Class StubStsResponse

Namespace

DynaSharp.Testing

Assembly

DynaSharp.Testing.dll

A canned answer of a StubSts to AssumeRoleWithWebIdentity or AssumeRole. Credentials(AwsCredentials) and Error(string, string?, HttpStatusCode?) cover what STS says; for anything else, such as a body that is not XML or a status of its own, a test sets StatusCode and Body: new StubStsResponse { StatusCode = HttpStatusCode.ServiceUnavailable, Body = "busy" }.

public sealed class StubStsResponse

Inheritance

object

StubStsResponse

Inherited Members

object.GetType()

object.ToString()

object.Equals(object)

object.Equals(object, object)

object.ReferenceEquals(object, object)

object.GetHashCode()

Remarks

The bodies of AssumeRoleWithWebIdentity keep to what botocore parsed, byte for byte: sts_vectors.json in the tests of this library holds them. The credentials body is the sample of the AWS documentation with other values, so an element the sample has and a test does not choose, such as Audience or RequestId, keeps the value of the sample. The body of AssumeRole is the sample of its page without SourceIdentity and PackedPolicySize, which STS sends only for a source identity and a session policy, and a provider of this library sends neither. One response answers either action, see Body.

Constructors

StubStsResponse()

Initializes a new instance of the StubStsResponse class for a body of your own: HTTP 200 and an empty body unless a test sets them.

public StubStsResponse()

Properties

Body

Gets the response body, as text that goes out as UTF-8 and text/xml. Defaults to empty, which a provider takes for a broken answer. Can be any text. For Credentials(AwsCredentials) this is the AssumeRoleWithWebIdentityResponse for the role and the session of the sample of the AWS documentation. What a StubSts sends has AssumedRoleUser derived from the request instead, and is an AssumeRoleResponse for a request whose Action is AssumeRole.

public string Body { get; init; }

Property Value

string

StatusCode

Gets the HTTP status code. Defaults to OK.

public HttpStatusCode StatusCode { get; init; }

Property Value

HttpStatusCode

Methods

Credentials(AwsCredentials)

Creates the answer that hands out credentials: HTTP 200, and the given values in the sample body of the AWS documentation.

public static StubStsResponse Credentials(AwsCredentials credentials)

Parameters

credentials AwsCredentials

The credentials, with SessionToken, which STS always sends. Expiration may be null.

Returns

StubStsResponse

The response.

Remarks

The body follows the Action of each request: AssumeRoleResponse for AssumeRole, which AssumeRoleCredentialsProvider sends, and AssumeRoleWithWebIdentityResponse for any other. Arn and AssumedRoleId of AssumedRoleUser are derived from the role and the session name of each request. Expiration goes out in UTC, to the second, as yyyy-MM-ddTHH:mm:ssZ. Values are XML-escaped.

STS always sends an expiration, so credentials without one go out with 2100-01-01T00:00:00Z. A provider rejects credentials that have expired, refreshes in the background from 15 minutes before the expiration and makes every caller wait from 10 minutes before it, all on its clock, which can be the fake clock of a test. A fixed date that far ahead keeps all three out of a test that does not ask for them, on any clock, and it is the same in every run. A test of a refresh gives the expiration it needs, relative to its clock: clock.GetUtcNow().AddMinutes(14) starts one.

Exceptions

ArgumentNullException

credentials is null.

ArgumentException

credentials has no session token.

Error(string, string?, HttpStatusCode?)

Creates an ErrorResponse of STS, with the status botocore's model gives the code: 403 for IDPRejectedClaim and RegionDisabledException, and 400 for the rest. Of the codes the model does not list, AccessDenied, InvalidClientTokenId and SignatureDoesNotMatch are 403, as the real service sends them, and any other is 400. The body is the same for AssumeRoleWithWebIdentity and AssumeRole, whose models agree on the status of every code they share.

public static StubStsResponse Error(string code, string? message = null, HttpStatusCode? statusCode = null)

Parameters

code string

The error code, for example InvalidIdentityToken. It is XML-escaped.

message string

The message of the error. A provider leaves it out of its exception. It is XML-escaped.

statusCode HttpStatusCode?

The status of the response, in place of the one of the model.

Returns

StubStsResponse

The response.

Remarks

A provider reads the code, so a transient code such as IDPCommunicationError or Throttling is retried at 400 as well, and ExpiredTokenException reads the token file again. It also retries by the status, which is not known here for every code outside the model: the real service sends InternalFailure as 500, so a test of a 5xx or a 429 passes statusCode.

Exceptions

ArgumentException

code is null or empty.