7031 lines
427 KiB
XML
7031 lines
427 KiB
XML
<?xml version="1.0"?>
|
||
<doc>
|
||
<assembly>
|
||
<name>AWSSDK.SecurityToken</name>
|
||
</assembly>
|
||
<members>
|
||
<member name="T:Amazon.SecurityToken.AmazonSecurityTokenServiceClient">
|
||
<summary>
|
||
Implementation for accessing SecurityTokenService
|
||
|
||
Security Token Service
|
||
<para>
|
||
Security Token Service (STS) enables you to request temporary, limited-privilege credentials
|
||
for Identity and Access Management (IAM) users or for users that you authenticate
|
||
(federated users). This guide provides descriptions of the STS API. For more information
|
||
about using this service, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp.html">Temporary
|
||
Security Credentials</a>.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.AmazonSecurityTokenServiceClient.Amazon#Runtime#SharedInterfaces#ICoreAmazonSTS_WebIdentity#CredentialsFromAssumeRoleWithWebIdentityAuthentication(System.String,System.String,System.String,Amazon.Runtime.AssumeRoleWithWebIdentityCredentialsOptions)">
|
||
<summary>
|
||
<see cref="T:Amazon.Runtime.SharedInterfaces.ICoreAmazonSTS_WebIdentity"/>
|
||
</summary>
|
||
<param name="webIdentityToken">The OAuth 2.0 access token or OpenID Connect ID token that is provided by the identity provider.</param>
|
||
<param name="roleArn">The Amazon Resource Name (ARN) of the role to assume.</param>
|
||
<param name="roleSessionName">An identifier for the assumed role session.</param>
|
||
<param name="options">Options to be used in the call to AssumeRole.</param>
|
||
<returns>Immutable AssumeRoleCredentials</returns>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.AmazonSecurityTokenServiceClient.Amazon#Runtime#SharedInterfaces#ICoreAmazonSTS#CredentialsFromAssumeRoleAuthentication(System.String,System.String,Amazon.Runtime.AssumeRoleAWSCredentialsOptions)">
|
||
<summary>
|
||
<see cref="T:Amazon.Runtime.SharedInterfaces.ICoreAmazonSTS"/>
|
||
</summary>
|
||
<param name="roleArn"></param>
|
||
<param name="roleSessionName"></param>
|
||
<param name="options"></param>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.AmazonSecurityTokenServiceClient.#ctor">
|
||
<summary>
|
||
Constructs AmazonSecurityTokenServiceClient with the credentials loaded from the application's
|
||
default configuration, and if unsuccessful from the Instance Profile service on an EC2 instance.
|
||
|
||
Example App.config with credentials set.
|
||
<code>
|
||
<?xml version="1.0" encoding="utf-8" ?>
|
||
<configuration>
|
||
<appSettings>
|
||
<add key="AWSProfileName" value="AWS Default"/>
|
||
</appSettings>
|
||
</configuration>
|
||
</code>
|
||
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.AmazonSecurityTokenServiceClient.#ctor(Amazon.RegionEndpoint)">
|
||
<summary>
|
||
Constructs AmazonSecurityTokenServiceClient with the credentials loaded from the application's
|
||
default configuration, and if unsuccessful from the Instance Profile service on an EC2 instance.
|
||
|
||
Example App.config with credentials set.
|
||
<code>
|
||
<?xml version="1.0" encoding="utf-8" ?>
|
||
<configuration>
|
||
<appSettings>
|
||
<add key="AWSProfileName" value="AWS Default"/>
|
||
</appSettings>
|
||
</configuration>
|
||
</code>
|
||
|
||
</summary>
|
||
<param name="region">The region to connect.</param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.AmazonSecurityTokenServiceClient.#ctor(Amazon.SecurityToken.AmazonSecurityTokenServiceConfig)">
|
||
<summary>
|
||
Constructs AmazonSecurityTokenServiceClient with the credentials loaded from the application's
|
||
default configuration, and if unsuccessful from the Instance Profile service on an EC2 instance.
|
||
|
||
Example App.config with credentials set.
|
||
<code>
|
||
<?xml version="1.0" encoding="utf-8" ?>
|
||
<configuration>
|
||
<appSettings>
|
||
<add key="AWSProfileName" value="AWS Default"/>
|
||
</appSettings>
|
||
</configuration>
|
||
</code>
|
||
|
||
</summary>
|
||
<param name="config">The AmazonSecurityTokenServiceClient Configuration Object</param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.AmazonSecurityTokenServiceClient.#ctor(Amazon.Runtime.AWSCredentials)">
|
||
<summary>
|
||
Constructs AmazonSecurityTokenServiceClient with AWS Credentials
|
||
</summary>
|
||
<param name="credentials">AWS Credentials</param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.AmazonSecurityTokenServiceClient.#ctor(Amazon.Runtime.AWSCredentials,Amazon.RegionEndpoint)">
|
||
<summary>
|
||
Constructs AmazonSecurityTokenServiceClient with AWS Credentials
|
||
</summary>
|
||
<param name="credentials">AWS Credentials</param>
|
||
<param name="region">The region to connect.</param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.AmazonSecurityTokenServiceClient.#ctor(Amazon.Runtime.AWSCredentials,Amazon.SecurityToken.AmazonSecurityTokenServiceConfig)">
|
||
<summary>
|
||
Constructs AmazonSecurityTokenServiceClient with AWS Credentials and an
|
||
AmazonSecurityTokenServiceClient Configuration object.
|
||
</summary>
|
||
<param name="credentials">AWS Credentials</param>
|
||
<param name="clientConfig">The AmazonSecurityTokenServiceClient Configuration Object</param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.AmazonSecurityTokenServiceClient.#ctor(System.String,System.String)">
|
||
<summary>
|
||
Constructs AmazonSecurityTokenServiceClient with AWS Access Key ID and AWS Secret Key
|
||
</summary>
|
||
<param name="awsAccessKeyId">AWS Access Key ID</param>
|
||
<param name="awsSecretAccessKey">AWS Secret Access Key</param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.AmazonSecurityTokenServiceClient.#ctor(System.String,System.String,Amazon.RegionEndpoint)">
|
||
<summary>
|
||
Constructs AmazonSecurityTokenServiceClient with AWS Access Key ID and AWS Secret Key
|
||
</summary>
|
||
<param name="awsAccessKeyId">AWS Access Key ID</param>
|
||
<param name="awsSecretAccessKey">AWS Secret Access Key</param>
|
||
<param name="region">The region to connect.</param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.AmazonSecurityTokenServiceClient.#ctor(System.String,System.String,Amazon.SecurityToken.AmazonSecurityTokenServiceConfig)">
|
||
<summary>
|
||
Constructs AmazonSecurityTokenServiceClient with AWS Access Key ID, AWS Secret Key and an
|
||
AmazonSecurityTokenServiceClient Configuration object.
|
||
</summary>
|
||
<param name="awsAccessKeyId">AWS Access Key ID</param>
|
||
<param name="awsSecretAccessKey">AWS Secret Access Key</param>
|
||
<param name="clientConfig">The AmazonSecurityTokenServiceClient Configuration Object</param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.AmazonSecurityTokenServiceClient.#ctor(System.String,System.String,System.String)">
|
||
<summary>
|
||
Constructs AmazonSecurityTokenServiceClient with AWS Access Key ID and AWS Secret Key
|
||
</summary>
|
||
<param name="awsAccessKeyId">AWS Access Key ID</param>
|
||
<param name="awsSecretAccessKey">AWS Secret Access Key</param>
|
||
<param name="awsSessionToken">AWS Session Token</param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.AmazonSecurityTokenServiceClient.#ctor(System.String,System.String,System.String,Amazon.RegionEndpoint)">
|
||
<summary>
|
||
Constructs AmazonSecurityTokenServiceClient with AWS Access Key ID and AWS Secret Key
|
||
</summary>
|
||
<param name="awsAccessKeyId">AWS Access Key ID</param>
|
||
<param name="awsSecretAccessKey">AWS Secret Access Key</param>
|
||
<param name="awsSessionToken">AWS Session Token</param>
|
||
<param name="region">The region to connect.</param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.AmazonSecurityTokenServiceClient.#ctor(System.String,System.String,System.String,Amazon.SecurityToken.AmazonSecurityTokenServiceConfig)">
|
||
<summary>
|
||
Constructs AmazonSecurityTokenServiceClient with AWS Access Key ID, AWS Secret Key and an
|
||
AmazonSecurityTokenServiceClient Configuration object.
|
||
</summary>
|
||
<param name="awsAccessKeyId">AWS Access Key ID</param>
|
||
<param name="awsSecretAccessKey">AWS Secret Access Key</param>
|
||
<param name="awsSessionToken">AWS Session Token</param>
|
||
<param name="clientConfig">The AmazonSecurityTokenServiceClient Configuration Object</param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.AmazonSecurityTokenServiceClient.CreateSigner">
|
||
<summary>
|
||
Creates the signer for the service.
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.AmazonSecurityTokenServiceClient.CustomizeRuntimePipeline(Amazon.Runtime.Internal.RuntimePipeline)">
|
||
<summary>
|
||
Customize the pipeline
|
||
</summary>
|
||
<param name="pipeline"></param>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.AmazonSecurityTokenServiceClient.ServiceMetadata">
|
||
<summary>
|
||
Capture metadata for the service.
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.AmazonSecurityTokenServiceClient.Dispose(System.Boolean)">
|
||
<summary>
|
||
Disposes the service client.
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.AmazonSecurityTokenServiceClient.AssumeRole(Amazon.SecurityToken.Model.AssumeRoleRequest)">
|
||
<summary>
|
||
Returns a set of temporary security credentials that you can use to access Amazon
|
||
Web Services resources that you might not normally have access to. These temporary
|
||
credentials consist of an access key ID, a secret access key, and a security token.
|
||
Typically, you use <code>AssumeRole</code> within your account or for cross-account
|
||
access. For a comparison of <code>AssumeRole</code> with other API operations that
|
||
produce temporary credentials, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html">Requesting
|
||
Temporary Security Credentials</a> and <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#stsapi_comparison">Comparing
|
||
the Amazon Web Services STS API operations</a> in the <i>IAM User Guide</i>.
|
||
|
||
|
||
<para>
|
||
<b>Permissions</b>
|
||
</para>
|
||
|
||
<para>
|
||
The temporary security credentials created by <code>AssumeRole</code> can be used
|
||
to make API calls to any Amazon Web Services service with the following exception:
|
||
You cannot call the Amazon Web Services STS <code>GetFederationToken</code> or <code>GetSessionToken</code>
|
||
API operations.
|
||
</para>
|
||
|
||
<para>
|
||
(Optional) You can pass inline or managed <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">session
|
||
policies</a> to this operation. You can pass a single JSON policy document to use
|
||
as an inline session policy. You can also specify up to 10 managed policies to use
|
||
as managed session policies. The plaintext that you use for both inline and managed
|
||
session policies can't exceed 2,048 characters. Passing policies to this operation
|
||
returns new temporary credentials. The resulting session's permissions are the intersection
|
||
of the role's identity-based policy and the session policies. You can use the role's
|
||
temporary credentials in subsequent Amazon Web Services API calls to access resources
|
||
in the account that owns the role. You cannot use session policies to grant more permissions
|
||
than those allowed by the identity-based policy of the role that is being assumed.
|
||
For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">Session
|
||
Policies</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
When you create a role, you create two policies: A role trust policy that specifies
|
||
<i>who</i> can assume the role and a permissions policy that specifies <i>what</i>
|
||
can be done with the role. You specify the trusted principal who is allowed to assume
|
||
the role in the role trust policy.
|
||
</para>
|
||
|
||
<para>
|
||
To assume a role from a different account, your Amazon Web Services account must be
|
||
trusted by the role. The trust relationship is defined in the role's trust policy
|
||
when the role is created. That trust policy states which accounts are allowed to delegate
|
||
that access to users in the account.
|
||
</para>
|
||
|
||
<para>
|
||
A user who wants to access a role in a different account must also have permissions
|
||
that are delegated from the user account administrator. The administrator must attach
|
||
a policy that allows the user to call <code>AssumeRole</code> for the ARN of the role
|
||
in the other account.
|
||
</para>
|
||
|
||
<para>
|
||
To allow a user to assume a role in the same account, you can do either of the following:
|
||
</para>
|
||
<ul> <li>
|
||
<para>
|
||
Attach a policy to the user that allows the user to call <code>AssumeRole</code> (as
|
||
long as the role's trust policy trusts the account).
|
||
</para>
|
||
</li> <li>
|
||
<para>
|
||
Add the user as a principal directly in the role's trust policy.
|
||
</para>
|
||
</li> </ul>
|
||
<para>
|
||
You can do either because the role’s trust policy acts as an IAM resource-based policy.
|
||
When a resource-based policy grants access to a principal in the same account, no
|
||
additional identity-based policy is required. For more information about trust policies
|
||
and resource-based policies, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html">IAM
|
||
Policies</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
<b>Tags</b>
|
||
</para>
|
||
|
||
<para>
|
||
(Optional) You can pass tag key-value pairs to your session. These tags are called
|
||
session tags. For more information about session tags, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html">Passing
|
||
Session Tags in STS</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
An administrator must grant you the permissions necessary to pass session tags. The
|
||
administrator can also create granular permissions to allow you to pass only specific
|
||
session tags. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_attribute-based-access-control.html">Tutorial:
|
||
Using Tags for Attribute-Based Access Control</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
You can set the session tags as transitive. Transitive tags persist during role chaining.
|
||
For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html#id_session-tags_role-chaining">Chaining
|
||
Roles with Session Tags</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
<b>Using MFA with AssumeRole</b>
|
||
</para>
|
||
|
||
<para>
|
||
(Optional) You can include multi-factor authentication (MFA) information when you
|
||
call <code>AssumeRole</code>. This is useful for cross-account scenarios to ensure
|
||
that the user that assumes the role has been authenticated with an Amazon Web Services
|
||
MFA device. In that scenario, the trust policy of the role being assumed includes
|
||
a condition that tests for MFA authentication. If the caller does not include valid
|
||
MFA information, the request to assume the role is denied. The condition in a trust
|
||
policy that tests for MFA authentication might look like the following example.
|
||
</para>
|
||
|
||
<para>
|
||
<code>"Condition": {"Bool": {"aws:MultiFactorAuthPresent": true}}</code>
|
||
</para>
|
||
|
||
<para>
|
||
For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/MFAProtectedAPI.html">Configuring
|
||
MFA-Protected API Access</a> in the <i>IAM User Guide</i> guide.
|
||
</para>
|
||
|
||
<para>
|
||
To use MFA with <code>AssumeRole</code>, you pass values for the <code>SerialNumber</code>
|
||
and <code>TokenCode</code> parameters. The <code>SerialNumber</code> value identifies
|
||
the user's hardware or virtual MFA device. The <code>TokenCode</code> is the time-based
|
||
one-time password (TOTP) that the MFA device produces.
|
||
</para>
|
||
</summary>
|
||
<param name="request">Container for the necessary parameters to execute the AssumeRole service method.</param>
|
||
|
||
<returns>The response from the AssumeRole service method, as returned by SecurityTokenService.</returns>
|
||
<exception cref="T:Amazon.SecurityToken.Model.ExpiredTokenException">
|
||
The web identity token that was passed is expired or is not valid. Get a new identity
|
||
token from the identity provider and then retry the request.
|
||
</exception>
|
||
<exception cref="T:Amazon.SecurityToken.Model.MalformedPolicyDocumentException">
|
||
The request was rejected because the policy document was malformed. The error message
|
||
describes the specific error.
|
||
</exception>
|
||
<exception cref="T:Amazon.SecurityToken.Model.PackedPolicyTooLargeException">
|
||
The request was rejected because the total packed size of the session policies and
|
||
session tags combined was too large. An Amazon Web Services conversion compresses
|
||
the session policy document, session policy ARNs, and session tags into a packed binary
|
||
format that has a separate limit. The error message indicates by percentage how close
|
||
the policies and tags are to the upper size limit. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html">Passing
|
||
Session Tags in STS</a> in the <i>IAM User Guide</i>.
