Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

No way of disabling sigv4 auth scheme (and signing) with AwsCodegen model #3958

Open
GJason88 opened this issue Dec 30, 2024 · 0 comments
Open

Comments

@GJason88
Copy link

GJason88 commented Dec 30, 2024

There is some logic that makes it so if there is an auth scheme for an operation in the model, it uses it.

AwsCodegen has a sigv4 auth scheme, which when isn't known about before its addition to a model, results in a NoMatchingAuthSchemeError:

source: NoMatchingAuthSchemeError(
    ExploredList {
        items: [
            ExploredAuthOption {
                scheme_id: AuthSchemeId {
                    scheme_id: "sigv4",
                },
                result: NoIdentityResolver,
            },
        ],
        truncated: false,
    },
),

The issue is that there is no easy way to disable the sigv4 auth scheme (and signing).

This may be relevant: https://github.com/smithy-lang/smithy-rs/pull/3087/files


We tried (without success) modifying the smithy model using optionalAuth like:

in model/main.smithy:

$version: "2.0"

namespace <namespace>

apply <operation> @optionalAuth

in smithy-build-template.json:

{
  "version": "1.0",
  "projections": {
    "<name>": {
      "imports": ["model/main.smithy"],
...

The only way we could get it working was using a gross hack to:

  • sign with dummy creds
  • remove the signature with an interceptor
#[derive(Debug)]
struct DropAuthHeaderIntercepter;
impl Intercept for DropAuthHeaderIntercepter {
    fn name(&self) -> &'static str {
        "DropAuthHeaderInterceptor"
    }
    fn modify_before_transmit(
        &self,
        context: &mut BeforeTransmitInterceptorContextMut<'_>,
        _runtime_components: &RuntimeComponents,
        _cfg: &mut ConfigBag,
    ) -> Result<(), BoxError> {
        context.request_mut().headers_mut().remove("Authorization");
        Ok(())
    }
}

and in the config builder:

builder()
    .interceptor(DropAuthHeaderIntercepter)
    .credentials_provider(Credentials::for_tests())
...
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant