⚝
One Hat Cyber Team
⚝
Your IP:
216.73.216.133
Server IP:
185.119.109.197
Server:
Linux managedhosting.chostar.me 5.15.0-160-generic #170-Ubuntu SMP Wed Oct 1 10:06:56 UTC 2025 x86_64
Server Software:
Apache
PHP Version:
8.1.33
Buat File
|
Buat Folder
Eksekusi
Dir :
~
/
lib
/
python3
/
dist-packages
/
botocore
/
__pycache__
/
View File Name :
credentials.cpython-310.pyc
o <&a@ @ sX d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dlm Z d dl m Z d dl m Z d dlmZ d dlmZ d dlmZmZ d dlZd dlZd dlmZ d d lmZ d d lmZ d d lm Z d d l m Z d d l m Z d dl m Z d dl m!Z! d dl m"Z" d dl m#Z# d dl m$Z$ d dl m%Z% d dl m&Z& d dl'm(Z(m)Z) d dl'm*Z* d dl'm+Z+ d dl'm,Z, d dl'm-Z- e.e/Z0e dg dZ1d]d d Z2G d d d e3Z4d d! Z5d"d# Z6d$d% Z7d^d'd(Z8d)d* Z9d+d, Z:d-d. Z;G d/d0 d0e3Z<G d1d2 d2e3Z=G d3d4 d4e=Z>G d5d6 d6e>Z?G d7d8 d8e3Z@G d9d: d:e@ZAG d;d< d<eAZBG d=d> d>eAZCG d?d@ d@e3ZDG dAdB dBeDZEG dCdD dDeDZFG dEdF dFeDZGG dGdH dHeDZHG dIdJ dJeDZIG dKdL dLeDZJG dMdN dNeDZKG dOdP dPeDZLG dQdR dReDZMG dSdT dTe3ZNG dUdV dVeDZOG dWdX dXe3ZPG dYdZ dZe@ZQG d[d\ d\eDZRdS )_ N) namedtuple)deepcopy)sha1)Pathparse)tzlocaltzutc)UNSIGNED) total_seconds)compat_shell_split)Config)UnknownCredentialError)PartialCredentialsError)ConfigNotFound)InvalidConfigError)InfiniteLoopConfigError) RefreshWithMFAUnsupportedError)MetadataRetrievalError)CredentialRetrievalError)UnauthorizedSSOTokenError)InstanceMetadataFetcherparse_key_val_file)ContainerMetadataFetcher)FileWebIdentityTokenLoader)SSOTokenLoader)resolve_imds_endpoint_modeReadOnlyCredentials access_key secret_keytokenc s dpd} d} d} ddu} dt d}|du r*i }t }t } tt|| |dd } t ||d } t fd d t |||t || | g| d } || g} | j ||d}t t | | g}| | | }|r|| td t|d}|S )zCreate a default credential resolver. This creates a pre-configured credential resolver that includes the default lookup chain for credentials. profiledefaultmetadata_service_timeout metadata_service_num_attemptsN ec2_metadata_service_endpoint)r& "ec2_metadata_service_endpoint_mode)timeout num_attempts user_agentconfig)iam_role_fetcher)cache region_namec s j S N) full_config sessionr1 6/usr/lib/python3/dist-packages/botocore/credentials.py<lambda>] s z,create_credential_resolver.<locals>.<lambda>) load_configclient_creatorr- profile_namecredential_sourcerprofile_provider_builderr8 disable_env_varszWSkipping environment variable credential check because profile name was explicitly set. providers)get_config_variableinstance_variablesgetr EnvProviderContainerProviderInstanceMetadataProviderr r* ProfileProviderBuilderAssumeRoleProvider_get_client_creator CanonicalNameCredentialSourcerr> OriginalEC2Provider BotoProviderremoveloggerdebugCredentialResolver)r3 r- r. r8 metadata_timeoutr) r< imds_config env_providercontainer_providerinstance_metadata_providerr: assume_role_provider pre_profileprofile_providers post_profiler> resolverr1 r2 r4 create_credential_resolver9 sl rY c @ sP e Zd ZdZ dddZdddZdd Zd d Zd d Zdd Z dd Z dS )rE a This class handles the creation of profile based providers. NOTE: This class is only intended for internal use. This class handles the creation and ordering of the various credential providers that primarly source their configuration from the shared config. This is needed to enable sharing between the default credential chain and the source profile chain created by the assume role provider. Nc C s || _ || _|| _|| _d S r/ )_session_cache _region_name_sso_token_cache)selfr3 r- r. sso_token_cacher1 r1 r4 __init__ s z ProfileProviderBuilder.__init__Fc C s. | ||| || || || |gS r/ ) _create_web_identity_provider_create_sso_provider"_create_shared_credential_provider_create_process_provider_create_config_providerr^ r8 r< r1 r1 r4 r> s z ProfileProviderBuilder.providersc s t | fdddS )Nc j jS r/ rZ r0 r1 r^ r1 r4 r5 zAProfileProviderBuilder._create_process_provider.<locals>.<lambda>)r8 r6 )ProcessProviderr^ r8 r1 ri r4 rd s z/ProfileProviderBuilder._create_process_providerc C | j d}t||dS )Ncredentials_file)r8 creds_filename)rZ r? SharedCredentialProvider)r^ r8 credential_filer1 r1 r4 rc z9ProfileProviderBuilder._create_shared_credential_providerc C rm )N config_file)r8 config_filename)rZ r? ConfigProvider)r^ r8 rs r1 r1 r4 re rr z.ProfileProviderBuilder._create_config_providerc s& t fddt j j j||dS )Nc rg r/ rh r1 ri r1 r4 r5 rj zFProfileProviderBuilder._create_web_identity_provider.<locals>.<lambda>)r6 r7 r- r8 r< )!AssumeRoleWithWebIdentityProviderrG rZ r\ r[ rf r1 ri r4 ra s z4ProfileProviderBuilder._create_web_identity_providerc s" t fdd jj| j jdS )Nc rg r/ rh r1 ri r1 r4 r5 rj z=ProfileProviderBuilder._create_sso_provider.<locals>.<lambda>)r6 r7 r8 r- token_cache) SSOProviderrZ create_clientr[ r] rl r1 ri r4 rb s z+ProfileProviderBuilder._create_sso_providerNNNF) __name__ __module__ __qualname____doc__r` r> rd rc re ra rb r1 r1 r1 r4 rE s rE c C s t | }| S r/ )rY load_credentials)r3 rX r1 r1 r4 get_credentials s r c C s t j t S r/ )datetimenowr r1 r1 r1 r4 _local_now r c C s t | tjr| S t| S r/ ) isinstancer r )valuer1 r1 r4 _parse_if_needed s r Fc C s& t | tjr|r | S | dS | S )Nz%Y-%m-%dT%H:%M:%S%Z)r r isoformatstrftime)r isor1 r1 r4 _serialize_if_needed s r c fdd}|S )Nc s* d i}|j di | j| fi |S )Nr. r1 )updatery ) service_namekwargscreate_client_kwargsr. r3 r1 r4 r7 s z+_get_client_creator.