|
||
|
||
|
||
<para>
|
||
You could receive this error even though you meet other defined session policy and
|
||
session tag limits. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html#reference_iam-limits-entity-length">IAM
|
||
and STS Entity Character Limits</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
</exception>
|
||
<exception cref="T:Amazon.SecurityToken.Model.RegionDisabledException">
|
||
STS is not activated in the requested region for the account that is being asked to
|
||
generate credentials. The account administrator must use the IAM console to activate
|
||
STS in that region. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html">Activating
|
||
and Deactivating Amazon Web Services STS in an Amazon Web Services Region</a> in the
|
||
<i>IAM User Guide</i>.
|
||
</exception>
|
||
<seealso href="http://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/AssumeRole">REST API Reference for AssumeRole Operation</seealso>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.AmazonSecurityTokenServiceClient.BeginAssumeRole(Amazon.SecurityToken.Model.AssumeRoleRequest,System.AsyncCallback,System.Object)">
|
||
<summary>
|
||
Initiates the asynchronous execution of the AssumeRole operation.
|
||
</summary>
|
||
|
||
<param name="request">Container for the necessary parameters to execute the AssumeRole operation on AmazonSecurityTokenServiceClient.</param>
|
||
<param name="callback">An AsyncCallback delegate that is invoked when the operation completes.</param>
|
||
<param name="state">A user-defined state object that is passed to the callback procedure. Retrieve this object from within the callback
|
||
procedure using the AsyncState property.</param>
|
||
|
||
<returns>An IAsyncResult that can be used to poll or wait for results, or both; this value is also needed when invoking EndAssumeRole
|
||
operation.</returns>
|
||
<seealso href="http://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/AssumeRole">REST API Reference for AssumeRole Operation</seealso>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.AmazonSecurityTokenServiceClient.EndAssumeRole(System.IAsyncResult)">
|
||
<summary>
|
||
Finishes the asynchronous execution of the AssumeRole operation.
|
||
</summary>
|
||
|
||
<param name="asyncResult">The IAsyncResult returned by the call to BeginAssumeRole.</param>
|
||
|
||
<returns>Returns a AssumeRoleResult from SecurityTokenService.</returns>
|
||
<seealso href="http://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/AssumeRole">REST API Reference for AssumeRole Operation</seealso>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.AmazonSecurityTokenServiceClient.AssumeRoleWithSAML(Amazon.SecurityToken.Model.AssumeRoleWithSAMLRequest)">
|
||
<summary>
|
||
Returns a set of temporary security credentials for users who have been authenticated
|
||
via a SAML authentication response. This operation provides a mechanism for tying
|
||
an enterprise identity store or directory to role-based Amazon Web Services access
|
||
without user-specific credentials or configuration. For a comparison of <code>AssumeRoleWithSAML</code>
|
||
with the other API operations that produce temporary credentials, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html">Requesting
|
||
Temporary Security Credentials</a> and <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#stsapi_comparison">Comparing
|
||
the Amazon Web Services STS API operations</a> in the <i>IAM User Guide</i>.
|
||
|
||
|
||
<para>
|
||
The temporary security credentials returned by this operation consist of an access
|
||
key ID, a secret access key, and a security token. Applications can use these temporary
|
||
security credentials to sign calls to Amazon Web Services services.
|
||
</para>
|
||
|
||
<para>
|
||
<b>Session Duration</b>
|
||
</para>
|
||
|
||
<para>
|
||
By default, the temporary security credentials created by <code>AssumeRoleWithSAML</code>
|
||
last for one hour. However, you can use the optional <code>DurationSeconds</code>
|
||
parameter to specify the duration of your session. Your role session lasts for the
|
||
duration that you specify, or until the time specified in the SAML authentication
|
||
response's <code>SessionNotOnOrAfter</code> value, whichever is shorter. You can provide
|
||
a <code>DurationSeconds</code> value from 900 seconds (15 minutes) up to the maximum
|
||
session duration setting for the role. This setting can have a value from 1 hour to
|
||
12 hours. To learn how to view the maximum value for your role, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html#id_roles_use_view-role-max-session">View
|
||
the Maximum Session Duration Setting for a Role</a> in the <i>IAM User Guide</i>.
|
||
The maximum session duration limit applies when you use the <code>AssumeRole*</code>
|
||
API operations or the <code>assume-role*</code> CLI commands. However the limit does
|
||
not apply when you use those operations to create a console URL. For more information,
|
||
see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html">Using
|
||
IAM Roles</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
<note>
|
||
<para>
|
||
<a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#iam-term-role-chaining">Role
|
||
chaining</a> limits your CLI or Amazon Web Services API role session to a maximum
|
||
of one hour. When you use the <code>AssumeRole</code> API operation to assume a role,
|
||
you can specify the duration of your role session with the <code>DurationSeconds</code>
|
||
parameter. You can specify a parameter value of up to 43200 seconds (12 hours), depending
|
||
on the maximum session duration setting for your role. However, if you assume a role
|
||
using role chaining and provide a <code>DurationSeconds</code> parameter value greater
|
||
than one hour, the operation fails.
|
||
</para>
|
||
</note>
|
||
<para>
|
||
<b>Permissions</b>
|
||
</para>
|
||
|
||
<para>
|
||
The temporary security credentials created by <code>AssumeRoleWithSAML</code> can
|
||
be used to make API calls to any Amazon Web Services service with the following exception:
|
||
you cannot call the STS <code>GetFederationToken</code> or <code>GetSessionToken</code>
|
||
API operations.
|
||
</para>
|
||
|
||
<para>
|
||
(Optional) You can pass inline or managed <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">session
|
||
policies</a> to this operation. You can pass a single JSON policy document to use
|
||
as an inline session policy. You can also specify up to 10 managed policies to use
|
||
as managed session policies. The plaintext that you use for both inline and managed
|
||
session policies can't exceed 2,048 characters. Passing policies to this operation
|
||
returns new temporary credentials. The resulting session's permissions are the intersection
|
||
of the role's identity-based policy and the session policies. You can use the role's
|
||
temporary credentials in subsequent Amazon Web Services API calls to access resources
|
||
in the account that owns the role. You cannot use session policies to grant more permissions
|
||
than those allowed by the identity-based policy of the role that is being assumed.
|
||
For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">Session
|
||
Policies</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
Calling <code>AssumeRoleWithSAML</code> does not require the use of Amazon Web Services
|
||
security credentials. The identity of the caller is validated by using keys in the
|
||
metadata document that is uploaded for the SAML provider entity for your identity
|
||
provider.
|
||
</para>
|
||
<important>
|
||
<para>
|
||
Calling <code>AssumeRoleWithSAML</code> can result in an entry in your CloudTrail
|
||
logs. The entry includes the value in the <code>NameID</code> element of the SAML
|
||
assertion. We recommend that you use a <code>NameIDType</code> that is not associated
|
||
with any personally identifiable information (PII). For example, you could instead
|
||
use the persistent identifier (<code>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</code>).
|
||
</para>
|
||
</important>
|
||
<para>
|
||
<b>Tags</b>
|
||
</para>
|
||
|
||
<para>
|
||
(Optional) You can configure your IdP to pass attributes into your SAML assertion
|
||
as session tags. Each session tag consists of a key name and an associated value.
|
||
For more information about session tags, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html">Passing
|
||
Session Tags in STS</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
You can pass up to 50 session tags. The plaintext session tag keys can’t exceed 128
|
||
characters and the values can’t exceed 256 characters. For these and additional limits,
|
||
see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-limits.html#reference_iam-limits-entity-length">IAM
|
||
and STS Character Limits</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
<note>
|
||
<para>
|
||
An Amazon Web Services conversion compresses the passed session policies and session
|
||
tags into a packed binary format that has a separate limit. Your request can fail
|
||
for this limit even if your plaintext meets the other requirements. The <code>PackedPolicySize</code>
|
||
response element indicates by percentage how close the policies and tags for your
|
||
request are to the upper size limit.
|
||
</para>
|
||
</note>
|
||
<para>
|
||
You can pass a session tag with the same key as a tag that is attached to the role.
|
||
When you do, session tags override the role's tags with the same key.
|
||
</para>
|
||
|
||
<para>
|
||
An administrator must grant you the permissions necessary to pass session tags. The
|
||
administrator can also create granular permissions to allow you to pass only specific
|
||
session tags. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_attribute-based-access-control.html">Tutorial:
|
||
Using Tags for Attribute-Based Access Control</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
You can set the session tags as transitive. Transitive tags persist during role chaining.
|
||
For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html#id_session-tags_role-chaining">Chaining
|
||
Roles with Session Tags</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
<b>SAML Configuration</b>
|
||
</para>
|
||
|
||
<para>
|
||
Before your application can call <code>AssumeRoleWithSAML</code>, you must configure
|
||
your SAML identity provider (IdP) to issue the claims required by Amazon Web Services.
|
||
Additionally, you must use Identity and Access Management (IAM) to create a SAML provider
|
||
entity in your Amazon Web Services account that represents your identity provider.
|
||
You must also create an IAM role that specifies this SAML provider in its trust policy.
|
||
|
||
</para>
|
||
|
||
<para>
|
||
For more information, see the following resources:
|
||
</para>
|
||
<ul> <li>
|
||
<para>
|
||
<a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_saml.html">About
|
||
SAML 2.0-based Federation</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
</li> <li>
|
||
<para>
|
||
<a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_saml.html">Creating
|
||
SAML Identity Providers</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
</li> <li>
|
||
<para>
|
||
<a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_saml_relying-party.html">Configuring
|
||
a Relying Party and Claims</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
</li> <li>
|
||
<para>
|
||
<a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-idp_saml.html">Creating
|
||
a Role for SAML 2.0 Federation</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
</li> </ul>
|
||
</summary>
|
||
<param name="request">Container for the necessary parameters to execute the AssumeRoleWithSAML service method.</param>
|
||
|
||
<returns>The response from the AssumeRoleWithSAML service method, as returned by SecurityTokenService.</returns>
|
||
<exception cref="T:Amazon.SecurityToken.Model.ExpiredTokenException">
|
||
The web identity token that was passed is expired or is not valid. Get a new identity
|
||
token from the identity provider and then retry the request.
|
||
</exception>
|
||
<exception cref="T:Amazon.SecurityToken.Model.IDPRejectedClaimException">
|
||
The identity provider (IdP) reported that authentication failed. This might be because
|
||
the claim is invalid.
|
||
|
||
|
||
<para>
|
||
If this error is returned for the <code>AssumeRoleWithWebIdentity</code> operation,
|
||
it can also mean that the claim has expired or has been explicitly revoked.
|
||
</para>
|
||
</exception>
|
||
<exception cref="T:Amazon.SecurityToken.Model.InvalidIdentityTokenException">
|
||
The web identity token that was passed could not be validated by Amazon Web Services.
|
||
Get a new identity token from the identity provider and then retry the request.
|
||
</exception>
|
||
<exception cref="T:Amazon.SecurityToken.Model.MalformedPolicyDocumentException">
|
||
The request was rejected because the policy document was malformed. The error message
|
||
describes the specific error.
|
||
</exception>
|
||
<exception cref="T:Amazon.SecurityToken.Model.PackedPolicyTooLargeException">
|
||
The request was rejected because the total packed size of the session policies and
|
||
session tags combined was too large. An Amazon Web Services conversion compresses
|
||
the session policy document, session policy ARNs, and session tags into a packed binary
|
||
format that has a separate limit. The error message indicates by percentage how close
|
||
the policies and tags are to the upper size limit. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html">Passing
|
||
Session Tags in STS</a> in the <i>IAM User Guide</i>.
|
||
|
||
|
||
<para>
|
||
You could receive this error even though you meet other defined session policy and
|
||
session tag limits. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html#reference_iam-limits-entity-length">IAM
|
||
and STS Entity Character Limits</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
</exception>
|
||
<exception cref="T:Amazon.SecurityToken.Model.RegionDisabledException">
|
||
STS is not activated in the requested region for the account that is being asked to
|
||
generate credentials. The account administrator must use the IAM console to activate
|
||
STS in that region. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html">Activating
|
||
and Deactivating Amazon Web Services STS in an Amazon Web Services Region</a> in the
|
||
<i>IAM User Guide</i>.
|
||
</exception>
|
||
<seealso href="http://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/AssumeRoleWithSAML">REST API Reference for AssumeRoleWithSAML Operation</seealso>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.AmazonSecurityTokenServiceClient.BeginAssumeRoleWithSAML(Amazon.SecurityToken.Model.AssumeRoleWithSAMLRequest,System.AsyncCallback,System.Object)">
|
||
<summary>
|
||
Initiates the asynchronous execution of the AssumeRoleWithSAML operation.
|
||
</summary>
|
||
|
||
<param name="request">Container for the necessary parameters to execute the AssumeRoleWithSAML operation on AmazonSecurityTokenServiceClient.</param>
|
||
<param name="callback">An AsyncCallback delegate that is invoked when the operation completes.</param>
|
||
<param name="state">A user-defined state object that is passed to the callback procedure. Retrieve this object from within the callback
|
||
procedure using the AsyncState property.</param>
|
||
|
||
<returns>An IAsyncResult that can be used to poll or wait for results, or both; this value is also needed when invoking EndAssumeRoleWithSAML
|
||
operation.</returns>
|
||
<seealso href="http://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/AssumeRoleWithSAML">REST API Reference for AssumeRoleWithSAML Operation</seealso>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.AmazonSecurityTokenServiceClient.EndAssumeRoleWithSAML(System.IAsyncResult)">
|
||
<summary>
|
||
Finishes the asynchronous execution of the AssumeRoleWithSAML operation.
|
||
</summary>
|
||
|
||
<param name="asyncResult">The IAsyncResult returned by the call to BeginAssumeRoleWithSAML.</param>
|
||
|
||
<returns>Returns a AssumeRoleWithSAMLResult from SecurityTokenService.</returns>
|
||
<seealso href="http://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/AssumeRoleWithSAML">REST API Reference for AssumeRoleWithSAML Operation</seealso>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.AmazonSecurityTokenServiceClient.AssumeRoleWithWebIdentity(Amazon.SecurityToken.Model.AssumeRoleWithWebIdentityRequest)">
|
||
<summary>
|
||
Returns a set of temporary security credentials for users who have been authenticated
|
||
in a mobile or web application with a web identity provider. Example providers include
|
||
the OAuth 2.0 providers Login with Amazon and Facebook, or any OpenID Connect-compatible
|
||
identity provider such as Google or <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-identity.html">Amazon
|
||
Cognito federated identities</a>.
|
||
|
||
<note>
|
||
<para>
|
||
For mobile applications, we recommend that you use Amazon Cognito. You can use Amazon
|
||
Cognito with the <a href="http://aws.amazon.com/sdkforios/">Amazon Web Services SDK
|
||
for iOS Developer Guide</a> and the <a href="http://aws.amazon.com/sdkforandroid/">Amazon
|
||
Web Services SDK for Android Developer Guide</a> to uniquely identify a user. You
|
||
can also supply the user with a consistent identity throughout the lifetime of an
|
||
application.
|
||
</para>
|
||
|
||
<para>
|
||
To learn more about Amazon Cognito, see <a href="https://docs.aws.amazon.com/mobile/sdkforandroid/developerguide/cognito-auth.html#d0e840">Amazon
|
||
Cognito Overview</a> in <i>Amazon Web Services SDK for Android Developer Guide</i>
|
||
and <a href="https://docs.aws.amazon.com/mobile/sdkforios/developerguide/cognito-auth.html#d0e664">Amazon
|
||
Cognito Overview</a> in the <i>Amazon Web Services SDK for iOS Developer Guide</i>.
