'StartingToken': 'string'
}
)
[REQUIRED]
The token issued by the CreateToken
API call. For more information, see CreateToken in the IAM Identity Center OIDC API Reference Guide .
[REQUIRED]
The identifier for the AWS account that is assigned to the user.
A dictionary that provides parameters to control pagination.
The total number of items to return. If the total number of items available is more than the value specified in max-items then a NextToken
will be provided in the output that you can use to resume pagination.
The size of each page.
A token to specify where to start paginating. This is the NextToken
from a previous response.
dict
Response Syntax
{
'roleList': [
{
'roleName': 'string',
'accountId': 'string'
},
],
'NextToken': 'string'
}
Response Structure
(dict) --
roleList (list) --
A paginated response with the list of roles and the next token if more results are available.
(dict) --
Provides information about the role that is assigned to the user.
roleName (string) --
The friendly name of the role that is assigned to the user.
accountId (string) --
The identifier of the AWS account assigned to the user.
NextToken (string) --
A token to resume pagination.
SSO.Paginator.
ListAccounts
¶paginator = client.get_paginator('list_accounts')
paginate
(**kwargs)¶Creates an iterator that will paginate through responses from SSO.Client.list_accounts()
.
See also: AWS API Documentation
Request Syntax
response_iterator = paginator.paginate(
accessToken='string',
PaginationConfig={
'MaxItems': 123,
'PageSize': 123,
'StartingToken': 'string'
}
)
[REQUIRED]
The token issued by the CreateToken
API call. For more information, see CreateToken in the IAM Identity Center OIDC API Reference Guide .
A dictionary that provides parameters to control pagination.
The total number of items to return. If the total number of items available is more than the value specified in max-items then a NextToken
will be provided in the output that you can use to resume pagination.
The size of each page.
A token to specify where to start paginating. This is the NextToken
from a previous response.
dict
Response Syntax
{
'accountList': [
{
'accountId': 'string',
'accountName': 'string',
'emailAddress': 'string'
},
],
'NextToken': 'string'
}
Response Structure
(dict) --
accountList (list) --
A paginated response with the list of account information and the next token if more results are available.
(dict) --
Provides information about your AWS account.
accountId (string) --
The identifier of the AWS account that is assigned to the user.
accountName (string) --
The display name of the AWS account that is assigned to the user.
emailAddress (string) --
The email address of the AWS account that is assigned to the user.
NextToken (string) --
A token to resume pagination.