<locals>.client_creatorr1 )r3 r. r7 r1 r r4 rG s rG c r )Nc s: j di } | d }|d |d |d t|d dS )N Credentials AccessKeyIdSecretAccessKey SessionToken Expirationr r r! expiry_timer1 ) assume_roler )response credentialsclientparamsr1 r4 refresh s z-create_assume_role_refresher.<locals>.refreshr1 )r r r r1 r r4 create_assume_role_refresher s r c C s G dd dt }|| S )Nc @ s e Zd Zdd Zdd ZdS )z/create_mfa_serial_refresher.<locals>._Refresherc S s || _ d| _d S )NF)_refresh_has_been_called)r^ r r1 r1 r4 r` s z8create_mfa_serial_refresher.<locals>._Refresher.__init__c S s | j rt d| _ | S NT)r r r ri r1 r1 r4 __call__ s z8create_mfa_serial_refresher.<locals>._Refresher.__call__N)r| r} r~ r` r r1 r1 r1 r4 _Refresher s r )object)actual_refreshr r1 r1 r4 create_mfa_serial_refresher s r c @ sh e Zd ZdZejejddddZedfddZ d d Z d d Z d d Z dd Z dd Zdd ZdS ) JSONFileCachezJSON file cache. This provides a dict like interface that stores JSON serializable objects. The objects are serialized to JSON and stored in a file. These values can be retrieved at a later time. ~.awsbotor- Nc C s || _ |d u r | j}|| _d S r/ ) _working_dir_default_dumps_dumps)r^ working_dir dumps_funcr1 r1 r4 r` ! s zJSONFileCache.__init__c C s t j|tdS )N)r# )jsondumpsr )r^ objr1 r1 r4 r ' r z JSONFileCache._default_dumpsc C s | |}tj|S r/ )_convert_cache_keyospathisfile)r^ cache_key actual_keyr1 r1 r4 __contains__* s zJSONFileCache.__contains__c C sb | |}z t|}t|W d W S 1 sw Y W dS tttfy0 t|w )z Retrieve value from a cache key.N)r openr loadOSError ValueErrorIOErrorKeyError)r^ r r fr1 r1 r4 __getitem__. s (zJSONFileCache.__getitem__c C s8 | |}z t|}| W d S ty t|w r/ )r r unlinkFileNotFoundErrorr )r^ r r key_pathr1 r1 r4 __delitem__7 s zJSONFileCache.__delitem__c C s | |}z| |}W n ttfy td| w tj| js)t| j t t |tj tj B dd}| || W d d S 1 sMw Y d S )Nz5Value cannot be cached, must be JSON serializable: %si w)r r TypeErrorr r r isdirr makedirsfdopenr O_WRONLYO_CREATtruncatewrite)r^ r r full_key file_contentr r1 r1 r4 __setitem__? s& "zJSONFileCache.__setitem__c C s t j| j|d }|S )Nz.json)r r joinr )r^ r full_pathr1 r1 r4 r M s z JSONFileCache._convert_cache_key)r| r} r~ r r r expanduserr CACHE_DIRr` r r r r r r r1 r1 r1 r4 r s r c @ s. e Zd ZdZ d ddZdd Zdd ZdS ) r a\ Holds the credentials needed to authenticate requests. :ivar access_key: The access key part of the credentials. :ivar secret_key: The secret key part of the credentials. :ivar token: The security token, valid only for session credentials. :ivar method: A string which identifies where the credentials were found. Nc C s0 || _ || _|| _|d u rd}|| _| d S )Nexplicit)r r r! method _normalize)r^ r r r! r r1 r1 r4 r` ] s zCredentials.__init__c C $ t j| j| _t j| j| _d S r/ )botocorecompatensure_unicoder r ri r1 r1 r4 r i s zCredentials._normalizec C s t | j| j| jS r/ )r r r r! ri r1 r1 r4 get_frozen_credentialss s z"Credentials.get_frozen_credentialsNN)r| r} r~ r r` r r r1 r1 r1 r4 r R s r c @ s e Zd ZdZdZdZefddZdd Ze dd Z e d d Z e j d d Z e d d Zej dd Ze dd Zej dd Zdd Zd$ddZdd Zdd Zd d Zed d Zd d! Zd"d# ZdS )%RefreshableCredentialsa Holds the credentials needed to authenticate requests. In addition, it knows how to refresh itself. :ivar access_key: The access key part of the credentials. :ivar secret_key: The secret key part of the credentials. :ivar token: The security token, valid only for session credentials. :ivar method: A string which identifies where the credentials were found. iX c C sN || _ || _|| _|| _|| _|| _t | _|| _ t |||| _ | d S r/ ) _refresh_using _access_key _secret_key_token _expiry_time _time_fetcher threadingLock _refresh_lockr r _frozen_credentialsr )r^ r r r! r refresh_usingr time_fetcherr1 r1 r4 r` s z RefreshableCredentials.__init__c C r r/ )r r r r r ri r1 r1 r4 r s z!RefreshableCredentials._normalizec C s. | |d |d |d | |d ||d}|S )Nr r r! r )r r r! r r r )_expiry_datetime)clsmetadatar r instancer1 r1 r4 create_from_metadata s z+RefreshableCredentials.create_from_metadatac C | | jS zWarning: Using this property can lead to race conditions if you access another property subsequently along the refresh boundary. Please use get_frozen_credentials instead. )r r ri r1 r1 r4 r z!RefreshableCredentials.access_keyc C || _ d S r/ )r r^ r r1 r1 r4 r c C r r )r r ri r1 r1 r4 r r z!RefreshableCredentials.secret_keyc C r r/ )r r r1 r1 r4 r r c C r r )r r ri r1 r1 r4 r! r z RefreshableCredentials.tokenc C r r/ )r r r1 r1 r4 r! r c C s | j | }t|S r/ )r r r )r^ deltar1 r1 r4 _seconds_remaining s z)RefreshableCredentials._seconds_remainingNc C s: | j du rdS |du r| j}| |krdS td dS )a Check if a refresh is needed. A refresh is needed if the expiry time associated with the temporary credentials is less than the provided ``refresh_in``. If ``time_delta`` is not provided, ``self.advisory_refresh_needed`` will be used. For example, if your temporary credentials expire in 10 minutes and the provided ``refresh_in`` is ``15 * 60``, then this function will return ``True``. :type refresh_in: int :param refresh_in: The number of seconds before the credentials expire in which refresh attempts should be made. :return: True if refresh needed, False otherwise. NFz!Credentials need to be refreshed.T)r _advisory_refresh_timeoutr rL rM r^ refresh_inr1 r1 r4 refresh_needed s z%RefreshableCredentials.refresh_neededc C s | j ddS )Nr )r )r ri r1 r1 r4 _is_expired s z"RefreshableCredentials._is_expiredc C s | | jsd S | jdr7z"| | js W | j d S | | j}| j|d W | j d S | j w | | jrh| j | | jsP W d d S | jdd W d d S 1 saw Y d S d S )NF) is_mandatoryT)r r r acquirerelease_mandatory_refresh_timeout_protected_refresh)r^ is_mandatory_refreshr1 r1 r4 r s* "z RefreshableCredentials._refreshc C s z| }W n ty! |rdnd}tjd|dd |r Y d S w | | t| j| j| j| _ | r@d}t| t |d S )N mandatoryadvisoryzARefreshing temporary credentials failed during %s refresh period.Texc_infozLCredentials were refreshed, but the refreshed credentials are still expired.) r ExceptionrL warning_set_from_datar r r r r r RuntimeError)r^ r r period_namemsgr1 r1 r4 r s( z)RefreshableCredentials._protected_refreshc C s t | S r/ r )time_strr1 r1 r4 r 9 s z'RefreshableCredentials._expiry_datetimec s g d} s |}n fdd|D }|r"d}t | j|d| d d | _ d | _ d | _t d | _t d | j | d S ) Nr c s g | ]}| vr|qS r1 r1 ).0kdatar1 r4 <listcomp>B s z9RefreshableCredentials._set_from_data.<locals>.<listcomp>z7Credential refresh failed, response did not contain: %s, provider error_msgr r r! r z(Retrieved credentials will expire at: %s) r r r r r r! r r rL rM r )r^ r expected_keys missing_keysmessager1 r r4 r = s$ z%RefreshableCredentials._set_from_datac C r )a Return immutable credentials. The ``access_key``, ``secret_key``, and ``token`` properties on this class will always check and refresh credentials if needed before returning the particular credentials. This has an edge case where you can get inconsistent credentials. Imagine this: # Current creds are "t1" tmp.access_key ---> expired? no, so return t1.access_key # ---- time is now expired, creds need refreshing to "t2" ---- tmp.secret_key ---> expired? yes, refresh and return t2.secret_key This means we're using the access key from t1 with the secret key from t2. To fix this issue, you can request a frozen credential object which is guaranteed not to change. The frozen credentials returned from this method should be used immediately and then discarded. The typical usage pattern would be:: creds = RefreshableCredentials(...) some_code = SomeSignerObject() # I'm about to sign the request. # The frozen credentials are only used for the # duration of generate_presigned_url and will be # immediately thrown away. request = some_code.sign_some_request( with_credentials=creds.get_frozen_credentials()) print("Signed request:", request) )r r ri r1 r1 r4 r S s "z-RefreshableCredentials.get_frozen_credentialsr/ )r| r} r~ r r r r r` r classmethodr propertyr setterr r! r r r r r staticmethodr r r r1 r1 r1 r4 r y s< " ! r c s. e Zd ZdZefddZd fdd Z ZS ) DeferredRefreshableCredentialszyRefreshable credentials that don't require initial credentials. refresh_using will be called upon first access. c C s> || _ d | _d | _d | _d | _|| _t | _|| _ d | _ d S r/ ) r r r r r r r r r r r )r^ r r r r1 r1 r4 r` ~ s z'DeferredRefreshableCredentials.__init__Nc s | j d u rdS tt| |S r )r superr# r r __class__r1 r4 r s z-DeferredRefreshableCredentials.refresh_neededr/ )r| r} r~ r r r` r __classcell__r1 r1 r% r4 r# y s r# c @ sZ e Zd ZdZdddZdd Zdd Zd d Zd d Zd d Z dd Z dd Z dd Z dS )CachedCredentialFetcherr Nc C s4 |d u ri }|| _ | | _|d u r| j}|| _d S r/ )r[ _create_cache_key _cache_key DEFAULT_EXPIRY_WINDOW_SECONDS_expiry_window_seconds)r^ r- expiry_window_secondsr1 r1 r4 r` s z CachedCredentialFetcher.__init__c C t d)Nz_create_cache_key()NotImplementedErrorri r1 r1 r4 r) z)CachedCredentialFetcher._create_cache_keyc C s$ | dd tjjd}| ddS )N:_/)replacer r sep)r^ filenamer1 r1 r4 _make_file_safe s z'CachedCredentialFetcher._make_file_safec C r. )Nz_get_credentials()r/ ri r1 r1 r4 _get_credentials r1 z(CachedCredentialFetcher._get_credentialsc C | S r/ )_get_cached_credentialsri r1 r1 r4 fetch_credentials r1 z)CachedCredentialFetcher.fetch_credentialsc C s` | }|du r| }| | ntd |d }t|d dd}|d |d |d |d S ) zGet up-to-date credentials. This will check the cache for up-to-date credentials, calling assume role if none are available. Nz*Credentials for role retrieved from cache.r r T)r r r r r )_load_from_cacher9 _write_to_cacherL rM r )r^ r creds expirationr1 r1 r4 r; s z/CachedCredentialFetcher._get_cached_credentialsc C s8 | j | jv rt| j| j }| |s|S td d S )Nz6Credentials were found in cache, but they are expired.)r* r[ r r rL rM )r^ r? r1 r1 r4 r= s z(CachedCredentialFetcher._load_from_cachec C s t || j| j< d S r/ )r r[ r* )r^ r r1 r1 r4 r> s z'CachedCredentialFetcher._write_to_cachec C s( t |d d }t|t }|| jk S )z!Check if credentials are expired.r r )r r r r, )r^ r end_timesecondsr1 r1 r4 r s z#CachedCredentialFetcher._is_expiredr ) r| r} r~ r+ r` r) r8 r9 r< r; r= r> r r1 r1 r1 r4 r( s r( c s2 e Zd Z d fdd Zdd Zdd Z ZS ) BaseAssumeRoleCredentialFetcherNc sj || _ || _|d u ri | _nt|| _| j| jd< | jd| _d| _| js*| tt | || d S )NRoleArnRoleSessionNameF) _client_creator _role_arn_assume_kwargsr rA _role_session_name_using_default_session_name_generate_assume_role_namer$ rC r` )r^ r7 role_arn extra_argsr- r- r% r1 r4 r` s z(BaseAssumeRoleCredentialFetcher.