|
||
</para>
|
||
</note>
|
||
<para>
|
||
Calling <code>AssumeRoleWithWebIdentity</code> does not require the use of Amazon
|
||
Web Services security credentials. Therefore, you can distribute an application (for
|
||
example, on mobile devices) that requests temporary security credentials without including
|
||
long-term Amazon Web Services credentials in the application. You also don't need
|
||
to deploy server-based proxy services that use long-term Amazon Web Services credentials.
|
||
Instead, the identity of the caller is validated by using a token from the web identity
|
||
provider. For a comparison of <code>AssumeRoleWithWebIdentity</code> with the other
|
||
API operations that produce temporary credentials, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html">Requesting
|
||
Temporary Security Credentials</a> and <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#stsapi_comparison">Comparing
|
||
the Amazon Web Services STS API operations</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
The temporary security credentials returned by this API consist of an access key ID,
|
||
a secret access key, and a security token. Applications can use these temporary security
|
||
credentials to sign calls to Amazon Web Services service API operations.
|
||
</para>
|
||
|
||
<para>
|
||
<b>Session Duration</b>
|
||
</para>
|
||
|
||
<para>
|
||
By default, the temporary security credentials created by <code>AssumeRoleWithWebIdentity</code>
|
||
last for one hour. However, you can use the optional <code>DurationSeconds</code>
|
||
parameter to specify the duration of your session. You can provide a value from 900
|
||
seconds (15 minutes) up to the maximum session duration setting for the role. This
|
||
setting can have a value from 1 hour to 12 hours. To learn how to view the maximum
|
||
value for your role, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html#id_roles_use_view-role-max-session">View
|
||
the Maximum Session Duration Setting for a Role</a> in the <i>IAM User Guide</i>.
|
||
The maximum session duration limit applies when you use the <code>AssumeRole*</code>
|
||
API operations or the <code>assume-role*</code> CLI commands. However the limit does
|
||
not apply when you use those operations to create a console URL. For more information,
|
||
see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html">Using
|
||
IAM Roles</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
<b>Permissions</b>
|
||
</para>
|
||
|
||
<para>
|
||
The temporary security credentials created by <code>AssumeRoleWithWebIdentity</code>
|
||
can be used to make API calls to any Amazon Web Services service with the following
|
||
exception: you cannot call the STS <code>GetFederationToken</code> or <code>GetSessionToken</code>
|
||
API operations.
|
||
</para>
|
||
|
||
<para>
|
||
(Optional) You can pass inline or managed <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">session
|
||
policies</a> to this operation. You can pass a single JSON policy document to use
|
||
as an inline session policy. You can also specify up to 10 managed policies to use
|
||
as managed session policies. The plaintext that you use for both inline and managed
|
||
session policies can't exceed 2,048 characters. Passing policies to this operation
|
||
returns new temporary credentials. The resulting session's permissions are the intersection
|
||
of the role's identity-based policy and the session policies. You can use the role's
|
||
temporary credentials in subsequent Amazon Web Services API calls to access resources
|
||
in the account that owns the role. You cannot use session policies to grant more permissions
|
||
than those allowed by the identity-based policy of the role that is being assumed.
|
||
For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">Session
|
||
Policies</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
<b>Tags</b>
|
||
</para>
|
||
|
||
<para>
|
||
(Optional) You can configure your IdP to pass attributes into your web identity token
|
||
as session tags. Each session tag consists of a key name and an associated value.
|
||
For more information about session tags, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html">Passing
|
||
Session Tags in STS</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
You can pass up to 50 session tags. The plaintext session tag keys can’t exceed 128
|
||
characters and the values can’t exceed 256 characters. For these and additional limits,
|
||
see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-limits.html#reference_iam-limits-entity-length">IAM
|
||
and STS Character Limits</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
<note>
|
||
<para>
|
||
An Amazon Web Services conversion compresses the passed session policies and session
|
||
tags into a packed binary format that has a separate limit. Your request can fail
|
||
for this limit even if your plaintext meets the other requirements. The <code>PackedPolicySize</code>
|
||
response element indicates by percentage how close the policies and tags for your
|
||
request are to the upper size limit.
|
||
</para>
|
||
</note>
|
||
<para>
|
||
You can pass a session tag with the same key as a tag that is attached to the role.
|
||
When you do, the session tag overrides the role tag with the same key.
|
||
</para>
|
||
|
||
<para>
|
||
An administrator must grant you the permissions necessary to pass session tags. The
|
||
administrator can also create granular permissions to allow you to pass only specific
|
||
session tags. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_attribute-based-access-control.html">Tutorial:
|
||
Using Tags for Attribute-Based Access Control</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
You can set the session tags as transitive. Transitive tags persist during role chaining.
|
||
For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html#id_session-tags_role-chaining">Chaining
|
||
Roles with Session Tags</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
<b>Identities</b>
|
||
</para>
|
||
|
||
<para>
|
||
Before your application can call <code>AssumeRoleWithWebIdentity</code>, you must
|
||
have an identity token from a supported identity provider and create a role that the
|
||
application can assume. The role that your application assumes must trust the identity
|
||
provider that is associated with the identity token. In other words, the identity
|
||
provider must be specified in the role's trust policy.
|
||
</para>
|
||
<important>
|
||
<para>
|
||
Calling <code>AssumeRoleWithWebIdentity</code> can result in an entry in your CloudTrail
|
||
logs. The entry includes the <a href="http://openid.net/specs/openid-connect-core-1_0.html#Claims">Subject</a>
|
||
of the provided web identity token. We recommend that you avoid using any personally
|
||
identifiable information (PII) in this field. For example, you could instead use a
|
||
GUID or a pairwise identifier, as <a href="http://openid.net/specs/openid-connect-core-1_0.html#SubjectIDTypes">suggested
|
||
in the OIDC specification</a>.
|
||
</para>
|
||
</important>
|
||
<para>
|
||
For more information about how to use web identity federation and the <code>AssumeRoleWithWebIdentity</code>
|
||
API, see the following resources:
|
||
</para>
|
||
<ul> <li>
|
||
<para>
|
||
<a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_oidc_manual.html">Using
|
||
Web Identity Federation API Operations for Mobile Apps</a> and <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#api_assumerolewithwebidentity">Federation
|
||
Through a Web-based Identity Provider</a>.
|
||
</para>
|
||
</li> <li>
|
||
<para>
|
||
<a href="https://aws.amazon.com/blogs/aws/the-aws-web-identity-federation-playground/">
|
||
Web Identity Federation Playground</a>. Walk through the process of authenticating
|
||
through Login with Amazon, Facebook, or Google, getting temporary security credentials,
|
||
and then using those credentials to make a request to Amazon Web Services.
|
||
</para>
|
||
</li> <li>
|
||
<para>
|
||
<a href="http://aws.amazon.com/sdkforios/">Amazon Web Services SDK for iOS Developer
|
||
Guide</a> and <a href="http://aws.amazon.com/sdkforandroid/">Amazon Web Services SDK
|
||
for Android Developer Guide</a>. These toolkits contain sample apps that show how
|
||
to invoke the identity providers. The toolkits then show how to use the information
|
||
from these providers to get and use temporary security credentials.
|
||
</para>
|
||
</li> <li>
|
||
<para>
|
||
<a href="http://aws.amazon.com/articles/web-identity-federation-with-mobile-applications">Web
|
||
Identity Federation with Mobile Applications</a>. This article discusses web identity
|
||
federation and shows an example of how to use web identity federation to get access
|
||
to content in Amazon S3.
|
||
</para>
|
||
</li> </ul>
|
||
</summary>
|
||
<param name="request">Container for the necessary parameters to execute the AssumeRoleWithWebIdentity service method.</param>
|
||
|
||
<returns>The response from the AssumeRoleWithWebIdentity service method, as returned by SecurityTokenService.</returns>
|
||
<exception cref="T:Amazon.SecurityToken.Model.ExpiredTokenException">
|
||
The web identity token that was passed is expired or is not valid. Get a new identity
|
||
token from the identity provider and then retry the request.
|
||
</exception>
|
||
<exception cref="T:Amazon.SecurityToken.Model.IDPCommunicationErrorException">
|
||
The request could not be fulfilled because the identity provider (IDP) that was asked
|
||
to verify the incoming identity token could not be reached. This is often a transient
|
||
error caused by network conditions. Retry the request a limited number of times so
|
||
that you don't exceed the request rate. If the error persists, the identity provider
|
||
might be down or not responding.
|
||
</exception>
|
||
<exception cref="T:Amazon.SecurityToken.Model.IDPRejectedClaimException">
|
||
The identity provider (IdP) reported that authentication failed. This might be because
|
||
the claim is invalid.
|
||
|
||
|
||
<para>
|
||
If this error is returned for the <code>AssumeRoleWithWebIdentity</code> operation,
|
||
it can also mean that the claim has expired or has been explicitly revoked.
|
||
</para>
|
||
</exception>
|
||
<exception cref="T:Amazon.SecurityToken.Model.InvalidIdentityTokenException">
|
||
The web identity token that was passed could not be validated by Amazon Web Services.
|
||
Get a new identity token from the identity provider and then retry the request.
|
||
</exception>
|
||
<exception cref="T:Amazon.SecurityToken.Model.MalformedPolicyDocumentException">
|
||
The request was rejected because the policy document was malformed. The error message
|
||
describes the specific error.
|
||
</exception>
|
||
<exception cref="T:Amazon.SecurityToken.Model.PackedPolicyTooLargeException">
|
||
The request was rejected because the total packed size of the session policies and
|
||
session tags combined was too large. An Amazon Web Services conversion compresses
|
||
the session policy document, session policy ARNs, and session tags into a packed binary
|
||
format that has a separate limit. The error message indicates by percentage how close
|
||
the policies and tags are to the upper size limit. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html">Passing
|
||
Session Tags in STS</a> in the <i>IAM User Guide</i>.
|
||
|
||
|
||
<para>
|
||
You could receive this error even though you meet other defined session policy and
|
||
session tag limits. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html#reference_iam-limits-entity-length">IAM
|
||
and STS Entity Character Limits</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
</exception>
|
||
<exception cref="T:Amazon.SecurityToken.Model.RegionDisabledException">
|
||
STS is not activated in the requested region for the account that is being asked to
|
||
generate credentials. The account administrator must use the IAM console to activate
|
||
STS in that region. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html">Activating
|
||
and Deactivating Amazon Web Services STS in an Amazon Web Services Region</a> in the
|
||
<i>IAM User Guide</i>.
|
||
</exception>
|
||
<seealso href="http://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/AssumeRoleWithWebIdentity">REST API Reference for AssumeRoleWithWebIdentity Operation</seealso>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.AmazonSecurityTokenServiceClient.BeginAssumeRoleWithWebIdentity(Amazon.SecurityToken.Model.AssumeRoleWithWebIdentityRequest,System.AsyncCallback,System.Object)">
|
||
<summary>
|
||
Initiates the asynchronous execution of the AssumeRoleWithWebIdentity operation.
|
||
</summary>
|
||
|
||
<param name="request">Container for the necessary parameters to execute the AssumeRoleWithWebIdentity operation on AmazonSecurityTokenServiceClient.</param>
|
||
<param name="callback">An AsyncCallback delegate that is invoked when the operation completes.</param>
|
||
<param name="state">A user-defined state object that is passed to the callback procedure. Retrieve this object from within the callback
|
||
procedure using the AsyncState property.</param>
|
||
|
||
<returns>An IAsyncResult that can be used to poll or wait for results, or both; this value is also needed when invoking EndAssumeRoleWithWebIdentity
|
||
operation.</returns>
|
||
<seealso href="http://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/AssumeRoleWithWebIdentity">REST API Reference for AssumeRoleWithWebIdentity Operation</seealso>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.AmazonSecurityTokenServiceClient.EndAssumeRoleWithWebIdentity(System.IAsyncResult)">
|
||
<summary>
|
||
Finishes the asynchronous execution of the AssumeRoleWithWebIdentity operation.
|
||
</summary>
|
||
|
||
<param name="asyncResult">The IAsyncResult returned by the call to BeginAssumeRoleWithWebIdentity.</param>
|
||
|
||
<returns>Returns a AssumeRoleWithWebIdentityResult from SecurityTokenService.</returns>
|
||
<seealso href="http://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/AssumeRoleWithWebIdentity">REST API Reference for AssumeRoleWithWebIdentity Operation</seealso>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.AmazonSecurityTokenServiceClient.DecodeAuthorizationMessage(Amazon.SecurityToken.Model.DecodeAuthorizationMessageRequest)">
|
||
<summary>
|
||
Decodes additional information about the authorization status of a request from an
|
||
encoded message returned in response to an Amazon Web Services request.
|
||
|
||
|
||
<para>
|
||
For example, if a user is not authorized to perform an operation that he or she has
|
||
requested, the request returns a <code>Client.UnauthorizedOperation</code> response
|
||
(an HTTP 403 response). Some Amazon Web Services operations additionally return an
|
||
encoded message that can provide details about this authorization failure.
|
||
</para>
|
||
<note>
|
||
<para>
|
||
Only certain Amazon Web Services operations return an encoded authorization message.
|
||
The documentation for an individual operation indicates whether that operation returns
|
||
an encoded message in addition to returning an HTTP code.
|
||
</para>
|
||
</note>
|
||
<para>
|
||
The message is encoded because the details of the authorization status can contain
|
||
privileged information that the user who requested the operation should not see. To
|
||
decode an authorization status message, a user must be granted permissions through
|
||
an IAM <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html">policy</a>
|
||
to request the <code>DecodeAuthorizationMessage</code> (<code>sts:DecodeAuthorizationMessage</code>)
|
||
action.
|
||
</para>
|
||
|
||
<para>
|
||
The decoded message includes the following type of information:
|
||
</para>
|
||
<ul> <li>
|
||
<para>
|
||
Whether the request was denied due to an explicit deny or due to the absence of an
|
||
explicit allow. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html#policy-eval-denyallow">Determining
|
||
Whether a Request is Allowed or Denied</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
</li> <li>
|
||
<para>
|
||
The principal who made the request.
|
||
</para>
|
||
</li> <li>
|
||
<para>
|
||
The requested action.
|
||
</para>
|
||
</li> <li>
|
||
<para>
|
||
The requested resource.
|
||
</para>
|
||
</li> <li>
|
||
<para>
|
||
The values of condition keys in the context of the user's request.
|
||
</para>
|
||
</li> </ul>
|
||
</summary>
|
||
<param name="request">Container for the necessary parameters to execute the DecodeAuthorizationMessage service method.</param>
|
||
|
||
<returns>The response from the DecodeAuthorizationMessage service method, as returned by SecurityTokenService.</returns>
|
||
<exception cref="T:Amazon.SecurityToken.Model.InvalidAuthorizationMessageException">
|
||
The error returned if the message passed to <code>DecodeAuthorizationMessage</code>
|
||
was invalid. This can happen if the token contains invalid characters, such as linebreaks.
|
||
</exception>
|
||
<seealso href="http://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/DecodeAuthorizationMessage">REST API Reference for DecodeAuthorizationMessage Operation</seealso>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.AmazonSecurityTokenServiceClient.BeginDecodeAuthorizationMessage(Amazon.SecurityToken.Model.DecodeAuthorizationMessageRequest,System.AsyncCallback,System.Object)">
|
||
<summary>
|
||
Initiates the asynchronous execution of the DecodeAuthorizationMessage operation.
|
||
</summary>
|
||
|
||
<param name="request">Container for the necessary parameters to execute the DecodeAuthorizationMessage operation on AmazonSecurityTokenServiceClient.</param>
|
||
<param name="callback">An AsyncCallback delegate that is invoked when the operation completes.</param>
|
||
<param name="state">A user-defined state object that is passed to the callback procedure. Retrieve this object from within the callback
|
||
procedure using the AsyncState property.</param>
|
||
|
||
<returns>An IAsyncResult that can be used to poll or wait for results, or both; this value is also needed when invoking EndDecodeAuthorizationMessage
|
||
operation.</returns>
|
||
<seealso href="http://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/DecodeAuthorizationMessage">REST API Reference for DecodeAuthorizationMessage Operation</seealso>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.AmazonSecurityTokenServiceClient.EndDecodeAuthorizationMessage(System.IAsyncResult)">
|
||
<summary>
|
||
Finishes the asynchronous execution of the DecodeAuthorizationMessage operation.
