Added authentication with custom credential provider and removed authentication with API key

[shah279]

Issue #, if available:: N/A

Description of changes:
feat: Added authentication with custom credential provider
feat: Removed authentication with API key

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[imraymondlee]

Can you provide me an example of how I could use the custom credential provider?

[shah279]

Can you provide me an example of how I could use the custom credential provider?

You can pass the credentialsProvider created with AWS Kotlin SDK in the authenticateWithCredentialsProvider method like below:

private fun exampleCustomCredentialLogin() {
    var authHelper = AuthHelper(applicationContext)
    var locationCredentialsProvider : LocationCredentialsProvider = authHelper.authenticateWithCredentialsProvider("MY-AWS-REGION", credentialsProvider)
    var locationClient = locationCredentialsProvider?.getLocationClient()
}

[imraymondlee]

Can you provide me an example of how I could use the custom credential provider?

You can pass the credentialsProvider created with AWS Kotlin SDK in the authenticateWithCredentialsProvider method like below:

private fun exampleCustomCredentialLogin() {
    var authHelper = AuthHelper(applicationContext)
    var locationCredentialsProvider : LocationCredentialsProvider = authHelper.authenticateWithCredentialsProvider("MY-AWS-REGION", credentialsProvider)
    var locationClient = locationCredentialsProvider?.getLocationClient()
}

The goal of the custom credential provider is to provide support for Cognito's developer-authenticated identities.

As some of these (AWSAbstractCognitoDeveloperIdentityProvider, CognitoCachingCredentialsProvider) classes are no longer part of AWS SDK for Kotlin, what would a developer need to do to create credentialsProvider that follows the developer-authenticated identities pattern in order to authenticate into the SDK?

[shah279]

Can you provide me an example of how I could use the custom credential provider?

You can pass the credentialsProvider created with AWS Kotlin SDK in the authenticateWithCredentialsProvider method like below:

private fun exampleCustomCredentialLogin() {
    var authHelper = AuthHelper(applicationContext)
    var locationCredentialsProvider : LocationCredentialsProvider = authHelper.authenticateWithCredentialsProvider("MY-AWS-REGION", credentialsProvider)
    var locationClient = locationCredentialsProvider?.getLocationClient()
}

The goal of the custom credential provider is to provide support for Cognito's developer-authenticated identities.

As some of these (AWSAbstractCognitoDeveloperIdentityProvider, CognitoCachingCredentialsProvider) classes are no longer part of AWS SDK for Kotlin, what would a developer need to do to create credentialsProvider that follows the developer-authenticated identities pattern in order to authenticate into the SDK?

Here is an example of creating a credential provider:

private suspend fun generateCredentialsProvider(region: String, identityPoolId: String): CredentialsProvider? {
        val cognitoIdentityClient = CognitoIdentityClient { this.region = region }
        try {
            val getIdResponse = cognitoIdentityClient.getId(GetIdRequest { this.identityPoolId = identityPoolId })
            val identityId =
                getIdResponse.identityId ?: throw Exception("Failed to get identity ID")
            if (identityId.isNotEmpty()) {
                val getCredentialsResponse =
                    cognitoIdentityClient.getCredentialsForIdentity(
                        GetCredentialsForIdentityRequest {
                            this.identityId = identityId
                        })

                val credentials = getCredentialsResponse.credentials ?: throw Exception("Failed to get credentials")
                return createCredentialsProvider(credentials)
            }
        } catch (e: Exception) {
            throw Exception("Credentials generation failed")
        }
        return null
    }

    private fun createCredentialsProvider(credentials: Credentials): CredentialsProvider {
        if (credentials.accessKeyId == null ||credentials.secretKey == null) throw Exception(
            "Failed to get credentials"
        )
        return StaticCredentialsProvider(
            aws.smithy.kotlin.runtime.auth.awscredentials.Credentials.invoke(
                accessKeyId = credentials.accessKeyId!!,
                secretAccessKey = credentials.secretKey!!,
                sessionToken = credentials.sessionToken,
                expiration = credentials.expiration
            )
        )
    }

Also, document comment is updated at the top of the method authenticateWithCredentialsProvider in AuthHelper.

[juaneslucero]

The second argument in the authenticateWithCredentialsProvider is not as string, it is a CredentialsProvider

[shah279]

Resolved

[juaneslucero]

If this constructor is used just for the custom Credential provider method, might as well pass it here rather than using the initializeLocationClient method. Wdyt?

[shah279]

initializeLocationClient is a suspend function, so instead of initializing the coroutine in the constructor of LocationCredentialsProvider, we can directly call the function here.

[juaneslucero]

I think this is related to my other open comment, as I don't think we need the extra translation layer that is done in setCustomCredentials between Credentials(aws.smithy.kotlin.runtime.auth.awscredentials) and Credentials( aws.sdk.kotlin.services.cognitoidentity.model.Credentials). If we don't invoke the the credentials.resolve() method and just assign the credential porvider directly to the LocationClient, then we could pass in the credential provider directly in the constructor as there is no async behavior that needs to occur at instantiation. Thus the constructor could look something like this:

    constructor(context: Context, region: AwsRegions, provider: CredentialsProvider) {
        this.context = context
        this.credentialsProvider = provider
        securePreferences = initPreference(context)
        securePreferences.put(METHOD, "custom")
        securePreferences.put(REGION, region.regionName)
    }

Which then allows the caller to call getLocationClient and get a properly configured client. Wdyt?

[juaneslucero]

As discussed internally, can be addressed as fast follow.

[juaneslucero]

All the constructors initialize the securePreferences, why are we making them nullable?

[shah279]

Resolved

[juaneslucero]

This and the createCredentialsProvider should be rethought considering that the we will be receiving a fully configured CredentialsProvider. I think there is unnecessary conversions between CredentialsProvider and aws.sdk.kotlin.services.cognitoidentity.model.Credentials

[shah279]

We are generating credentials with CognitoIdentityClient with AWS Kotlin SDK and we are getting this Credentials(aws.sdk.kotlin.services.cognitoidentity.model)

and for creating LocationClient we need CredentialsProvider(aws.smithy.kotlin.runtime.auth.awscredentials)
and for creating CredentialsProvider we need Credentials(aws.smithy.kotlin.runtime.auth.awscredentials)

So, the conversions are needed in createCredentialsProvider

[juaneslucero]

Since we createCredentialsProvider returns a CredentialsProvider(aws.smithy.kotlin.runtime.auth.awscredentials) so why not early return the this.credentialsProvider if it is not null (and potentially if method == "custom"). Otherwise we are passing a credentials provider to get cerdentials to create a new credentials provider.

[juaneslucero]

As discussed internally, can be addressed as fast follow.