[feature] Expose an API for sso process as a package

[jannawro]

Suggestion
Move the parts of the API responsible for the access token generation/putting it in .aws/sso/cache into packge/{some-name-for-package}.

Why?
I think it would be very useful to have an easy to import external dependency for the aws sso proccess. I myself am currently working on embeding this in a tool of mine to get rid of a call to aws cli with os.Exec. Currently struggling due to the abundance of pointers in aws-go-sdk which I have trouble to get my head around.

[theurichde]

Hi @jannawro! 👋🏼

Thanks for reaching out. It's cool to see, that you are interested in using the methods in your project.
I will see if I can make it generic, if that's the case, I will put the generic code into pkg, so you can use it in your project.

[jannawro]

Thank you for being so considerate :)

[theurichde]

@jannawro

I fiddled a bit around with the methods and moved the SSO methods to pkg.
You can try it out with go get github.com/theurichde/go-aws-sso@Expose_SSO_API

⚠️ Please be aware, that it is not final yet and just a first draft. But to get you started, it should be sufficient.

Let me know how it works 👍🏼

[jannawro]

Overall integrating with your api wasn't too hard. Though I am facing an issue(a bug possibly). My integration:

    oidcApi, ssoApi := InitClients(c.Region)
    clientInformation, _ := ProcessClientInformation(oidcApi, startUrl)
    rci := &sso.GetRoleCredentialsInput{
        AccountId: &c.AccountId,
        RoleName: &roleName,
        AccessToken: &clientInformation.AccessToken,
    }
    roleCredentials, err := ssoApi.GetRoleCredentials(rci)

My sso doesn't seem to get the right grant:

Could it be due to the fact that my org uses okta in addition to regular aws sso?

[theurichde]

Hm, nothing I can reproduce. A quick search brought me to that issue - maybe it is related to that?

[theurichde]

@jannawro Were you able to figure out the invalid_grant issue?

[theurichde]

I just had the same issue with a colleague. He has set the region for his SSO instance wrong. That gave him the exact same error you encountered.

[theurichde]

The SSO API is exposed and merged into main.