|
||
</summary>
|
||
|
||
<param name="asyncResult">The IAsyncResult returned by the call to BeginDecodeAuthorizationMessage.</param>
|
||
|
||
<returns>Returns a DecodeAuthorizationMessageResult from SecurityTokenService.</returns>
|
||
<seealso href="http://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/DecodeAuthorizationMessage">REST API Reference for DecodeAuthorizationMessage Operation</seealso>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.AmazonSecurityTokenServiceClient.GetAccessKeyInfo(Amazon.SecurityToken.Model.GetAccessKeyInfoRequest)">
|
||
<summary>
|
||
Returns the account identifier for the specified access key ID.
|
||
|
||
|
||
<para>
|
||
Access keys consist of two parts: an access key ID (for example, <code>AKIAIOSFODNN7EXAMPLE</code>)
|
||
and a secret access key (for example, <code>wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY</code>).
|
||
For more information about access keys, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html">Managing
|
||
Access Keys for IAM Users</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
When you pass an access key ID to this operation, it returns the ID of the Amazon
|
||
Web Services account to which the keys belong. Access key IDs beginning with <code>AKIA</code>
|
||
are long-term credentials for an IAM user or the Amazon Web Services account root
|
||
user. Access key IDs beginning with <code>ASIA</code> are temporary credentials that
|
||
are created using STS operations. If the account in the response belongs to you, you
|
||
can sign in as the root user and review your root user access keys. Then, you can
|
||
pull a <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_getting-report.html">credentials
|
||
report</a> to learn which IAM user owns the keys. To learn who requested the temporary
|
||
credentials for an <code>ASIA</code> access key, view the STS events in your <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html">CloudTrail
|
||
logs</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
This operation does not indicate the state of the access key. The key might be active,
|
||
inactive, or deleted. Active keys might not have permissions to perform an operation.
|
||
Providing a deleted access key might return an error that the key doesn't exist.
|
||
</para>
|
||
</summary>
|
||
<param name="request">Container for the necessary parameters to execute the GetAccessKeyInfo service method.</param>
|
||
|
||
<returns>The response from the GetAccessKeyInfo service method, as returned by SecurityTokenService.</returns>
|
||
<seealso href="http://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/GetAccessKeyInfo">REST API Reference for GetAccessKeyInfo Operation</seealso>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.AmazonSecurityTokenServiceClient.BeginGetAccessKeyInfo(Amazon.SecurityToken.Model.GetAccessKeyInfoRequest,System.AsyncCallback,System.Object)">
|
||
<summary>
|
||
Initiates the asynchronous execution of the GetAccessKeyInfo operation.
|
||
</summary>
|
||
|
||
<param name="request">Container for the necessary parameters to execute the GetAccessKeyInfo operation on AmazonSecurityTokenServiceClient.</param>
|
||
<param name="callback">An AsyncCallback delegate that is invoked when the operation completes.</param>
|
||
<param name="state">A user-defined state object that is passed to the callback procedure. Retrieve this object from within the callback
|
||
procedure using the AsyncState property.</param>
|
||
|
||
<returns>An IAsyncResult that can be used to poll or wait for results, or both; this value is also needed when invoking EndGetAccessKeyInfo
|
||
operation.</returns>
|
||
<seealso href="http://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/GetAccessKeyInfo">REST API Reference for GetAccessKeyInfo Operation</seealso>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.AmazonSecurityTokenServiceClient.EndGetAccessKeyInfo(System.IAsyncResult)">
|
||
<summary>
|
||
Finishes the asynchronous execution of the GetAccessKeyInfo operation.
|
||
</summary>
|
||
|
||
<param name="asyncResult">The IAsyncResult returned by the call to BeginGetAccessKeyInfo.</param>
|
||
|
||
<returns>Returns a GetAccessKeyInfoResult from SecurityTokenService.</returns>
|
||
<seealso href="http://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/GetAccessKeyInfo">REST API Reference for GetAccessKeyInfo Operation</seealso>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.AmazonSecurityTokenServiceClient.GetCallerIdentity(Amazon.SecurityToken.Model.GetCallerIdentityRequest)">
|
||
<summary>
|
||
Returns details about the IAM user or role whose credentials are used to call the
|
||
operation.
|
||
|
||
<note>
|
||
<para>
|
||
No permissions are required to perform this operation. If an administrator adds a
|
||
policy to your IAM user or role that explicitly denies access to the <code>sts:GetCallerIdentity</code>
|
||
action, you can still perform this operation. Permissions are not required because
|
||
the same information is returned when an IAM user or role is denied access. To view
|
||
an example response, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_access-denied-delete-mfa">I
|
||
Am Not Authorized to Perform: iam:DeleteVirtualMFADevice</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
</note>
|
||
</summary>
|
||
<param name="request">Container for the necessary parameters to execute the GetCallerIdentity service method.</param>
|
||
|
||
<returns>The response from the GetCallerIdentity service method, as returned by SecurityTokenService.</returns>
|
||
<seealso href="http://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/GetCallerIdentity">REST API Reference for GetCallerIdentity Operation</seealso>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.AmazonSecurityTokenServiceClient.BeginGetCallerIdentity(Amazon.SecurityToken.Model.GetCallerIdentityRequest,System.AsyncCallback,System.Object)">
|
||
<summary>
|
||
Initiates the asynchronous execution of the GetCallerIdentity operation.
|
||
</summary>
|
||
|
||
<param name="request">Container for the necessary parameters to execute the GetCallerIdentity operation on AmazonSecurityTokenServiceClient.</param>
|
||
<param name="callback">An AsyncCallback delegate that is invoked when the operation completes.</param>
|
||
<param name="state">A user-defined state object that is passed to the callback procedure. Retrieve this object from within the callback
|
||
procedure using the AsyncState property.</param>
|
||
|
||
<returns>An IAsyncResult that can be used to poll or wait for results, or both; this value is also needed when invoking EndGetCallerIdentity
|
||
operation.</returns>
|
||
<seealso href="http://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/GetCallerIdentity">REST API Reference for GetCallerIdentity Operation</seealso>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.AmazonSecurityTokenServiceClient.EndGetCallerIdentity(System.IAsyncResult)">
|
||
<summary>
|
||
Finishes the asynchronous execution of the GetCallerIdentity operation.
|
||
</summary>
|
||
|
||
<param name="asyncResult">The IAsyncResult returned by the call to BeginGetCallerIdentity.</param>
|
||
|
||
<returns>Returns a GetCallerIdentityResult from SecurityTokenService.</returns>
|
||
<seealso href="http://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/GetCallerIdentity">REST API Reference for GetCallerIdentity Operation</seealso>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.AmazonSecurityTokenServiceClient.GetFederationToken(Amazon.SecurityToken.Model.GetFederationTokenRequest)">
|
||
<summary>
|
||
Returns a set of temporary security credentials (consisting of an access key ID, a
|
||
secret access key, and a security token) for a federated user. A typical use is in
|
||
a proxy application that gets temporary security credentials on behalf of distributed
|
||
applications inside a corporate network. You must call the <code>GetFederationToken</code>
|
||
operation using the long-term security credentials of an IAM user. As a result, this
|
||
call is appropriate in contexts where those credentials can be safely stored, usually
|
||
in a server-based application. For a comparison of <code>GetFederationToken</code>
|
||
with the other API operations that produce temporary credentials, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html">Requesting
|
||
Temporary Security Credentials</a> and <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#stsapi_comparison">Comparing
|
||
the Amazon Web Services STS API operations</a> in the <i>IAM User Guide</i>.
|
||
|
||
<note>
|
||
<para>
|
||
You can create a mobile-based or browser-based app that can authenticate users using
|
||
a web identity provider like Login with Amazon, Facebook, Google, or an OpenID Connect-compatible
|
||
identity provider. In this case, we recommend that you use <a href="http://aws.amazon.com/cognito/">Amazon
|
||
Cognito</a> or <code>AssumeRoleWithWebIdentity</code>. For more information, see <a
|
||
href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#api_assumerolewithwebidentity">Federation
|
||
Through a Web-based Identity Provider</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
</note>
|
||
<para>
|
||
You can also call <code>GetFederationToken</code> using the security credentials of
|
||
an Amazon Web Services account root user, but we do not recommend it. Instead, we
|
||
recommend that you create an IAM user for the purpose of the proxy application. Then
|
||
attach a policy to the IAM user that limits federated users to only the actions and
|
||
resources that they need to access. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html">IAM
|
||
Best Practices</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
<b>Session duration</b>
|
||
</para>
|
||
|
||
<para>
|
||
The temporary credentials are valid for the specified duration, from 900 seconds (15
|
||
minutes) up to a maximum of 129,600 seconds (36 hours). The default session duration
|
||
is 43,200 seconds (12 hours). Temporary credentials obtained by using the Amazon Web
|
||
Services account root user credentials have a maximum duration of 3,600 seconds (1
|
||
hour).
|
||
</para>
|
||
|
||
<para>
|
||
<b>Permissions</b>
|
||
</para>
|
||
|
||
<para>
|
||
You can use the temporary credentials created by <code>GetFederationToken</code> in
|
||
any Amazon Web Services service except the following:
|
||
</para>
|
||
<ul> <li>
|
||
<para>
|
||
You cannot call any IAM operations using the CLI or the Amazon Web Services API.
|
||
</para>
|
||
</li> <li>
|
||
<para>
|
||
You cannot call any STS operations except <code>GetCallerIdentity</code>.
|
||
</para>
|
||
</li> </ul>
|
||
<para>
|
||
You must pass an inline or managed <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">session
|
||
policy</a> to this operation. You can pass a single JSON policy document to use as
|
||
an inline session policy. You can also specify up to 10 managed policies to use as
|
||
managed session policies. The plaintext that you use for both inline and managed session
|
||
policies can't exceed 2,048 characters.
|
||
</para>
|
||
|
||
<para>
|
||
Though the session policy parameters are optional, if you do not pass a policy, then
|
||
the resulting federated user session has no permissions. When you pass session policies,
|
||
the session permissions are the intersection of the IAM user policies and the session
|
||
policies that you pass. This gives you a way to further restrict the permissions for
|
||
a federated user. You cannot use session policies to grant more permissions than those
|
||
that are defined in the permissions policy of the IAM user. For more information,
|
||
see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">Session
|
||
Policies</a> in the <i>IAM User Guide</i>. For information about using <code>GetFederationToken</code>
|
||
to create temporary security credentials, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#api_getfederationtoken">GetFederationToken—Federation
|
||
Through a Custom Identity Broker</a>.
|
||
</para>
|
||
|
||
<para>
|
||
You can use the credentials to access a resource that has a resource-based policy.
|
||
If that policy specifically references the federated user session in the <code>Principal</code>
|
||
element of the policy, the session has the permissions allowed by the policy. These
|
||
permissions are granted in addition to the permissions granted by the session policies.
|
||
</para>
|
||
|
||
<para>
|
||
<b>Tags</b>
|
||
</para>
|
||
|
||
<para>
|
||
(Optional) You can pass tag key-value pairs to your session. These are called session
|
||
tags. For more information about session tags, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html">Passing
|
||
Session Tags in STS</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
<note>
|
||
<para>
|
||
You can create a mobile-based or browser-based app that can authenticate users using
|
||
a web identity provider like Login with Amazon, Facebook, Google, or an OpenID Connect-compatible
|
||
identity provider. In this case, we recommend that you use <a href="http://aws.amazon.com/cognito/">Amazon
|
||
Cognito</a> or <code>AssumeRoleWithWebIdentity</code>. For more information, see <a
|
||
href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#api_assumerolewithwebidentity">Federation
|
||
Through a Web-based Identity Provider</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
</note>
|
||
<para>
|
||
An administrator must grant you the permissions necessary to pass session tags. The
|
||
administrator can also create granular permissions to allow you to pass only specific
|
||
session tags. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_attribute-based-access-control.html">Tutorial:
|
||
Using Tags for Attribute-Based Access Control</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
Tag key–value pairs are not case sensitive, but case is preserved. This means that
|
||
you cannot have separate <code>Department</code> and <code>department</code> tag keys.
|
||
Assume that the user that you are federating has the <code>Department</code>=<code>Marketing</code>
|
||
tag and you pass the <code>department</code>=<code>engineering</code> session tag.
|
||
<code>Department</code> and <code>department</code> are not saved as separate tags,
|
||
and the session tag passed in the request takes precedence over the user tag.
|
||
</para>
|
||
</summary>
|
||
<param name="request">Container for the necessary parameters to execute the GetFederationToken service method.</param>
|
||
|
||
<returns>The response from the GetFederationToken service method, as returned by SecurityTokenService.</returns>
|
||
<exception cref="T:Amazon.SecurityToken.Model.MalformedPolicyDocumentException">
|
||
The request was rejected because the policy document was malformed. The error message
|
||
describes the specific error.
|
||
</exception>
|
||
<exception cref="T:Amazon.SecurityToken.Model.PackedPolicyTooLargeException">
|
||
The request was rejected because the total packed size of the session policies and
|
||
session tags combined was too large. An Amazon Web Services conversion compresses
|
||
the session policy document, session policy ARNs, and session tags into a packed binary
|
||
format that has a separate limit. The error message indicates by percentage how close
|
||
the policies and tags are to the upper size limit. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html">Passing
|
||
Session Tags in STS</a> in the <i>IAM User Guide</i>.
|
||
|
||
|
||
<para>
|
||
You could receive this error even though you meet other defined session policy and
|
||
session tag limits. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html#reference_iam-limits-entity-length">IAM
|
||
and STS Entity Character Limits</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
</exception>
|
||
<exception cref="T:Amazon.SecurityToken.Model.RegionDisabledException">
|
||
STS is not activated in the requested region for the account that is being asked to
|
||
generate credentials. The account administrator must use the IAM console to activate
|
||
STS in that region. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html">Activating
|
||
and Deactivating Amazon Web Services STS in an Amazon Web Services Region</a> in the
|
||
<i>IAM User Guide</i>.
|
||
</exception>
|
||
<seealso href="http://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/GetFederationToken">REST API Reference for GetFederationToken Operation</seealso>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.AmazonSecurityTokenServiceClient.BeginGetFederationToken(Amazon.SecurityToken.Model.GetFederationTokenRequest,System.AsyncCallback,System.Object)">
|
||
<summary>
|
||
Initiates the asynchronous execution of the GetFederationToken operation.
|
||
</summary>
|
||
|
||
<param name="request">Container for the necessary parameters to execute the GetFederationToken operation on AmazonSecurityTokenServiceClient.</param>
|
||
<param name="callback">An AsyncCallback delegate that is invoked when the operation completes.</param>
|
||
<param name="state">A user-defined state object that is passed to the callback procedure. Retrieve this object from within the callback
|
||
procedure using the AsyncState property.</param>
|
||
|
||
<returns>An IAsyncResult that can be used to poll or wait for results, or both; this value is also needed when invoking EndGetFederationToken
|
||
operation.</returns>
|
||
<seealso href="http://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/GetFederationToken">REST API Reference for GetFederationToken Operation</seealso>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.AmazonSecurityTokenServiceClient.EndGetFederationToken(System.IAsyncResult)">
|
||
<summary>
|
||
Finishes the asynchronous execution of the GetFederationToken operation.
|
||
</summary>
|
||
|
||
<param name="asyncResult">The IAsyncResult returned by the call to BeginGetFederationToken.</param>
|
||
|
||
<returns>Returns a GetFederationTokenResult from SecurityTokenService.</returns>
|
||
<seealso href="http://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/GetFederationToken">REST API Reference for GetFederationToken Operation</seealso>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.AmazonSecurityTokenServiceClient.GetSessionToken">
|
||
<summary>
|
||
Returns a set of temporary credentials for an Amazon Web Services account or IAM user.