__init__c C s( dt t | _| j| jd< d| _d S )Nzbotocore-session-%srE T)inttimerI rH rJ ri r1 r1 r4 rK s z:BaseAssumeRoleCredentialFetcher._generate_assume_role_namec C sZ t | j}| jr |d= d|v rt|d |d< tj|dd}t|d }| |S )Create a predictable cache key for the current configuration. The cache key is intended to be compatible with file names. rE PolicyT) sort_keysutf-8) r rH rJ r loadsr r encode hexdigestr8 r^ args argument_hashr1 r1 r4 r) s z1BaseAssumeRoleCredentialFetcher._create_cache_keyrz )r| r} r~ r` rK r) r' r1 r1 r% r4 rC s rC c s: e Zd Z d fdd Zdd Zdd Zdd Z ZS ) AssumeRoleCredentialFetcherNc s< || _ || _| jdu rtj| _tt| j|||||d dS )a :type client_creator: callable :param client_creator: A callable that creates a client taking arguments like ``Session.create_client``. :type source_credentials: Credentials :param source_credentials: The credentials to use to create the client for the call to AssumeRole. :type role_arn: str :param role_arn: The ARN of the role to be assumed. :type extra_args: dict :param extra_args: Any additional arguments to add to the assume role request using the format of the botocore operation. Possible keys include, but may not be limited to, DurationSeconds, Policy, SerialNumber, ExternalId and RoleSessionName. :type mfa_prompter: callable :param mfa_prompter: A callable that returns input provided by the user (i.e raw_input, getpass.getpass, etc.). :type cache: dict :param cache: An object that supports ``__getitem__``, ``__setitem__``, and ``__contains__``. An example of this is the ``JSONFileCache`` class in aws-cli. :type expiry_window_seconds: int :param expiry_window_seconds: The amount of time, in seconds, NrM r- r- )_source_credentials _mfa_promptergetpassr$ rZ r` )r^ r7 source_credentialsrL rM mfa_prompterr- r- r% r1 r4 r` s " z$AssumeRoleCredentialFetcher.__init__c C s | }| }|jdi |S )'Get credentials by calling assume role.Nr1 )_assume_role_kwargs_create_clientr )r^ r r r1 r1 r4 r9 4 s z,AssumeRoleCredentialFetcher._get_credentialsc C sT t | j}|d}|durd| }| |}||d< |d}|dur(||d< |S )AGet the arguments for assume role based on current configuration. SerialNumberNzEnter MFA code for %s: TokenCodeDurationSeconds)r rH rA r] )r^ assume_role_kwargs mfa_serialprompt token_codeduration_secondsr1 r1 r4 rb : s z/AssumeRoleCredentialFetcher._assume_role_kwargsc C s" | j }| jd|j|j|jdS )z2Create an STS client using the source credentials.sts)aws_access_key_idaws_secret_access_keyaws_session_token)r\ r rF r r r! )r^ frozen_credentialsr1 r1 r4 rc L s z*AssumeRoleCredentialFetcher._create_client)NNNN)r| r} r~ r` r9 rb rc r' r1 r1 r% r4 rZ s ,rZ c s0 e Zd Z d fdd Zdd Zdd Z ZS ) *AssumeRoleWithWebIdentityCredentialFetcherNc s$ || _ tt| j|||||d dS )aG :type client_creator: callable :param client_creator: A callable that creates a client taking arguments like ``Session.create_client``. :type web_identity_token_loader: callable :param web_identity_token_loader: A callable that takes no arguments and returns a web identity token str. :type role_arn: str :param role_arn: The ARN of the role to be assumed. :type extra_args: dict :param extra_args: Any additional arguments to add to the assume role request using the format of the botocore operation. Possible keys include, but may not be limited to, DurationSeconds, Policy, SerialNumber, ExternalId and RoleSessionName. :type cache: dict :param cache: An object that supports ``__getitem__``, ``__setitem__``, and ``__contains__``. An example of this is the ``JSONFileCache`` class in aws-cli. :type expiry_window_seconds: int :param expiry_window_seconds: The amount of time, in seconds, r[ N)_web_identity_token_loaderr$ rr r` )r^ r7 web_identity_token_loaderrL rM r- r- r% r1 r4 r` Z s z3AssumeRoleWithWebIdentityCredentialFetcher.__init__c C s0 | }ttd}| jd|d}|jdi |S )ra )signature_versionrm r+ Nr1 )rb r r rF assume_role_with_web_identity)r^ r r+ r r1 r1 r4 r9 ~ s z;AssumeRoleWithWebIdentityCredentialFetcher._get_credentialsc C s t | j}| }||d< |S )rd WebIdentityToken)r rH rs )r^ rh identity_tokenr1 r1 r4 rb s z>AssumeRoleWithWebIdentityCredentialFetcher._assume_role_kwargsrz )r| r} r~ r` r9 rb r' r1 r1 r% r4 rr W s $ rr c @ s. e Zd ZdZdZdddZdd Zdd ZdS ) CredentialProviderNc C r r/ r2 )r^ r3 r1 r1 r4 r` zCredentialProvider.__init__c C s dS )a~ Loads the credentials from their source & sets them on the object. Subclasses should implement this method (by reading from disk, the environment, the network or wherever), returning ``True`` if they were found & loaded. If not found, this method should return ``False``, indictating that the ``CredentialResolver`` should fall back to the next available method. The default implementation does nothing, assuming the user has set the ``access_key/secret_key/token`` themselves. :returns: Whether credentials were found & set :rtype: Credentials Tr1 ri r1 r1 r4 r s zCredentialProvider.loadc G s@ g }|D ]}z | || W q ty t| j|dw |S )Nr cred_var)appendr r METHOD)r^ mapping key_namesfoundkey_namer1 r1 r4 _extract_creds_from_mapping s z.CredentialProvider._extract_creds_from_mappingr/ )r| r} r~ r CANONICAL_NAMEr` r r r1 r1 r1 r4 rz s rz c @ s: e Zd ZdZejfddZdd Zdd Ze dd Z d S ) rk zcustom-processc C s || _ || _d | _|| _d S r/ ) _profile_name _load_config_loaded_config_popen)r^ r8 r6 popenr1 r1 r4 r` s zProcessProvider.__init__c sd j d u r d S }|dd ur"t| fddjS t|d |d |djdS )Nr c s S r/ )_retrieve_credentials_usingr1 credential_processr^ r1 r4 r5 s z&ProcessProvider.load.<locals>.<lambda>r r r! )r r r! r )_credential_processr rA r r r r )r^ creds_dictr1 r r4 r s zProcessProvider.loadc C s t |}| j|tjtjd}| \}}|jdkr#t| j|ddt j j |d}| dd}|dkr@t| jd| dz|d |d | d | d d W S tyg } z t| jd| dd }~ww )N)stdoutstderrr rS r Versionz<Version key not provided> zOUnsupported version '%s' for credential process provider, supported versions: 1r r r r r z$Missing required key in response: %s)r r subprocessPIPE communicate returncoder r decoder r r rT rA r ) r^ r process_listpr r parsedversioner1 r1 r4 r s@ z+ProcessProvider._retrieve_credentials_usingc C s6 | j d u r | | _ | j di | ji }|dS )Nprofilesr )r r rA r )r^ profile_configr1 r1 r4 r s z#ProcessProvider._credential_processN) r| r} r~ r r Popenr` r r r r r1 r1 r1 r4 rk s rk c @ s$ e Zd ZdZdZdd Zdd ZdS )rD ziam-roleEc2InstanceMetadatac C r r/ ) _role_fetcher)r^ r, r1 r1 r4 r` r{ z!InstanceMetadataProvider.__init__c C s> | j }| }|s d S td|d tj|| j|jd}|S )Nz#Found credentials from IAM Role: %s role_namer r )r retrieve_iam_role_credentialsrL rM r r r )r^ fetcherr r? r1 r1 r4 r s z InstanceMetadataProvider.loadN)r| r} r~ r r r` r r1 r1 r1 r4 rD s rD c @ sJ e Zd ZdZdZdZdZddgZdZdd d Z d d Z d d Z dd Z dS )rB env EnvironmentAWS_ACCESS_KEY_IDAWS_SECRET_ACCESS_KEYAWS_SECURITY_TOKENAWS_SESSION_TOKENAWS_CREDENTIAL_EXPIRATIONNc C s$ |du rt j}|| _| || _dS )a :param environ: The environment variables (defaults to ``os.environ`` if no value is provided). :param mapping: An optional mapping of variable names to environment variable names. Use this if you want to change the mapping of access_key->AWS_ACCESS_KEY_ID, etc. The dict can have up to 3 keys: ``access_key``, ``secret_key``, ``session_token``. N)r environ_build_mapping_mapping)r^ r r r1 r1 r4 r` ) s zEnvProvider.__init__c C s i }|d u r | j |d< | j|d< | j|d< | j|d< |S |d| j |d< |d| j|d< |d| j|d< t|d tsE|d g|d< |d| j|d< |S )Nr r r! r ) ACCESS_KEY SECRET_KEYTOKENS EXPIRY_TIMErA r list)r^ r var_mappingr1 r1 r4 r 9 s, zEnvProvider._build_mappingc C s | j | jd d}|rFtd | }|dd}|d }|dur7t|}t|d |d |d ||| jd S t |d |d |d | jd S dS ) zK Search for credentials in explicit environment variables. r z+Found credentials in environment variables.F)require_expiryr Nr r! )r r r ) r rA r rL info_create_credentials_fetcherr r r r )r^ r r r r r1 r1 r4 r O s$ zEnvProvider.loadc s( | j | j| j d fdd }|S )NTc s i } d d}|std d||d< d d}|s*td d||d< d |d< d D ]} |d}|rF||d< nq6d |d< d d}|rY||d< | re|setd d|S )Nr r r| r r! r )rA r )r r r r token_env_varr! r r r r r1 r4 r< p s: zBEnvProvider._create_credentials_fetcher.<locals>.fetch_credentials)T)r r r )r^ r< r1 r r4 r k s z'EnvProvider._create_credentials_fetcherr ) r| r} r~ r r r r r r r` r r r r1 r1 r1 r4 rB s rB c @ s2 e Zd ZdZdZdZdZdZd ddZd d Z dS ) rI zec2-credentials-file Ec2ConfigAWS_CREDENTIAL_FILEAWSAccessKeyId AWSSecretKeyNc C s* |d u rt j}|d u r t}|| _|| _d S r/ )r r r _environ_parser)r^ r parserr1 r1 r4 r` s z OriginalEC2Provider.__init__c C sf d| j v r1tj| j d }| |}| j|v r/td || j }|| j }t ||| j dS dS dS )zN Search for a credential file used by original EC2 CLI tools. r z)Found credentials in AWS_CREDENTIAL_FILE.r N) r r r r r r rL r r r r )r^ r r? r r r1 r1 r4 r s zOriginalEC2Provider.loadr ) r| r} r~ r r CRED_FILE_ENVr r r` r r1 r1 r1 r4 rI s rI c @ s> e Zd ZdZdZdZdZddgZddd Zd d Z d d Z dS )rp zshared-credentials-fileSharedCredentialsrn ro aws_security_tokenrp Nc C s2 || _ |d u r d}|| _|d u rtjj}|| _d S )Nr# )_creds_filenamer r configloaderraw_config_parse _ini_parser)r^ ro r8 ini_parserr1 r1 r4 r` s z!SharedCredentialProvider.__init__c C s z| | j}W n ty Y d S w | j|v rB|| j }| j|v rDtd| j | || j| j\}}| |}t |||| j dS d S d S )Nz0Found credentials in shared credentials file: %sr ) r r r r r rL r r r _get_session_tokenr r )r^ available_credsr+ r r r! r1 r1 r4 r s( z SharedCredentialProvider.loadc C $ | j D ] }||v r|| S qd S r/ r )r^ r+ token_envvarr1 r1 r4 r z+SharedCredentialProvider._get_session_tokenr ) r| r} r~ r r r r r r` r r r1 r1 r1 r4 rp s rp c @ sB e Zd ZdZdZdZdZdZddgZdd d Z d d Z d d Z dS )ru z0INI based config provider with profile sections.z config-file SharedConfigrn ro r rp Nc C s& || _ || _|du rtjj}|| _dS )a :param config_filename: The session configuration scoped to the current profile. This is available via ``session.config``. :param profile_name: The name of the current profile. :param config_parser: A config parser callable. N)_config_filenamer r r r6 _config_parser)r^ rt r8 config_parserr1 r1 r4 r` s zConfigProvider.