From 0f5069075160f99cb9dadb85600e6a66ef887e8f Mon Sep 17 00:00:00 2001 From: yndu13 Date: Fri, 17 Nov 2023 15:53:47 +0800 Subject: [PATCH] feat: support RoleSessionExpiration for OIDCCredential --- credentials/oidc_credential.go | 4 ++++ credentials/oidc_credential_test.go | 3 ++- 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/credentials/oidc_credential.go b/credentials/oidc_credential.go index 7d960ab..de0acc7 100644 --- a/credentials/oidc_credential.go +++ b/credentials/oidc_credential.go @@ -5,6 +5,7 @@ import ( "fmt" "io/ioutil" "os" + "strconv" "time" "github.com/alibabacloud-go/tea/tea" @@ -154,6 +155,9 @@ func (r *OIDCCredential) updateCredential() (err error) { if r.Policy != "" { request.QueryParams["Policy"] = r.Policy } + if r.RoleSessionExpiration > 0 { + request.QueryParams["DurationSeconds"] = strconv.Itoa(r.RoleSessionExpiration) + } request.QueryParams["RoleSessionName"] = r.RoleSessionName request.QueryParams["Version"] = "2015-04-01" request.QueryParams["SignatureNonce"] = utils.GetUUID() diff --git a/credentials/oidc_credential_test.go b/credentials/oidc_credential_test.go index b39ed40..c329bb5 100644 --- a/credentials/oidc_credential_test.go +++ b/credentials/oidc_credential_test.go @@ -61,10 +61,11 @@ func Test_oidcCredential_updateCredential(t *testing.T) { assert.Equal(t, 1027, len(*token)) assert.Equal(t, "test_long_oidc_token_eyJhbGciOiJSUzI1NiIsImtpZCI6ImFQaXlpNEVGSU8wWnlGcFh1V0psQUNWbklZVlJsUkNmM2tlSzNMUlhWT1UifQ.eyJhdWQiOlsic3RzLmFsaXl1bmNzLmNvbSJdLCJleHAiOjE2NDUxMTk3ODAsImlhdCI6MTY0NTA4Mzc4MCwiaXNzIjoiaHR0cHM6Ly9vaWRjLWFjay1jbi1oYW5nemhvdS5vc3MtY24taGFuZ3pob3UtaW50ZXJuYWwuYWxpeXVuY3MuY29tL2NmMWQ4ZGIwMjM0ZDk0YzEyOGFiZDM3MTc4NWJjOWQxNSIsImt1YmVybmV0ZXMuaW8iOnsibmFtZXNwYWNlIjoidGVzdC1ycnNhIiwicG9kIjp7Im5hbWUiOiJydW4tYXMtcm9vdCIsInVpZCI6ImIzMGI0MGY2LWNiZTAtNGY0Yy1hZGYyLWM1OGQ4ZmExZTAxMCJ9LCJzZXJ2aWNlYWNjb3VudCI6eyJuYW1lIjoidXNlcjEiLCJ1aWQiOiJiZTEyMzdjYS01MTY4LTQyMzYtYWUyMC00NDM1YjhmMGI4YzAifX0sIm5iZiI6MTY0NTA4Mzc4MCwic3ViIjoic3lzdGVtOnNlcnZpY2VhY2NvdW50OnRlc3QtcnJzYTp1c2VyMSJ9.XGP-wgLj-iMiAHjLe0lZLh7y48Qsj9HzsEbNh706WwerBoxnssdsyGFb9lzd2FyM8CssbAOCstr7OuAMWNdJmDZgpiOGGSbQ-KXXmbfnIS4ix-V3pQF6LVBFr7xJlj20J6YY89um3rv_04t0iCGxKWs2ZMUyU1FbZpIPRep24LVKbUz1saiiVGgDBTIZdHA13Z-jUvYAnsxK_Kj5tc1K-IuQQU0IwSKJh5OShMcdPugMV5LwTL3ogCikfB7yljq5vclBhCeF2lXLIibvwF711TOhuJ5lMlh-a2KkIgwBHhANg_U9k4Mt_VadctfUGc4hxlSbBD0w9o9mDGKwgGmW5Q", *token) - oidcCredential = newOIDCRoleArnCredential("accessKeyId", "accessKeySecret", "RoleArn", "OIDCProviderArn", "tokenFilePath", "roleSessionName", "Policy", 3600, &utils.Runtime{STSEndpoint: "www.aliyun.com"}) + oidcCredential = newOIDCRoleArnCredential("accessKeyId", "accessKeySecret", "RoleArn", "OIDCProviderArn", "tokenFilePath", "roleSessionName", "Policy", 7200, &utils.Runtime{STSEndpoint: "www.aliyun.com"}) hookDo = func(fn func(req *http.Request) (*http.Response, error)) func(req *http.Request) (*http.Response, error) { return func(req *http.Request) (*http.Response, error) { assert.Equal(t, "www.aliyun.com", req.Host) + assert.Contains(t, req.URL.RawQuery, "DurationSeconds=7200") return mockResponse(400, ``, errors.New("sdk test")) } }