|
||
The credentials consist of an access key ID, a secret access key, and a security token.
|
||
Typically, you use <code>GetSessionToken</code> if you want to use MFA to protect
|
||
programmatic calls to specific Amazon Web Services API operations like Amazon EC2
|
||
<code>StopInstances</code>. MFA-enabled IAM users would need to call <code>GetSessionToken</code>
|
||
and submit an MFA code that is associated with their MFA device. Using the temporary
|
||
security credentials that are returned from the call, IAM users can then make programmatic
|
||
calls to API operations that require MFA authentication. If you do not supply a correct
|
||
MFA code, then the API returns an access denied error. For a comparison of <code>GetSessionToken</code>
|
||
with the other API operations that produce temporary credentials, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html">Requesting
|
||
Temporary Security Credentials</a> and <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#stsapi_comparison">Comparing
|
||
the Amazon Web Services STS API operations</a> in the <i>IAM User Guide</i>.
|
||
|
||
<note>
|
||
<para>
|
||
No permissions are required for users to perform this operation. The purpose of the
|
||
<code>sts:GetSessionToken</code> operation is to authenticate the user using MFA.
|
||
You cannot use policies to control authentication operations. For more information,
|
||
see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_getsessiontoken.html">Permissions
|
||
for GetSessionToken</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
</note>
|
||
<para>
|
||
<b>Session Duration</b>
|
||
</para>
|
||
|
||
<para>
|
||
The <code>GetSessionToken</code> operation must be called by using the long-term Amazon
|
||
Web Services security credentials of the Amazon Web Services account root user or
|
||
an IAM user. Credentials that are created by IAM users are valid for the duration
|
||
that you specify. This duration can range from 900 seconds (15 minutes) up to a maximum
|
||
of 129,600 seconds (36 hours), with a default of 43,200 seconds (12 hours). Credentials
|
||
based on account credentials can range from 900 seconds (15 minutes) up to 3,600 seconds
|
||
(1 hour), with a default of 1 hour.
|
||
</para>
|
||
|
||
<para>
|
||
<b>Permissions</b>
|
||
</para>
|
||
|
||
<para>
|
||
The temporary security credentials created by <code>GetSessionToken</code> can be
|
||
used to make API calls to any Amazon Web Services service with the following exceptions:
|
||
</para>
|
||
<ul> <li>
|
||
<para>
|
||
You cannot call any IAM API operations unless MFA authentication information is included
|
||
in the request.
|
||
</para>
|
||
</li> <li>
|
||
<para>
|
||
You cannot call any STS API <i>except</i> <code>AssumeRole</code> or <code>GetCallerIdentity</code>.
|
||
</para>
|
||
</li> </ul> <note>
|
||
<para>
|
||
We recommend that you do not call <code>GetSessionToken</code> with Amazon Web Services
|
||
account root user credentials. Instead, follow our <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#create-iam-users">best
|
||
practices</a> by creating one or more IAM users, giving them the necessary permissions,
|
||
and using IAM users for everyday interaction with Amazon Web Services.
|
||
</para>
|
||
</note>
|
||
<para>
|
||
The credentials that are returned by <code>GetSessionToken</code> are based on permissions
|
||
associated with the user whose credentials were used to call the operation. If <code>GetSessionToken</code>
|
||
is called using Amazon Web Services account root user credentials, the temporary credentials
|
||
have root user permissions. Similarly, if <code>GetSessionToken</code> is called using
|
||
the credentials of an IAM user, the temporary credentials have the same permissions
|
||
as the IAM user.
|
||
</para>
|
||
|
||
<para>
|
||
For more information about using <code>GetSessionToken</code> to create temporary
|
||
credentials, go to <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#api_getsessiontoken">Temporary
|
||
Credentials for Users in Untrusted Environments</a> in the <i>IAM User Guide</i>.
|
||
|
||
</para>
|
||
</summary>
|
||
|
||
<returns>The response from the GetSessionToken service method, as returned by SecurityTokenService.</returns>
|
||
<exception cref="T:Amazon.SecurityToken.Model.RegionDisabledException">
|
||
STS is not activated in the requested region for the account that is being asked to
|
||
generate credentials. The account administrator must use the IAM console to activate
|
||
STS in that region. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html">Activating
|
||
and Deactivating Amazon Web Services STS in an Amazon Web Services Region</a> in the
|
||
<i>IAM User Guide</i>.
|
||
</exception>
|
||
<seealso href="http://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/GetSessionToken">REST API Reference for GetSessionToken Operation</seealso>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.AmazonSecurityTokenServiceClient.GetSessionToken(Amazon.SecurityToken.Model.GetSessionTokenRequest)">
|
||
<summary>
|
||
Returns a set of temporary credentials for an Amazon Web Services account or IAM user.
|
||
The credentials consist of an access key ID, a secret access key, and a security token.
|
||
Typically, you use <code>GetSessionToken</code> if you want to use MFA to protect
|
||
programmatic calls to specific Amazon Web Services API operations like Amazon EC2
|
||
<code>StopInstances</code>. MFA-enabled IAM users would need to call <code>GetSessionToken</code>
|
||
and submit an MFA code that is associated with their MFA device. Using the temporary
|
||
security credentials that are returned from the call, IAM users can then make programmatic
|
||
calls to API operations that require MFA authentication. If you do not supply a correct
|
||
MFA code, then the API returns an access denied error. For a comparison of <code>GetSessionToken</code>
|
||
with the other API operations that produce temporary credentials, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html">Requesting
|
||
Temporary Security Credentials</a> and <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#stsapi_comparison">Comparing
|
||
the Amazon Web Services STS API operations</a> in the <i>IAM User Guide</i>.
|
||
|
||
<note>
|
||
<para>
|
||
No permissions are required for users to perform this operation. The purpose of the
|
||
<code>sts:GetSessionToken</code> operation is to authenticate the user using MFA.
|
||
You cannot use policies to control authentication operations. For more information,
|
||
see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_getsessiontoken.html">Permissions
|
||
for GetSessionToken</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
</note>
|
||
<para>
|
||
<b>Session Duration</b>
|
||
</para>
|
||
|
||
<para>
|
||
The <code>GetSessionToken</code> operation must be called by using the long-term Amazon
|
||
Web Services security credentials of the Amazon Web Services account root user or
|
||
an IAM user. Credentials that are created by IAM users are valid for the duration
|
||
that you specify. This duration can range from 900 seconds (15 minutes) up to a maximum
|
||
of 129,600 seconds (36 hours), with a default of 43,200 seconds (12 hours). Credentials
|
||
based on account credentials can range from 900 seconds (15 minutes) up to 3,600 seconds
|
||
(1 hour), with a default of 1 hour.
|
||
</para>
|
||
|
||
<para>
|
||
<b>Permissions</b>
|
||
</para>
|
||
|
||
<para>
|
||
The temporary security credentials created by <code>GetSessionToken</code> can be
|
||
used to make API calls to any Amazon Web Services service with the following exceptions:
|
||
</para>
|
||
<ul> <li>
|
||
<para>
|
||
You cannot call any IAM API operations unless MFA authentication information is included
|
||
in the request.
|
||
</para>
|
||
</li> <li>
|
||
<para>
|
||
You cannot call any STS API <i>except</i> <code>AssumeRole</code> or <code>GetCallerIdentity</code>.
|
||
</para>
|
||
</li> </ul> <note>
|
||
<para>
|
||
We recommend that you do not call <code>GetSessionToken</code> with Amazon Web Services
|
||
account root user credentials. Instead, follow our <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#create-iam-users">best
|
||
practices</a> by creating one or more IAM users, giving them the necessary permissions,
|
||
and using IAM users for everyday interaction with Amazon Web Services.
|
||
</para>
|
||
</note>
|
||
<para>
|
||
The credentials that are returned by <code>GetSessionToken</code> are based on permissions
|
||
associated with the user whose credentials were used to call the operation. If <code>GetSessionToken</code>
|
||
is called using Amazon Web Services account root user credentials, the temporary credentials
|
||
have root user permissions. Similarly, if <code>GetSessionToken</code> is called using
|
||
the credentials of an IAM user, the temporary credentials have the same permissions
|
||
as the IAM user.
|
||
</para>
|
||
|
||
<para>
|
||
For more information about using <code>GetSessionToken</code> to create temporary
|
||
credentials, go to <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#api_getsessiontoken">Temporary
|
||
Credentials for Users in Untrusted Environments</a> in the <i>IAM User Guide</i>.
|
||
|
||
</para>
|
||
</summary>
|
||
<param name="request">Container for the necessary parameters to execute the GetSessionToken service method.</param>
|
||
|
||
<returns>The response from the GetSessionToken service method, as returned by SecurityTokenService.</returns>
|
||
<exception cref="T:Amazon.SecurityToken.Model.RegionDisabledException">
|
||
STS is not activated in the requested region for the account that is being asked to
|
||
generate credentials. The account administrator must use the IAM console to activate
|
||
STS in that region. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html">Activating
|
||
and Deactivating Amazon Web Services STS in an Amazon Web Services Region</a> in the
|
||
<i>IAM User Guide</i>.
|
||
</exception>
|
||
<seealso href="http://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/GetSessionToken">REST API Reference for GetSessionToken Operation</seealso>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.AmazonSecurityTokenServiceClient.BeginGetSessionToken(Amazon.SecurityToken.Model.GetSessionTokenRequest,System.AsyncCallback,System.Object)">
|
||
<summary>
|
||
Initiates the asynchronous execution of the GetSessionToken operation.
|
||
</summary>
|
||
|
||
<param name="request">Container for the necessary parameters to execute the GetSessionToken operation on AmazonSecurityTokenServiceClient.</param>
|
||
<param name="callback">An AsyncCallback delegate that is invoked when the operation completes.</param>
|
||
<param name="state">A user-defined state object that is passed to the callback procedure. Retrieve this object from within the callback
|
||
procedure using the AsyncState property.</param>
|
||
|
||
<returns>An IAsyncResult that can be used to poll or wait for results, or both; this value is also needed when invoking EndGetSessionToken
|
||
operation.</returns>
|
||
<seealso href="http://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/GetSessionToken">REST API Reference for GetSessionToken Operation</seealso>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.AmazonSecurityTokenServiceClient.EndGetSessionToken(System.IAsyncResult)">
|
||
<summary>
|
||
Finishes the asynchronous execution of the GetSessionToken operation.
|
||
</summary>
|
||
|
||
<param name="asyncResult">The IAsyncResult returned by the call to BeginGetSessionToken.</param>
|
||
|
||
<returns>Returns a GetSessionTokenResult from SecurityTokenService.</returns>
|
||
<seealso href="http://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/GetSessionToken">REST API Reference for GetSessionToken Operation</seealso>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.AmazonSecurityTokenServiceConfig">
|
||
<summary>
|
||
Configuration for accessing Amazon SecurityTokenService service
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.AmazonSecurityTokenServiceConfig.StsRegionalEndpoints">
|
||
<summary>
|
||
StsRegionalEndpoints should be set to <see cref="F:Amazon.Runtime.StsRegionalEndpointsValue.Legacy"/> to resolve to the global
|
||
sts endpoint (only for legacy global regions) or StsRegionalEndpointsValue.Regional to resolve to
|
||
the regional sts endpoint. The default value for StsRegionalEndpoints is StsRegionalEndpointsValue.Legacy.
|
||
|
||
Get the Sts Regional Flag value by checking the environment variable, the shared credentials file field,
|
||
or falling back to <see cref="T:Amazon.Runtime.Internal.IDefaultConfigurationProvider"/> and using <see cref="P:Amazon.Runtime.DefaultConfiguration.StsRegionalEndpoints"/>
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.AmazonSecurityTokenServiceConfig.DetermineServiceURL">
|
||
<summary>
|
||
Override DetermineServiceURL to set the url to the
|
||
global endpoint if the sts regional flag is equal to legacy
|
||
and the region is a legacy global region
|
||
</summary>
|
||
<returns> url: A string url for the request </returns>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.AmazonSecurityTokenServiceConfig.CheckSTSEnvironmentVariable">
|
||
<summary>
|
||
If the sts regional flag environment variable is set, then first validate that
|
||
it is an acceptable value, if not, then throw an error. Then
|
||
set the sts regional flag to that value.
|
||
</summary>
|
||
<returns> _isRegionalFlagSet: a boolean for whether or not
|
||
the environment variable set the regional flag </returns>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.AmazonSecurityTokenServiceConfig.CheckCredentialsFile">
|
||
<summary>
|
||
Check the credential file for an sts regional endpoints
|
||
option. If it is set within the file, then set the sts
|
||
regional flag to that value.
|
||
</summary>
|
||
<returns> _isRegionalFlagSet: A boolean for whether
|
||
or not the credentials file set the regional flag </returns>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.AmazonSecurityTokenServiceConfig.#ctor">
|
||
<summary>
|
||
Default constructor
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.AmazonSecurityTokenServiceConfig.RegionEndpointServiceName">
|
||
<summary>
|
||
The constant used to lookup in the region hash the endpoint.
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.AmazonSecurityTokenServiceConfig.ServiceVersion">
|
||
<summary>
|
||
Gets the ServiceVersion property.
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.AmazonSecurityTokenServiceConfig.UserAgent">
|
||
<summary>
|
||
Gets the value of UserAgent property.
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.STSAssumeRoleAWSCredentials">
|
||
<summary>
|
||
Credentials that are retrieved by invoking AWS Security Token Service
|
||
AssumeRole or AssumeRoleWithSAML action.
|
||
</summary>
|
||
<summary>
|
||
Assumed role credentials retrieved and automatically refreshed from
|
||
an instance of IAmazonSecurityTokenService.
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.STSAssumeRoleAWSCredentials.#ctor(Amazon.SecurityToken.IAmazonSecurityTokenService,Amazon.SecurityToken.Model.AssumeRoleRequest)">
|
||
<summary>
|
||
Instantiates STSAssumeRoleAWSCredentials which automatically assumes a specified role.
|
||
The credentials are refreshed before expiration.
|
||
</summary>
|
||
<param name="sts">
|
||
Instance of IAmazonSecurityTokenService that will be used to make the AssumeRole service call.
|
||
</param>
|
||
<param name="assumeRoleRequest">Configuration for the role to assume.</param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.STSAssumeRoleAWSCredentials.#ctor(Amazon.SecurityToken.Model.AssumeRoleWithSAMLRequest)">
|
||
<summary>
|
||
Instantiates STSAssumeRoleAWSCredentials which automatically assumes a specified SAML role.
|
||
The credentials are refreshed before expiration.
|
||
</summary>
|
||
<param name="assumeRoleWithSamlRequest">Configuration for the SAML role to assume.</param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.STSAssumeRoleAWSCredentials.GenerateNewCredentials">
|
||
<summary>
|
||
Generate new credentials.
|
||
</summary>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.STSAssumeRoleAWSCredentials.Dispose(System.Boolean)">
|
||
<summary>
|
||
Implements the Dispose pattern
|
||
</summary>
|
||
<param name="disposing">Whether this object is being disposed via a call to Dispose
|
||
or garbage collected.</param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.STSAssumeRoleAWSCredentials.Dispose">
|
||
<summary>
|
||
Disposes of all managed and unmanaged resources.