__init__c C s z| | j}W n ty Y dS w | j|d v rH|d | j }| j|v rFtd| j | || j| j\}}| |}t |||| j dS dS dS )zr If there is are credentials in the configuration associated with the session, use those. Nr z$Credentials found in config file: %sr ) r r r r r rL r r r r r r )r^ r0 r r r r! r1 r1 r4 r s( zConfigProvider.loadc C r r/ r )r^ r token_namer1 r1 r4 r r z!ConfigProvider._get_session_tokenr/ ) r| r} r~ r r r r r r r` r r r1 r1 r1 r4 ru s ru c @ s: e Zd ZdZdZdZddgZdZdZd d d Z d d Z dS )rJ z boto-config Boto2Config BOTO_CONFIGz /etc/boto.cfgz~/.botorn ro Nc C s. |d u rt j}|d u rtjj}|| _|| _d S r/ )r r r r r r r )r^ r r r1 r1 r4 r` s zBotoProvider.__init__c C s | j | jv r| j| j g}n| j}|D ];}z| |}W n ty% Y qw d|v rN|d }| j|v rNtd| | || j| j \}}t ||| j d S qdS )z; Look for credentials in boto config file. r z)Found credentials in boto config file: %sr N) BOTO_CONFIG_ENVr DEFAULT_CONFIG_FILENAMESr r r rL r r r r r )r^ potential_locationsr7 r+ r r r r1 r1 r4 r ' s. zBotoProvider.loadr ) r| r} r~ r r r r r r r` r r1 r1 r1 r4 rJ s rJ c @ s e Zd ZdZdZdZdZdZejddfddZ dd Z d d Z d d Z dd Z dd Zdd Zdd Zdd Zdd Zdd Zd d Zd d ZdS ) rF assume-roleNrL web_identity_token_filer c C s> || _ || _|| _|| _|| _i | _|| _|| _| jg| _dS )a :type load_config: callable :param load_config: A function that accepts no arguments, and when called, will return the full configuration dictionary for the session (``session.full_config``). :type client_creator: callable :param client_creator: A factory function that will create a client when called. Has the same interface as ``botocore.session.Session.create_client``. :type cache: dict :param cache: An object that supports ``__getitem__``, ``__setitem__``, and ``__contains__``. An example of this is the ``JSONFileCache`` class in the CLI. :type profile_name: str :param profile_name: The name of the profile. :type prompter: callable :param prompter: A callable that returns input provided by the user (i.e raw_input, getpass.getpass, etc.). :type credential_sourcer: CanonicalNameCredentialSourcer :param credential_sourcer: A credential provider that takes a configuration, which is used to provide the source credentials for the STS call. N) r- r rF r _prompterr _credential_sourcer_profile_provider_builder_visited_profiles)r^ r6 r7 r- r8 prompterr9 r: r1 r1 r4 r` O s $zAssumeRoleProvider.__init__c C s@ | | _| jdi }|| ji }| |r | | jS d S Nr )r r rA r _has_assume_role_config_vars_load_creds_via_assume_role)r^ r r" r1 r1 r4 r s zAssumeRoleProvider.loadc C s | j |v o | j|vS r/ )ROLE_CONFIG_VARWEB_IDENTITY_TOKE_FILE_VARr^ r" r1 r1 r4 r s z/AssumeRoleProvider._has_assume_role_config_varsc C s | |}| ||}i }|d}|d ur||d< |d}|d ur'||d< |d}|d ur4||d< |d}|d urA||d< t| j||d || j| jd } | j} |d ur[t| } t | j | t d S ) Nrole_session_namerE external_id ExternalIdri re rl rg rL )r7 r_ rL rM r` r- )r r r ) _get_role_config_resolve_source_credentialsrA rZ rF r r- r< r r# r r ) r^ r8 role_configr_ rM r r ri rl r refresherr1 r1 r4 r sB z.AssumeRoleProvider._load_creds_via_assume_rolec C s | j di }|| }|d}|d }|d}|d}|d}|d} |d} |||| ||d } | d urLzt| | d< W n tyK Y nw |d ur[|d ur[td | d |d u rj|d u rjt| jd d|d urv| || | S | || | S )z?Retrieves and validates the role configuration for the profile.r source_profilerL credential_sourceri r r rl )rL r ri r r r NzDThe profile "%s" contains both source_profile and credential_source.r z#source_profile or credential_sourcer| ) r rA rN r r r r _validate_credential_source_validate_source_profile) r^ r8 r r" r rL r ri r r rl r r1 r1 r4 r sP z#AssumeRoleProvider._get_role_configc C s> | j d u rtd||f d| j |s td||f dd S )Nz_The credential_source "%s" is specified in profile "%s", but no source provider was configured.r zCThe credential source "%s" referenced in profile "%s" is not valid.)r r is_supported)r^ parent_profiler r1 r1 r4 r s z.AssumeRoleProvider._validate_credential_sourcec C s t | || |gS r/ )any_has_static_credentialsr r r1 r1 r4 _source_profile_has_credentials s z2AssumeRoleProvider._source_profile_has_credentialsc C sp | j di }||vrtd||f d|| }|| jvr d S ||kr*t|| jd| |s6t|| jdd S )Nr zFThe source_profile "%s" referenced in the profile "%s" does not exist.r )r visited_profiles)r rA r r r r )r^ parent_profile_namesource_profile_namer r r1 r1 r4 r s, z+AssumeRoleProvider._validate_source_profilec s ddg}t fdd|D S )Nro rn c 3 s | ]}| v V qd S r/ r1 )r static_keyr" r1 r4 <genexpr>0 z=AssumeRoleProvider._has_static_credentials.<locals>.<genexpr>)r )r^ r" static_keysr1 r r4 r . s z*AssumeRoleProvider._has_static_credentialsc C s< | d}|d ur| ||S |d }| j| | |S )Nr r )rA _resolve_credentials_from_sourcer r~ !