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.IAmazonSecurityTokenService">
|
||
<summary>
|
||
Interface for accessing SecurityTokenService
|
||
|
||
Security Token Service
|
||
<para>
|
||
Security Token Service (STS) enables you to request temporary, limited-privilege credentials
|
||
for Identity and Access Management (IAM) users or for users that you authenticate
|
||
(federated users). This guide provides descriptions of the STS API. For more information
|
||
about using this service, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp.html">Temporary
|
||
Security Credentials</a>.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.IAmazonSecurityTokenService.AssumeRole(Amazon.SecurityToken.Model.AssumeRoleRequest)">
|
||
<summary>
|
||
Returns a set of temporary security credentials that you can use to access Amazon
|
||
Web Services resources that you might not normally have access to. These temporary
|
||
credentials consist of an access key ID, a secret access key, and a security token.
|
||
Typically, you use <code>AssumeRole</code> within your account or for cross-account
|
||
access. For a comparison of <code>AssumeRole</code> with other API operations that
|
||
produce temporary credentials, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html">Requesting
|
||
Temporary Security Credentials</a> and <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#stsapi_comparison">Comparing
|
||
the Amazon Web Services STS API operations</a> in the <i>IAM User Guide</i>.
|
||
|
||
|
||
<para>
|
||
<b>Permissions</b>
|
||
</para>
|
||
|
||
<para>
|
||
The temporary security credentials created by <code>AssumeRole</code> can be used
|
||
to make API calls to any Amazon Web Services service with the following exception:
|
||
You cannot call the Amazon Web Services STS <code>GetFederationToken</code> or <code>GetSessionToken</code>
|
||
API operations.
|
||
</para>
|
||
|
||
<para>
|
||
(Optional) You can pass inline or managed <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">session
|
||
policies</a> to this operation. You can pass a single JSON policy document to use
|
||
as an inline session policy. You can also specify up to 10 managed policies to use
|
||
as managed session policies. The plaintext that you use for both inline and managed
|
||
session policies can't exceed 2,048 characters. Passing policies to this operation
|
||
returns new temporary credentials. The resulting session's permissions are the intersection
|
||
of the role's identity-based policy and the session policies. You can use the role's
|
||
temporary credentials in subsequent Amazon Web Services API calls to access resources
|
||
in the account that owns the role. You cannot use session policies to grant more permissions
|
||
than those allowed by the identity-based policy of the role that is being assumed.
|
||
For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">Session
|
||
Policies</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
When you create a role, you create two policies: A role trust policy that specifies
|
||
<i>who</i> can assume the role and a permissions policy that specifies <i>what</i>
|
||
can be done with the role. You specify the trusted principal who is allowed to assume
|
||
the role in the role trust policy.
|
||
</para>
|
||
|
||
<para>
|
||
To assume a role from a different account, your Amazon Web Services account must be
|
||
trusted by the role. The trust relationship is defined in the role's trust policy
|
||
when the role is created. That trust policy states which accounts are allowed to delegate
|
||
that access to users in the account.
|
||
</para>
|
||
|
||
<para>
|
||
A user who wants to access a role in a different account must also have permissions
|
||
that are delegated from the user account administrator. The administrator must attach
|
||
a policy that allows the user to call <code>AssumeRole</code> for the ARN of the role
|
||
in the other account.
|
||
</para>
|
||
|
||
<para>
|
||
To allow a user to assume a role in the same account, you can do either of the following:
|
||
</para>
|
||
<ul> <li>
|
||
<para>
|
||
Attach a policy to the user that allows the user to call <code>AssumeRole</code> (as
|
||
long as the role's trust policy trusts the account).
|
||
</para>
|
||
</li> <li>
|
||
<para>
|
||
Add the user as a principal directly in the role's trust policy.
|
||
</para>
|
||
</li> </ul>
|
||
<para>
|
||
You can do either because the role’s trust policy acts as an IAM resource-based policy.
|
||
When a resource-based policy grants access to a principal in the same account, no
|
||
additional identity-based policy is required. For more information about trust policies
|
||
and resource-based policies, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html">IAM
|
||
Policies</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
<b>Tags</b>
|
||
</para>
|
||
|
||
<para>
|
||
(Optional) You can pass tag key-value pairs to your session. These tags are called
|
||
session tags. For more information about session tags, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html">Passing
|
||
Session Tags in STS</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
An administrator must grant you the permissions necessary to pass session tags. The
|
||
administrator can also create granular permissions to allow you to pass only specific
|
||
session tags. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_attribute-based-access-control.html">Tutorial:
|
||
Using Tags for Attribute-Based Access Control</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
You can set the session tags as transitive. Transitive tags persist during role chaining.
|
||
For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html#id_session-tags_role-chaining">Chaining
|
||
Roles with Session Tags</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
<b>Using MFA with AssumeRole</b>
|
||
</para>
|
||
|
||
<para>
|
||
(Optional) You can include multi-factor authentication (MFA) information when you
|
||
call <code>AssumeRole</code>. This is useful for cross-account scenarios to ensure
|
||
that the user that assumes the role has been authenticated with an Amazon Web Services
|
||
MFA device. In that scenario, the trust policy of the role being assumed includes
|
||
a condition that tests for MFA authentication. If the caller does not include valid
|
||
MFA information, the request to assume the role is denied. The condition in a trust
|
||
policy that tests for MFA authentication might look like the following example.
|
||
</para>
|
||
|
||
<para>
|
||
<code>"Condition": {"Bool": {"aws:MultiFactorAuthPresent": true}}</code>
|
||
</para>
|
||
|
||
<para>
|
||
For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/MFAProtectedAPI.html">Configuring
|
||
MFA-Protected API Access</a> in the <i>IAM User Guide</i> guide.
|
||
</para>
|
||
|
||
<para>
|
||
To use MFA with <code>AssumeRole</code>, you pass values for the <code>SerialNumber</code>
|
||
and <code>TokenCode</code> parameters. The <code>SerialNumber</code> value identifies
|
||
the user's hardware or virtual MFA device. The <code>TokenCode</code> is the time-based
|
||
one-time password (TOTP) that the MFA device produces.
|
||
</para>
|
||
</summary>
|
||
<param name="request">Container for the necessary parameters to execute the AssumeRole service method.</param>
|
||
|
||
<returns>The response from the AssumeRole service method, as returned by SecurityTokenService.</returns>
|
||
<exception cref="T:Amazon.SecurityToken.Model.ExpiredTokenException">
|
||
The web identity token that was passed is expired or is not valid. Get a new identity
|
||
token from the identity provider and then retry the request.
|
||
</exception>
|
||
<exception cref="T:Amazon.SecurityToken.Model.MalformedPolicyDocumentException">
|
||
The request was rejected because the policy document was malformed. The error message
|
||
describes the specific error.
|
||
</exception>
|
||
<exception cref="T:Amazon.SecurityToken.Model.PackedPolicyTooLargeException">
|
||
The request was rejected because the total packed size of the session policies and
|
||
session tags combined was too large. An Amazon Web Services conversion compresses
|
||
the session policy document, session policy ARNs, and session tags into a packed binary
|
||
format that has a separate limit. The error message indicates by percentage how close
|
||
the policies and tags are to the upper size limit. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html">Passing
|
||
Session Tags in STS</a> in the <i>IAM User Guide</i>.
|
||
|
||
|
||
<para>
|
||
You could receive this error even though you meet other defined session policy and
|
||
session tag limits. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html#reference_iam-limits-entity-length">IAM
|
||
and STS Entity Character Limits</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
</exception>
|
||
<exception cref="T:Amazon.SecurityToken.Model.RegionDisabledException">
|
||
STS is not activated in the requested region for the account that is being asked to
|
||
generate credentials. The account administrator must use the IAM console to activate
|
||
STS in that region. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html">Activating
|
||
and Deactivating Amazon Web Services STS in an Amazon Web Services Region</a> in the
|
||
<i>IAM User Guide</i>.
|
||
</exception>
|
||
<seealso href="http://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/AssumeRole">REST API Reference for AssumeRole Operation</seealso>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.IAmazonSecurityTokenService.BeginAssumeRole(Amazon.SecurityToken.Model.AssumeRoleRequest,System.AsyncCallback,System.Object)">
|
||
<summary>
|
||
Initiates the asynchronous execution of the AssumeRole operation.
|
||
</summary>
|
||
|
||
<param name="request">Container for the necessary parameters to execute the AssumeRole operation on AmazonSecurityTokenServiceClient.</param>
|
||
<param name="callback">An AsyncCallback delegate that is invoked when the operation completes.</param>
|
||
<param name="state">A user-defined state object that is passed to the callback procedure. Retrieve this object from within the callback
|
||
procedure using the AsyncState property.</param>
|
||
|
||
<returns>An IAsyncResult that can be used to poll or wait for results, or both; this value is also needed when invoking EndAssumeRole
|
||
operation.</returns>
|
||
<seealso href="http://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/AssumeRole">REST API Reference for AssumeRole Operation</seealso>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.IAmazonSecurityTokenService.EndAssumeRole(System.IAsyncResult)">
|
||
<summary>
|
||
Finishes the asynchronous execution of the AssumeRole operation.
|
||
</summary>
|
||
|
||
<param name="asyncResult">The IAsyncResult returned by the call to BeginAssumeRole.</param>
|
||
|
||
<returns>Returns a AssumeRoleResult from SecurityTokenService.</returns>
|
||
<seealso href="http://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/AssumeRole">REST API Reference for AssumeRole Operation</seealso>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.IAmazonSecurityTokenService.AssumeRoleWithSAML(Amazon.SecurityToken.Model.AssumeRoleWithSAMLRequest)">
|
||
<summary>
|
||
Returns a set of temporary security credentials for users who have been authenticated
|
||
via a SAML authentication response. This operation provides a mechanism for tying
|
||
an enterprise identity store or directory to role-based Amazon Web Services access
|
||
without user-specific credentials or configuration. For a comparison of <code>AssumeRoleWithSAML</code>
|
||
with the other API operations that produce temporary credentials, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html">Requesting
|
||
Temporary Security Credentials</a> and <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#stsapi_comparison">Comparing
|
||
the Amazon Web Services STS API operations</a> in the <i>IAM User Guide</i>.
|
||
|
||
|
||
<para>
|
||
The temporary security credentials returned by this operation consist of an access
|
||
key ID, a secret access key, and a security token. Applications can use these temporary
|
||
security credentials to sign calls to Amazon Web Services services.
|
||
</para>
|
||
|
||
<para>
|
||
<b>Session Duration</b>
|
||
</para>
|
||
|
||
<para>
|
||
By default, the temporary security credentials created by <code>AssumeRoleWithSAML</code>
|
||
last for one hour. However, you can use the optional <code>DurationSeconds</code>
|
||
parameter to specify the duration of your session. Your role session lasts for the
|
||
duration that you specify, or until the time specified in the SAML authentication
|
||
response's <code>SessionNotOnOrAfter</code> value, whichever is shorter. You can provide
|
||
a <code>DurationSeconds</code> value from 900 seconds (15 minutes) up to the maximum
|
||
session duration setting for the role. This setting can have a value from 1 hour to
|
||
12 hours. To learn how to view the maximum value for your role, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html#id_roles_use_view-role-max-session">View
|
||
the Maximum Session Duration Setting for a Role</a> in the <i>IAM User Guide</i>.
|
||
The maximum session duration limit applies when you use the <code>AssumeRole*</code>
|
||
API operations or the <code>assume-role*</code> CLI commands. However the limit does
|
||
not apply when you use those operations to create a console URL. For more information,
|
||
see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html">Using
|
||
IAM Roles</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
<note>
|
||
<para>
|
||
<a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#iam-term-role-chaining">Role
|
||
chaining</a> limits your CLI or Amazon Web Services API role session to a maximum
|
||
of one hour. When you use the <code>AssumeRole</code> API operation to assume a role,
|
||
you can specify the duration of your role session with the <code>DurationSeconds</code>
|
||
parameter. You can specify a parameter value of up to 43200 seconds (12 hours), depending
|
||
on the maximum session duration setting for your role. However, if you assume a role
|
||
using role chaining and provide a <code>DurationSeconds</code> parameter value greater
|
||
than one hour, the operation fails.
|
||
</para>
|
||
</note>
|
||
<para>
|
||
<b>Permissions</b>
|
||
</para>
|
||
|
||
<para>
|
||
The temporary security credentials created by <code>AssumeRoleWithSAML</code> can
|
||
be used to make API calls to any Amazon Web Services service with the following exception:
|
||
you cannot call the STS <code>GetFederationToken</code> or <code>GetSessionToken</code>
|
||
API operations.
|
||
</para>
|
||
|
||
<para>
|
||
(Optional) You can pass inline or managed <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">session
|
||
policies</a> to this operation. You can pass a single JSON policy document to use
|
||
as an inline session policy. You can also specify up to 10 managed policies to use
|
||
as managed session policies. The plaintext that you use for both inline and managed
|
||
session policies can't exceed 2,048 characters. Passing policies to this operation
|
||
returns new temporary credentials. The resulting session's permissions are the intersection
|
||
of the role's identity-based policy and the session policies. You can use the role's
|
||
temporary credentials in subsequent Amazon Web Services API calls to access resources
|
||
in the account that owns the role. You cannot use session policies to grant more permissions
|
||
than those allowed by the identity-based policy of the role that is being assumed.
|
||
For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">Session
|
||
Policies</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
Calling <code>AssumeRoleWithSAML</code> does not require the use of Amazon Web Services
|
||
security credentials. The identity of the caller is validated by using keys in the
|
||
metadata document that is uploaded for the SAML provider entity for your identity
|
||
provider.
|
||
</para>
|
||
<important>
|
||
<para>
|
||
Calling <code>AssumeRoleWithSAML</code> can result in an entry in your CloudTrail
|
||
logs. The entry includes the value in the <code>NameID</code> element of the SAML
|
||
assertion. We recommend that you use a <code>NameIDType</code> that is not associated
|
||
with any personally identifiable information (PII). For example, you could instead
|
||
use the persistent identifier (<code>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</code>).
|
||
</para>
|
||
</important>
|
||
<para>
|
||
<b>Tags</b>
|
||
</para>
|
||
|
||
<para>
|
||
(Optional) You can configure your IdP to pass attributes into your SAML assertion
|
||
as session tags. Each session tag consists of a key name and an associated value.
|
||
For more information about session tags, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html">Passing
|
||
Session Tags in STS</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
You can pass up to 50 session tags. The plaintext session tag keys can’t exceed 128
|
||
characters and the values can’t exceed 256 characters. For these and additional limits,
|
||
see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-limits.html#reference_iam-limits-entity-length">IAM
|
||
and STS Character Limits</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
<note>
|
||
<para>
|
||
An Amazon Web Services conversion compresses the passed session policies and session
|
||
tags into a packed binary format that has a separate limit. Your request can fail
|
||
for this limit even if your plaintext meets the other requirements. The <code>PackedPolicySize</code>
|
||
response element indicates by percentage how close the policies and tags for your
|
||
request are to the upper size limit.
|
||
</para>
|
||
</note>
|
||
<para>
|
||
You can pass a session tag with the same key as a tag that is attached to the role.
|
||
When you do, session tags override the role's tags with the same key.
|
||
</para>
|
||
|
||
<para>
|
||
An administrator must grant you the permissions necessary to pass session tags. The
|
||
administrator can also create granular permissions to allow you to pass only specific
|
||
session tags. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_attribute-based-access-control.html">Tutorial:
|
||
Using Tags for Attribute-Based Access Control</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
You can set the session tags as transitive. Transitive tags persist during role chaining.
|
||
For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html#id_session-tags_role-chaining">Chaining
|
||
Roles with Session Tags</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
<b>SAML Configuration</b>
|
||
</para>
|
||
|
||
<para>
|
||
Before your application can call <code>AssumeRoleWithSAML</code>, you must configure
|
||
your SAML identity provider (IdP) to issue the claims required by Amazon Web Services.
|
||
Additionally, you must use Identity and Access Management (IAM) to create a SAML provider
|
||
entity in your Amazon Web Services account that represents your identity provider.
|
||
You must also create an IAM role that specifies this SAML provider in its trust policy.