_resolve_credentials_from_profile)r^ r r8 r r r1 r1 r4 r 2 s z.AssumeRoleProvider._resolve_source_credentialsc C s | j di }|| }| |r| js| |S | |s"| |sA| jj|dd}t|}| }|d u r?d}t || d|S | |S )Nr Tr; z.The source profile "%s" must have credentials.r ) r rA r r (_resolve_static_credentials_from_profiler r> rN r r r )r^ r8 r r" rV profile_chainr error_messager1 r1 r4 r = s. z4AssumeRoleProvider._resolve_credentials_from_profilec C sJ zt |d |d |ddW S ty$ } z t| jt|dd }~ww )Nrn ro rp r r| )r rA r r r str)r^ r" r r1 r1 r4 r [ s z;AssumeRoleProvider._resolve_static_credentials_from_profilec C s( | j |}|d u rt|d| d|S )NzBNo credentials found in credential_source referenced in profile %sr )r r_ r )r^ r r8 r r1 r1 r4 r f s z3AssumeRoleProvider._resolve_credentials_from_source)r| r} r~ r r r r EXPIRY_WINDOW_SECONDSr^ r` r r r r r r r r r r r r r1 r1 r1 r4 rF @ s* 7 ,2 & rF c @ sX e Zd ZdZdZddddZ ddd Zd d Zd d Zdd Z dd Z dd Z dS )rv z assume-role-with-web-identityNAWS_WEB_IDENTITY_TOKEN_FILEAWS_ROLE_SESSION_NAME AWS_ROLE_ARN)r r rL Fc C s: || _ || _|| _|| _d | _|| _|d u rt}|| _d S r/ )r- r rF r _profile_config_disable_env_varsr _token_loader_cls)r^ r6 r7 r8 r- r< token_loader_clsr1 r1 r4 r` ~ s z*AssumeRoleWithWebIdentityProvider.__init__c C r: r/ ) _assume_role_with_web_identityri r1 r1 r4 r r1 z&AssumeRoleWithWebIdentityProvider.loadc C s: | j d u r| }|di }|| ji | _ | j |S r )r r rA r )r^ key loaded_configr r1 r1 r4 _get_profile_config s z5AssumeRoleWithWebIdentityProvider._get_profile_configc C s2 | j rd S | j|}|r|tjv rtj| S d S r/ )r _CONFIG_TO_ENV_VARrA r r )r^ r env_keyr1 r1 r4 _get_env_config s z1AssumeRoleWithWebIdentityProvider._get_env_configc C s | |}|d ur |S | |S r/ )r r )r^ r env_valuer1 r1 r4 _get_config s z-AssumeRoleWithWebIdentityProvider._get_configc C s| | d}|s d S | |}| d}|s d}t|di }| d}|d ur+||d< t| j|||| jd}t| j|jdS ) Nr rL zThe provided profile or the current environment is configured to assume role with web identity but has no role ARN configured. Ensure that the profile has the role_arnconfiguration set or the AWS_ROLE_ARN env var is set.r r rE )r7 rt rL rM r- r ) r r r rr rF r- r# r r< )r^ token_path token_loaderrL r rM r r r1 r1 r4 r s0 z@AssumeRoleWithWebIdentityProvider._assume_role_with_web_identity)NFN) r| r} r~ r r r r` r r r r r r1 r1 r1 r4 rv u s rv c @ s< e Zd Zdd Zdd Zdd Zdd Zd d Zd d Zd S )rH c C r r/ _providersr^ r> r1 r1 r4 r` r{ z'CanonicalNameCredentialSourcer.__init__c C s |dd | j D v S )aL Validates a given source name. :type source_name: str :param source_name: The value of credential_source in the config file. This is the canonical name of the credential provider. :rtype: bool :returns: True if the credential provider is supported, False otherwise. c S g | ]}|j qS r1 )r r r r1 r1 r4 r z?CanonicalNameCredentialSourcer.is_supported.<locals>.<listcomp>r )r^ source_namer1 r1 r4 r s z+CanonicalNameCredentialSourcer.is_supportedc C s$ | |}t|tr| S | S )a Loads source credentials based on the provided configuration. :type source_name: str :param source_name: The value of credential_source in the config file. This is the canonical name of the credential provider. :rtype: Credentials ) _get_providerr rN r r )r^ r" sourcer1 r1 r4 r_ s z1CanonicalNameCredentialSourcer.source_credentialsc C sV | |}| dv r | d}|dur |du r|S t||gS |du r)t|d|S )a# Return a credential provider by its canonical name. :type canonical_name: str :param canonical_name: The canonical name of the provider. :raises UnknownCredentialError: Raised if no credential provider by the provided name is found. ) sharedconfigsharedcredentialsr Nname) _get_provider_by_canonical_namelower_get_provider_by_methodrN r )r^ canonical_namer rT r1 r1 r4 r# s z,CanonicalNameCredentialSourcer._get_providerc C s2 | j D ]}|j}|r| | kr| S qdS )zReturn a credential provider by its canonical name. This function is strict, it does not attempt to address compatibility issues. N)r r r* )r^ r, r r( r1 r1 r4 r) s z>CanonicalNameCredentialSourcer._get_provider_by_canonical_namec C s" | j D ] }|j|kr| S qdS )z0Return a credential provider by its METHOD name.N)r r )r^ r r r1 r1 r4 r+ s z6CanonicalNameCredentialSourcer._get_provider_by_methodN) r| r} r~ r` r r_ r# r) r+ r1 r1 r1 r4 rH s & rH c @ sR e Zd ZdZdZdZdZdZdddZd d Z d d Z d d Z dd Z dd Z dS )rC zcontainer-role EcsContainer&AWS_CONTAINER_CREDENTIALS_RELATIVE_URI"AWS_CONTAINER_CREDENTIALS_FULL_URI!AWS_CONTAINER_AUTHORIZATION_TOKENNc C s, |d u rt j}|d u rt }|| _|| _d S r/ )r r r r _fetcher)r^ r r r1 r1 r4 r` - s zContainerProvider.__init__c C s$ | j | jv s | j| jv r| S d S r/ )ENV_VARr ENV_VAR_FULL_retrieve_or_failri r1 r1 r4 r 5 s zContainerProvider.loadc C sn | r| j| j| j }n| j| j }| }| ||}| }t|d |d |d | j t |d |dS )Nr r r! r )r r r! r r r ) _provided_relative_urir1 full_urlr r2 r3 _build_headers_create_fetcherr r r )r^ full_uriheadersr r? r1 r1 r4 r4 ; s z#ContainerProvider._retrieve_or_failc C s" | j | j}|d urd|iS d S )N Authorization)r rA ENV_VAR_AUTH_TOKEN)r^ auth_tokenr1 r1 r4 r7 L s z ContainerProvider._build_headersc s fdd}|S )Nc sn z j j d} W n ty' } ztjd|dd tjt|dd }~ww | d | d | d | d d S ) N)r: z'Error retrieving container metadata: %sTr r r r Tokenr r )r1 retrieve_full_urir rL rM r r r )r r r9 r: r^ r1 r4 fetch_credsT s$ z6ContainerProvider._create_fetcher.<locals>.fetch_credsr1 )r^ r9 r: rA r1 r@ r4 r8 S s z!ContainerProvider._create_fetcherc C s | j | jv S r/ )r2 r ri r1 r1 r4 r5 f s z(ContainerProvider._provided_relative_urir )r| r} r~ r r r2 r3 r< r` r r4 r7 r8 r5 r1 r1 r1 r4 rC & s rC c @ sD e Zd Zdd Zdd Zdd Zdd Zd d Zd d Zd d Z dS )rN c C s || _ dS )zQ :param providers: A list of ``CredentialProvider`` instances. Nr= r r1 r1 r4 r` k s zCredentialResolver.__init__c C sF z dd | j D |}W n ty t|dw | j || dS )a= Inserts a new instance of ``CredentialProvider`` into the chain that will be tried before an existing one. :param name: The short name of the credentials you'd like to insert the new credentials before. (ex. ``env`` or ``config``). Existing names & ordering can be discovered via ``self.available_methods``. :type name: string :param cred_instance: An instance of the new ``Credentials`` object you'd like to add to the chain. :type cred_instance: A subclass of ``Credentials`` c S r r1 r r r1 r1 r4 r r! z4CredentialResolver.insert_before.<locals>.<listcomp>r' N)r> indexr r insertr^ r( credential_provideroffsetr1 r1 r4 insert_befores s z CredentialResolver.insert_beforec C s | |}| j|d | dS )a9 Inserts a new type of ``Credentials`` instance into the chain that will be tried after an existing one. :param name: The short name of the credentials you'd like to insert the new credentials after. (ex. ``env`` or ``config``). Existing names & ordering can be discovered via ``self.available_methods``. :type name: string :param cred_instance: An instance of the new ``Credentials`` object you'd like to add to the chain. :type cred_instance: A subclass of ``Credentials`` r N)_get_provider_offsetr> rD rE r1 r1 r4 insert_after s z CredentialResolver.insert_afterc C s6 dd | j D }||vrdS ||}| j | dS )z Removes a given ``Credentials`` instance from the chain. :param name: The short name of the credentials instance to remove. :type name: string c S r r1 rB r r1 r1 r4 r r! z-CredentialResolver.remove.<locals>.<listcomp>N)r> rC pop)r^ r( available_methodsrG r1 r1 r4 rK s zCredentialResolver.removec C s | j | | S )zReturn a credential provider by name. :type name: str :param name: The name of the provider. :raises UnknownCredentialError: Raised if no credential provider by the provided name is found. )r> rI r^ r( r1 r1 r4 get_provider s z CredentialResolver.get_providerc C s2 z dd | j D |W S ty t|dw )Nc S r r1 rB r r1 r1 r4 r r! z;CredentialResolver._get_provider_offset.<locals>.<listcomp>r' )r> rC r r rM r1 r1 r4 rI s z'CredentialResolver._get_provider_offsetc C s6 | j D ]}td|j | }|dur| S qdS )zw Goes through the credentials chain, returning the first ``Credentials`` that could be loaded. z Looking for credentials via: %sN)r> rL rM r r )r^ r r? r1 r1 r4 r s z#CredentialResolver.load_credentialsN) r| r} r~ r` rH rJ rK rN rI r r1 r1 r1 r4 rN j s rN c s> e Zd ZdZ d fdd Zdd Zdd Zd d Z ZS ) SSOCredentialFetcherz%Y-%m-%dT%H:%M:%SZNc s: || _ || _|| _|| _|| _|| _tt| || d S r/ ) rF _sso_region _role_name _account_id _start_url _token_loaderr$ rO r` ) r^ start_url sso_regionr account_idr7 r r- r- r% r1 r4 r` s z SSOCredentialFetcher.__init__c C s> | j | j| jd}tj|ddd}t|d }| |S )rP )startUrlroleName accountIdT),r2 )rR separatorsrS ) rS rQ rR r r r rU rV r8 rW r1 r1 r4 r) s z&SSOCredentialFetcher._create_cache_keyc C s$ |d }t j |t }|| jS )Ng @@)r fromtimestampr r _UTC_DATE_FORMAT)r^ timestamp_mstimestamp_seconds timestampr1 r1 r4 _parse_timestamp s z%SSOCredentialFetcher._parse_timestampc C s t t| jd}| jd|d}| j| j| | jd}z |jd i |}W n |j j y0 t w |d }d|d |d |d | |d d d }|S )z4Get credentials by calling SSO get role credentials.)ru r. ssorv )rY rZ accessTokenroleCredentials accessKeyIdsecretAccessKey sessionTokenr@ )r r r r ) ProviderTyper Nr1 ) r r rP rF rQ rR rT rS get_role_credentials exceptionsUnauthorizedExceptionr rb )r^ r+ r r r r r1 r1 r4 r9 s. z%SSOCredentialFetcher._get_credentialsrz ) r| r} r~ r^ r` r) rb r9 r' r1 r1 r% r4 rO s rO c @ sN e Zd ZdZejejddddZg dZ d ddZ d d Z d d Z dS )rx rc r r r- ) sso_start_urlrV sso_role_namesso_account_idNc C s@ |d u r t | j}|| _|d u ri }|| _|| _|| _|| _d S r/ )r _SSO_TOKEN_CACHE_DIR _token_cacher- r rF r )r^ r6 r7 r8 r- rw r1 r1 r4 r` # s zSSOProvider.__init__c s | }|di }| j}|| ji t fdd| jD r"d S i }g }| jD ]}| v r6 | ||< q)|| q)|rLd|}td||f d|S )Nr c 3 s | ]}| vV qd S r/ r1 )r cr r1 r4 r 5 r z/SSOProvider._load_sso_config.<locals>.<genexpr>r zSThe profile "%s" is configured to use SSO but is missing required configuration: %sr )r rA r all_SSO_CONFIG_VARSr~ r r )r^ r r r8 r+ missing_config_vars config_varmissingr1 rs r4 _load_sso_config/ s( z SSOProvider._load_sso_configc C sR | }|sd S t|d |d |d |d | jt| jd| jd}t| j|jdS )Nrm rV rn ro )r- )r r- r ) ry rO rF r rq r- r# r r< )r^ sso_config sso_fetcherr1 r1 r4 r K s zSSOProvider.loadr ) r| r} r~ r r r r r rp ru r` ry r r1 r1 r1 r4 rx s rx r r{ )SrO r loggingr r^ r r r collectionsr copyr hashlibr pathlibr dateutil.parserr dateutil.tzr r botocore.configloaderr botocore.compatr r r botocore.configr botocore.exceptionsr r r r r r r r r botocore.utilsr r r r r r getLoggerr| rL r rY r rE r r r r rG r r r r r r# r( rC rZ rr rz rk rD rB rI rp ru rJ rF rv rH rC rN rO rx r1 r1 r1 r4 <module> s VD ;' E1 P9-F t"*7* 7YXDdH