|
||
|
||
</para>
|
||
|
||
<para>
|
||
For more information, see the following resources:
|
||
</para>
|
||
<ul> <li>
|
||
<para>
|
||
<a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_saml.html">About
|
||
SAML 2.0-based Federation</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
</li> <li>
|
||
<para>
|
||
<a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_saml.html">Creating
|
||
SAML Identity Providers</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
</li> <li>
|
||
<para>
|
||
<a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_saml_relying-party.html">Configuring
|
||
a Relying Party and Claims</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
</li> <li>
|
||
<para>
|
||
<a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-idp_saml.html">Creating
|
||
a Role for SAML 2.0 Federation</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
</li> </ul>
|
||
</summary>
|
||
<param name="request">Container for the necessary parameters to execute the AssumeRoleWithSAML service method.</param>
|
||
|
||
<returns>The response from the AssumeRoleWithSAML service method, as returned by SecurityTokenService.</returns>
|
||
<exception cref="T:Amazon.SecurityToken.Model.ExpiredTokenException">
|
||
The web identity token that was passed is expired or is not valid. Get a new identity
|
||
token from the identity provider and then retry the request.
|
||
</exception>
|
||
<exception cref="T:Amazon.SecurityToken.Model.IDPRejectedClaimException">
|
||
The identity provider (IdP) reported that authentication failed. This might be because
|
||
the claim is invalid.
|
||
|
||
|
||
<para>
|
||
If this error is returned for the <code>AssumeRoleWithWebIdentity</code> operation,
|
||
it can also mean that the claim has expired or has been explicitly revoked.
|
||
</para>
|
||
</exception>
|
||
<exception cref="T:Amazon.SecurityToken.Model.InvalidIdentityTokenException">
|
||
The web identity token that was passed could not be validated by Amazon Web Services.
|
||
Get a new identity token from the identity provider and then retry the request.
|
||
</exception>
|
||
<exception cref="T:Amazon.SecurityToken.Model.MalformedPolicyDocumentException">
|
||
The request was rejected because the policy document was malformed. The error message
|
||
describes the specific error.
|
||
</exception>
|
||
<exception cref="T:Amazon.SecurityToken.Model.PackedPolicyTooLargeException">
|
||
The request was rejected because the total packed size of the session policies and
|
||
session tags combined was too large. An Amazon Web Services conversion compresses
|
||
the session policy document, session policy ARNs, and session tags into a packed binary
|
||
format that has a separate limit. The error message indicates by percentage how close
|
||
the policies and tags are to the upper size limit. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html">Passing
|
||
Session Tags in STS</a> in the <i>IAM User Guide</i>.
|
||
|
||
|
||
<para>
|
||
You could receive this error even though you meet other defined session policy and
|
||
session tag limits. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html#reference_iam-limits-entity-length">IAM
|
||
and STS Entity Character Limits</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
</exception>
|
||
<exception cref="T:Amazon.SecurityToken.Model.RegionDisabledException">
|
||
STS is not activated in the requested region for the account that is being asked to
|
||
generate credentials. The account administrator must use the IAM console to activate
|
||
STS in that region. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html">Activating
|
||
and Deactivating Amazon Web Services STS in an Amazon Web Services Region</a> in the
|
||
<i>IAM User Guide</i>.
|
||
</exception>
|
||
<seealso href="http://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/AssumeRoleWithSAML">REST API Reference for AssumeRoleWithSAML Operation</seealso>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.IAmazonSecurityTokenService.BeginAssumeRoleWithSAML(Amazon.SecurityToken.Model.AssumeRoleWithSAMLRequest,System.AsyncCallback,System.Object)">
|
||
<summary>
|
||
Initiates the asynchronous execution of the AssumeRoleWithSAML operation.
|
||
</summary>
|
||
|
||
<param name="request">Container for the necessary parameters to execute the AssumeRoleWithSAML operation on AmazonSecurityTokenServiceClient.</param>
|
||
<param name="callback">An AsyncCallback delegate that is invoked when the operation completes.</param>
|
||
<param name="state">A user-defined state object that is passed to the callback procedure. Retrieve this object from within the callback
|
||
procedure using the AsyncState property.</param>
|
||
|
||
<returns>An IAsyncResult that can be used to poll or wait for results, or both; this value is also needed when invoking EndAssumeRoleWithSAML
|
||
operation.</returns>
|
||
<seealso href="http://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/AssumeRoleWithSAML">REST API Reference for AssumeRoleWithSAML Operation</seealso>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.IAmazonSecurityTokenService.EndAssumeRoleWithSAML(System.IAsyncResult)">
|
||
<summary>
|
||
Finishes the asynchronous execution of the AssumeRoleWithSAML operation.
|
||
</summary>
|
||
|
||
<param name="asyncResult">The IAsyncResult returned by the call to BeginAssumeRoleWithSAML.</param>
|
||
|
||
<returns>Returns a AssumeRoleWithSAMLResult from SecurityTokenService.</returns>
|
||
<seealso href="http://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/AssumeRoleWithSAML">REST API Reference for AssumeRoleWithSAML Operation</seealso>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.IAmazonSecurityTokenService.AssumeRoleWithWebIdentity(Amazon.SecurityToken.Model.AssumeRoleWithWebIdentityRequest)">
|
||
<summary>
|
||
Returns a set of temporary security credentials for users who have been authenticated
|
||
in a mobile or web application with a web identity provider. Example providers include
|
||
the OAuth 2.0 providers Login with Amazon and Facebook, or any OpenID Connect-compatible
|
||
identity provider such as Google or <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-identity.html">Amazon
|
||
Cognito federated identities</a>.
|
||
|
||
<note>
|
||
<para>
|
||
For mobile applications, we recommend that you use Amazon Cognito. You can use Amazon
|
||
Cognito with the <a href="http://aws.amazon.com/sdkforios/">Amazon Web Services SDK
|
||
for iOS Developer Guide</a> and the <a href="http://aws.amazon.com/sdkforandroid/">Amazon
|
||
Web Services SDK for Android Developer Guide</a> to uniquely identify a user. You
|
||
can also supply the user with a consistent identity throughout the lifetime of an
|
||
application.
|
||
</para>
|
||
|
||
<para>
|
||
To learn more about Amazon Cognito, see <a href="https://docs.aws.amazon.com/mobile/sdkforandroid/developerguide/cognito-auth.html#d0e840">Amazon
|
||
Cognito Overview</a> in <i>Amazon Web Services SDK for Android Developer Guide</i>
|
||
and <a href="https://docs.aws.amazon.com/mobile/sdkforios/developerguide/cognito-auth.html#d0e664">Amazon
|
||
Cognito Overview</a> in the <i>Amazon Web Services SDK for iOS Developer Guide</i>.
|
||
</para>
|
||
</note>
|
||
<para>
|
||
Calling <code>AssumeRoleWithWebIdentity</code> does not require the use of Amazon
|
||
Web Services security credentials. Therefore, you can distribute an application (for
|
||
example, on mobile devices) that requests temporary security credentials without including
|
||
long-term Amazon Web Services credentials in the application. You also don't need
|
||
to deploy server-based proxy services that use long-term Amazon Web Services credentials.
|
||
Instead, the identity of the caller is validated by using a token from the web identity
|
||
provider. For a comparison of <code>AssumeRoleWithWebIdentity</code> with the other
|
||
API operations that produce temporary credentials, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html">Requesting
|
||
Temporary Security Credentials</a> and <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#stsapi_comparison">Comparing
|
||
the Amazon Web Services STS API operations</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
The temporary security credentials returned by this API consist of an access key ID,
|
||
a secret access key, and a security token. Applications can use these temporary security
|
||
credentials to sign calls to Amazon Web Services service API operations.
|
||
</para>
|
||
|
||
<para>
|
||
<b>Session Duration</b>
|
||
</para>
|
||
|
||
<para>
|
||
By default, the temporary security credentials created by <code>AssumeRoleWithWebIdentity</code>
|
||
last for one hour. However, you can use the optional <code>DurationSeconds</code>
|
||
parameter to specify the duration of your session. You can provide a value from 900
|
||
seconds (15 minutes) up to the maximum session duration setting for the role. This
|
||
setting can have a value from 1 hour to 12 hours. To learn how to view the maximum
|
||
value for your role, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html#id_roles_use_view-role-max-session">View
|
||
the Maximum Session Duration Setting for a Role</a> in the <i>IAM User Guide</i>.
|
||
The maximum session duration limit applies when you use the <code>AssumeRole*</code>
|
||
API operations or the <code>assume-role*</code> CLI commands. However the limit does
|
||
not apply when you use those operations to create a console URL. For more information,
|
||
see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html">Using
|
||
IAM Roles</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
<b>Permissions</b>
|
||
</para>
|
||
|
||
<para>
|
||
The temporary security credentials created by <code>AssumeRoleWithWebIdentity</code>
|
||
can be used to make API calls to any Amazon Web Services service with the following
|
||
exception: you cannot call the STS <code>GetFederationToken</code> or <code>GetSessionToken</code>
|
||
API operations.
|
||
</para>
|
||
|
||
<para>
|
||
(Optional) You can pass inline or managed <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">session
|
||
policies</a> to this operation. You can pass a single JSON policy document to use
|
||
as an inline session policy. You can also specify up to 10 managed policies to use
|
||
as managed session policies. The plaintext that you use for both inline and managed
|
||
session policies can't exceed 2,048 characters. Passing policies to this operation
|
||
returns new temporary credentials. The resulting session's permissions are the intersection
|
||
of the role's identity-based policy and the session policies. You can use the role's
|
||
temporary credentials in subsequent Amazon Web Services API calls to access resources
|
||
in the account that owns the role. You cannot use session policies to grant more permissions
|
||
than those allowed by the identity-based policy of the role that is being assumed.
|
||
For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">Session
|
||
Policies</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
<b>Tags</b>
|
||
</para>
|
||
|
||
<para>
|
||
(Optional) You can configure your IdP to pass attributes into your web identity token
|
||
as session tags. Each session tag consists of a key name and an associated value.
|
||
For more information about session tags, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html">Passing
|
||
Session Tags in STS</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
You can pass up to 50 session tags. The plaintext session tag keys can’t exceed 128
|
||
characters and the values can’t exceed 256 characters. For these and additional limits,
|
||
see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-limits.html#reference_iam-limits-entity-length">IAM
|
||
and STS Character Limits</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
<note>
|
||
<para>
|
||
An Amazon Web Services conversion compresses the passed session policies and session
|
||
tags into a packed binary format that has a separate limit. Your request can fail
|
||
for this limit even if your plaintext meets the other requirements. The <code>PackedPolicySize</code>
|
||
response element indicates by percentage how close the policies and tags for your
|
||
request are to the upper size limit.
|
||
</para>
|
||
</note>
|
||
<para>
|
||
You can pass a session tag with the same key as a tag that is attached to the role.
|
||
When you do, the session tag overrides the role tag with the same key.
|
||
</para>
|
||
|
||
<para>
|
||
An administrator must grant you the permissions necessary to pass session tags. The
|
||
administrator can also create granular permissions to allow you to pass only specific
|
||
session tags. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_attribute-based-access-control.html">Tutorial:
|
||
Using Tags for Attribute-Based Access Control</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
You can set the session tags as transitive. Transitive tags persist during role chaining.
|
||
For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html#id_session-tags_role-chaining">Chaining
|
||
Roles with Session Tags</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
<b>Identities</b>
|
||
</para>
|
||
|
||
<para>
|
||
Before your application can call <code>AssumeRoleWithWebIdentity</code>, you must
|
||
have an identity token from a supported identity provider and create a role that the
|
||
application can assume. The role that your application assumes must trust the identity
|
||
provider that is associated with the identity token. In other words, the identity
|
||
provider must be specified in the role's trust policy.
|
||
</para>
|
||
<important>
|
||
<para>
|
||
Calling <code>AssumeRoleWithWebIdentity</code> can result in an entry in your CloudTrail
|
||
logs. The entry includes the <a href="http://openid.net/specs/openid-connect-core-1_0.html#Claims">Subject</a>
|
||
of the provided web identity token. We recommend that you avoid using any personally
|
||
identifiable information (PII) in this field. For example, you could instead use a
|
||
GUID or a pairwise identifier, as <a href="http://openid.net/specs/openid-connect-core-1_0.html#SubjectIDTypes">suggested
|
||
in the OIDC specification</a>.
|
||
</para>
|
||
</important>
|
||
<para>
|
||
For more information about how to use web identity federation and the <code>AssumeRoleWithWebIdentity</code>
|
||
API, see the following resources:
|
||
</para>
|
||
<ul> <li>
|
||
<para>
|
||
<a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_oidc_manual.html">Using
|
||
Web Identity Federation API Operations for Mobile Apps</a> and <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#api_assumerolewithwebidentity">Federation
|
||
Through a Web-based Identity Provider</a>.
|
||
</para>
|
||
</li> <li>
|
||
<para>
|
||
<a href="https://aws.amazon.com/blogs/aws/the-aws-web-identity-federation-playground/">
|
||
Web Identity Federation Playground</a>. Walk through the process of authenticating
|
||
through Login with Amazon, Facebook, or Google, getting temporary security credentials,
|
||
and then using those credentials to make a request to Amazon Web Services.
|
||
</para>
|
||
</li> <li>
|
||
<para>
|
||
<a href="http://aws.amazon.com/sdkforios/">Amazon Web Services SDK for iOS Developer
|
||
Guide</a> and <a href="http://aws.amazon.com/sdkforandroid/">Amazon Web Services SDK
|
||
for Android Developer Guide</a>. These toolkits contain sample apps that show how
|
||
to invoke the identity providers. The toolkits then show how to use the information
|
||
from these providers to get and use temporary security credentials.
|
||
</para>
|
||
</li> <li>
|
||
<para>
|
||
<a href="http://aws.amazon.com/articles/web-identity-federation-with-mobile-applications">Web
|
||
Identity Federation with Mobile Applications</a>. This article discusses web identity
|
||
federation and shows an example of how to use web identity federation to get access
|
||
to content in Amazon S3.
|
||
</para>
|
||
</li> </ul>
|
||
</summary>
|
||
<param name="request">Container for the necessary parameters to execute the AssumeRoleWithWebIdentity service method.</param>
|
||
|
||
<returns>The response from the AssumeRoleWithWebIdentity service method, as returned by SecurityTokenService.</returns>
|
||
<exception cref="T:Amazon.SecurityToken.Model.ExpiredTokenException">
|
||
The web identity token that was passed is expired or is not valid. Get a new identity
|
||
token from the identity provider and then retry the request.
|
||
</exception>
|
||
<exception cref="T:Amazon.SecurityToken.Model.IDPCommunicationErrorException">
|
||
The request could not be fulfilled because the identity provider (IDP) that was asked
|
||
to verify the incoming identity token could not be reached. This is often a transient
|
||
error caused by network conditions. Retry the request a limited number of times so
|
||
that you don't exceed the request rate. If the error persists, the identity provider
|
||
might be down or not responding.
|
||
</exception>
|
||
<exception cref="T:Amazon.SecurityToken.Model.IDPRejectedClaimException">
|
||
The identity provider (IdP) reported that authentication failed. This might be because
|
||
the claim is invalid.
|
||
|
||
|
||
<para>
|
||
If this error is returned for the <code>AssumeRoleWithWebIdentity</code> operation,
|
||
it can also mean that the claim has expired or has been explicitly revoked.
|
||
</para>
|
||
</exception>
|
||
<exception cref="T:Amazon.SecurityToken.Model.InvalidIdentityTokenException">
|
||
The web identity token that was passed could not be validated by Amazon Web Services.
|
||
Get a new identity token from the identity provider and then retry the request.
|
||
</exception>
|
||
<exception cref="T:Amazon.SecurityToken.Model.MalformedPolicyDocumentException">
|
||
The request was rejected because the policy document was malformed. The error message
|
||
describes the specific error.
|
||
</exception>
|
||
<exception cref="T:Amazon.SecurityToken.Model.PackedPolicyTooLargeException">
|
||
The request was rejected because the total packed size of the session policies and
|
||
session tags combined was too large. An Amazon Web Services conversion compresses
|
||
the session policy document, session policy ARNs, and session tags into a packed binary
|
||
format that has a separate limit. The error message indicates by percentage how close
|
||
the policies and tags are to the upper size limit. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html">Passing
|
||
Session Tags in STS</a> in the <i>IAM User Guide</i>.
|
||
|
||
|
||
<para>
|
||
You could receive this error even though you meet other defined session policy and
|
||
session tag limits. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html#reference_iam-limits-entity-length">IAM
|
||
and STS Entity Character Limits</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
</exception>
|
||
<exception cref="T:Amazon.SecurityToken.Model.RegionDisabledException">
|
||
STS is not activated in the requested region for the account that is being asked to
|
||
generate credentials. The account administrator must use the IAM console to activate
|
||
STS in that region. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html">Activating
|
||
and Deactivating Amazon Web Services STS in an Amazon Web Services Region</a> in the
|
||
<i>IAM User Guide</i>.
|
||
</exception>
|
||
<seealso href="http://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/AssumeRoleWithWebIdentity">REST API Reference for AssumeRoleWithWebIdentity Operation</seealso>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.IAmazonSecurityTokenService.BeginAssumeRoleWithWebIdentity(Amazon.SecurityToken.Model.AssumeRoleWithWebIdentityRequest,System.AsyncCallback,System.Object)">
|
||
<summary>
|
||
Initiates the asynchronous execution of the AssumeRoleWithWebIdentity operation.
|
||
</summary>
|
||
|
||
<param name="request">Container for the necessary parameters to execute the AssumeRoleWithWebIdentity operation on AmazonSecurityTokenServiceClient.</param>
|
||
<param name="callback">An AsyncCallback delegate that is invoked when the operation completes.</param>
|
||
<param name="state">A user-defined state object that is passed to the callback procedure. Retrieve this object from within the callback
|
||
procedure using the AsyncState property.</param>
|
||
|
||
<returns>An IAsyncResult that can be used to poll or wait for results, or both; this value is also needed when invoking EndAssumeRoleWithWebIdentity
|
||
operation.</returns>
|
||
<seealso href="http://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/AssumeRoleWithWebIdentity">REST API Reference for AssumeRoleWithWebIdentity Operation</seealso>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.IAmazonSecurityTokenService.EndAssumeRoleWithWebIdentity(System.IAsyncResult)">
|
||
<summary>
|
||
Finishes the asynchronous execution of the AssumeRoleWithWebIdentity operation.
|
||
</summary>
|
||
|
||
<param name="asyncResult">The IAsyncResult returned by the call to BeginAssumeRoleWithWebIdentity.</param>
|
||
|
||
<returns>Returns a AssumeRoleWithWebIdentityResult from SecurityTokenService.</returns>
|
||
<seealso href="http://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/AssumeRoleWithWebIdentity">REST API Reference for AssumeRoleWithWebIdentity Operation</seealso>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.IAmazonSecurityTokenService.DecodeAuthorizationMessage(Amazon.SecurityToken.Model.DecodeAuthorizationMessageRequest)">
|
||
<summary>
|
||
Decodes additional information about the authorization status of a request from an
|
||
encoded message returned in response to an Amazon Web Services request.
|
||
|
||
|
||
<para>
|
||
For example, if a user is not authorized to perform an operation that he or she has
|
||
requested, the request returns a <code>Client.UnauthorizedOperation</code> response
|
||
(an HTTP 403 response). Some Amazon Web Services operations additionally return an
|
||
encoded message that can provide details about this authorization failure.
|
||
</para>
|
||
<note>
|
||
<para>
|
||
Only certain Amazon Web Services operations return an encoded authorization message.
|
||
The documentation for an individual operation indicates whether that operation returns
|
||
an encoded message in addition to returning an HTTP code.
|
||
</para>
|
||
</note>
|
||
<para>
|
||
The message is encoded because the details of the authorization status can contain
|
||
privileged information that the user who requested the operation should not see. To
|
||
decode an authorization status message, a user must be granted permissions through
|
||
an IAM <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html">policy</a>
|
||
to request the <code>DecodeAuthorizationMessage</code> (<code>sts:DecodeAuthorizationMessage</code>)
|
||
action.
|
||
</para>
|
||
|
||
<para>
|
||
The decoded message includes the following type of information:
|
||
</para>
|
||
<ul> <li>
|
||
<para>
|
||
Whether the request was denied due to an explicit deny or due to the absence of an
|
||
explicit allow. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html#policy-eval-denyallow">Determining
|
||
Whether a Request is Allowed or Denied</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
</li> <li>
|
||
<para>
|
||
The principal who made the request.
|
||
</para>
|
||
</li> <li>
|
||
<para>
|
||
The requested action.
|
||
</para>
|
||
</li> <li>
|
||
<para>
|
||
The requested resource.
|
||
</para>
|
||
</li> <li>
|
||
<para>
|
||
The values of condition keys in the context of the user's request.
|
||
</para>
|
||
</li> </ul>
|
||
</summary>
|
||
<param name="request">Container for the necessary parameters to execute the DecodeAuthorizationMessage service method.</param>
|
||
|
||
<returns>The response from the DecodeAuthorizationMessage service method, as returned by SecurityTokenService.</returns>
|
||
<exception cref="T:Amazon.SecurityToken.Model.InvalidAuthorizationMessageException">
|
||
The error returned if the message passed to <code>DecodeAuthorizationMessage</code>
|
||
was invalid. This can happen if the token contains invalid characters, such as linebreaks.
|
||
</exception>
|
||
<seealso href="http://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/DecodeAuthorizationMessage">REST API Reference for DecodeAuthorizationMessage Operation</seealso>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.IAmazonSecurityTokenService.BeginDecodeAuthorizationMessage(Amazon.SecurityToken.Model.DecodeAuthorizationMessageRequest,System.AsyncCallback,System.Object)">
|
||
<summary>
|
||
Initiates the asynchronous execution of the DecodeAuthorizationMessage operation.
|
||
</summary>
|
||
|
||
<param name="request">Container for the necessary parameters to execute the DecodeAuthorizationMessage operation on AmazonSecurityTokenServiceClient.</param>
|
||
<param name="callback">An AsyncCallback delegate that is invoked when the operation completes.</param>
|
||
<param name="state">A user-defined state object that is passed to the callback procedure. Retrieve this object from within the callback
|
||
procedure using the AsyncState property.</param>
|
||
|
||
<returns>An IAsyncResult that can be used to poll or wait for results, or both; this value is also needed when invoking EndDecodeAuthorizationMessage
|
||
operation.</returns>
|
||
<seealso href="http://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/DecodeAuthorizationMessage">REST API Reference for DecodeAuthorizationMessage Operation</seealso>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.IAmazonSecurityTokenService.EndDecodeAuthorizationMessage(System.IAsyncResult)">
|
||
<summary>
|
||
Finishes the asynchronous execution of the DecodeAuthorizationMessage operation.
|
||
</summary>
|
||
|
||
<param name="asyncResult">The IAsyncResult returned by the call to BeginDecodeAuthorizationMessage.</param>
|
||
|
||
<returns>Returns a DecodeAuthorizationMessageResult from SecurityTokenService.</returns>
|
||
<seealso href="http://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/DecodeAuthorizationMessage">REST API Reference for DecodeAuthorizationMessage Operation</seealso>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.IAmazonSecurityTokenService.GetAccessKeyInfo(Amazon.SecurityToken.Model.GetAccessKeyInfoRequest)">
|
||
<summary>
|
||
Returns the account identifier for the specified access key ID.
|
||
|
||
|
||
<para>
|
||
Access keys consist of two parts: an access key ID (for example, <code>AKIAIOSFODNN7EXAMPLE</code>)
|
||
and a secret access key (for example, <code>wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY</code>).
|
||
For more information about access keys, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html">Managing
|
||
Access Keys for IAM Users</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
When you pass an access key ID to this operation, it returns the ID of the Amazon
|
||
Web Services account to which the keys belong. Access key IDs beginning with <code>AKIA</code>
|
||
are long-term credentials for an IAM user or the Amazon Web Services account root
|
||
user. Access key IDs beginning with <code>ASIA</code> are temporary credentials that
|
||
are created using STS operations. If the account in the response belongs to you, you
|
||
can sign in as the root user and review your root user access keys. Then, you can
|
||
pull a <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_getting-report.html">credentials
|
||
report</a> to learn which IAM user owns the keys. To learn who requested the temporary
|
||
credentials for an <code>ASIA</code> access key, view the STS events in your <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html">CloudTrail
|
||
logs</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
This operation does not indicate the state of the access key. The key might be active,
|
||
inactive, or deleted. Active keys might not have permissions to perform an operation.
|
||
Providing a deleted access key might return an error that the key doesn't exist.
|
||
</para>
|
||
</summary>
|
||
<param name="request">Container for the necessary parameters to execute the GetAccessKeyInfo service method.</param>
|
||
|
||
<returns>The response from the GetAccessKeyInfo service method, as returned by SecurityTokenService.</returns>
|
||
<seealso href="http://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/GetAccessKeyInfo">REST API Reference for GetAccessKeyInfo Operation</seealso>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.IAmazonSecurityTokenService.BeginGetAccessKeyInfo(Amazon.SecurityToken.Model.GetAccessKeyInfoRequest,System.AsyncCallback,System.Object)">
|
||
<summary>
|
||
Initiates the asynchronous execution of the GetAccessKeyInfo operation.
|
||
</summary>
|
||
|
||
<param name="request">Container for the necessary parameters to execute the GetAccessKeyInfo operation on AmazonSecurityTokenServiceClient.</param>
|
||
<param name="callback">An AsyncCallback delegate that is invoked when the operation completes.</param>
|
||
<param name="state">A user-defined state object that is passed to the callback procedure. Retrieve this object from within the callback
|
||
procedure using the AsyncState property.</param>
|
||
|
||
<returns>An IAsyncResult that can be used to poll or wait for results, or both; this value is also needed when invoking EndGetAccessKeyInfo
|
||
operation.</returns>
|
||
<seealso href="http://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/GetAccessKeyInfo">REST API Reference for GetAccessKeyInfo Operation</seealso>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.IAmazonSecurityTokenService.EndGetAccessKeyInfo(System.IAsyncResult)">
|
||
<summary>
|
||
Finishes the asynchronous execution of the GetAccessKeyInfo operation.
|
||
</summary>
|
||
|
||
<param name="asyncResult">The IAsyncResult returned by the call to BeginGetAccessKeyInfo.</param>
|
||
|
||
<returns>Returns a GetAccessKeyInfoResult from SecurityTokenService.</returns>
|
||
<seealso href="http://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/GetAccessKeyInfo">REST API Reference for GetAccessKeyInfo Operation</seealso>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.IAmazonSecurityTokenService.GetCallerIdentity(Amazon.SecurityToken.Model.GetCallerIdentityRequest)">
|
||
<summary>
|
||
Returns details about the IAM user or role whose credentials are used to call the
|
||
operation.
|
||
|
||
<note>
|
||
<para>
|
||
No permissions are required to perform this operation. If an administrator adds a
|
||
policy to your IAM user or role that explicitly denies access to the <code>sts:GetCallerIdentity</code>
|
||
action, you can still perform this operation. Permissions are not required because
|
||
the same information is returned when an IAM user or role is denied access. To view
|
||
an example response, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_access-denied-delete-mfa">I
|
||
Am Not Authorized to Perform: iam:DeleteVirtualMFADevice</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
</note>
|
||
</summary>
|
||
<param name="request">Container for the necessary parameters to execute the GetCallerIdentity service method.</param>
|
||
|
||
<returns>The response from the GetCallerIdentity service method, as returned by SecurityTokenService.</returns>
|
||
<seealso href="http://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/GetCallerIdentity">REST API Reference for GetCallerIdentity Operation</seealso>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.IAmazonSecurityTokenService.BeginGetCallerIdentity(Amazon.SecurityToken.Model.GetCallerIdentityRequest,System.AsyncCallback,System.Object)">
|
||
<summary>
|
||
Initiates the asynchronous execution of the GetCallerIdentity operation.
|
||
</summary>
|
||
|
||
<param name="request">Container for the necessary parameters to execute the GetCallerIdentity operation on AmazonSecurityTokenServiceClient.</param>
|
||
<param name="callback">An AsyncCallback delegate that is invoked when the operation completes.</param>
|
||
<param name="state">A user-defined state object that is passed to the callback procedure. Retrieve this object from within the callback
|
||
procedure using the AsyncState property.</param>
|
||
|
||
<returns>An IAsyncResult that can be used to poll or wait for results, or both; this value is also needed when invoking EndGetCallerIdentity
|
||
operation.</returns>
|
||
<seealso href="http://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/GetCallerIdentity">REST API Reference for GetCallerIdentity Operation</seealso>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.IAmazonSecurityTokenService.EndGetCallerIdentity(System.IAsyncResult)">
|
||
<summary>
|
||
Finishes the asynchronous execution of the GetCallerIdentity operation.
|
||
</summary>
|
||
|
||
<param name="asyncResult">The IAsyncResult returned by the call to BeginGetCallerIdentity.</param>
|
||
|
||
<returns>Returns a GetCallerIdentityResult from SecurityTokenService.</returns>
|
||
<seealso href="http://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/GetCallerIdentity">REST API Reference for GetCallerIdentity Operation</seealso>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.IAmazonSecurityTokenService.GetFederationToken(Amazon.SecurityToken.Model.GetFederationTokenRequest)">
|
||
<summary>
|
||
Returns a set of temporary security credentials (consisting of an access key ID, a
|
||
secret access key, and a security token) for a federated user. A typical use is in
|
||
a proxy application that gets temporary security credentials on behalf of distributed
|
||
applications inside a corporate network. You must call the <code>GetFederationToken</code>
|
||
operation using the long-term security credentials of an IAM user. As a result, this
|
||
call is appropriate in contexts where those credentials can be safely stored, usually
|
||
in a server-based application. For a comparison of <code>GetFederationToken</code>
|
||
with the other API operations that produce temporary credentials, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html">Requesting
|
||
Temporary Security Credentials</a> and <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#stsapi_comparison">Comparing
|
||
the Amazon Web Services STS API operations</a> in the <i>IAM User Guide</i>.
|
||
|
||
<note>
|
||
<para>
|
||
You can create a mobile-based or browser-based app that can authenticate users using
|
||
a web identity provider like Login with Amazon, Facebook, Google, or an OpenID Connect-compatible
|
||
identity provider. In this case, we recommend that you use <a href="http://aws.amazon.com/cognito/">Amazon
|
||
Cognito</a> or <code>AssumeRoleWithWebIdentity</code>. For more information, see <a
|
||
href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#api_assumerolewithwebidentity">Federation
|
||
Through a Web-based Identity Provider</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
</note>
|
||
<para>
|
||
You can also call <code>GetFederationToken</code> using the security credentials of
|
||
an Amazon Web Services account root user, but we do not recommend it. Instead, we
|
||
recommend that you create an IAM user for the purpose of the proxy application. Then
|
||
attach a policy to the IAM user that limits federated users to only the actions and
|
||
resources that they need to access. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html">IAM
|
||
Best Practices</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
<b>Session duration</b>
|
||
</para>
|
||
|
||
<para>
|
||
The temporary credentials are valid for the specified duration, from 900 seconds (15
|
||
minutes) up to a maximum of 129,600 seconds (36 hours). The default session duration
|
||
is 43,200 seconds (12 hours). Temporary credentials obtained by using the Amazon Web
|
||
Services account root user credentials have a maximum duration of 3,600 seconds (1
|
||
hour).
|
||
</para>
|
||
|
||
<para>
|
||
<b>Permissions</b>
|
||
</para>
|
||
|
||
<para>
|
||
You can use the temporary credentials created by <code>GetFederationToken</code> in
|
||
any Amazon Web Services service except the following:
|
||
</para>
|
||
<ul> <li>
|
||
<para>
|
||
You cannot call any IAM operations using the CLI or the Amazon Web Services API.
|
||
</para>
|
||
</li> <li>
|
||
<para>
|
||
You cannot call any STS operations except <code>GetCallerIdentity</code>.
|
||
</para>
|
||
</li> </ul>
|
||
<para>
|
||
You must pass an inline or managed <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">session
|
||
policy</a> to this operation. You can pass a single JSON policy document to use as
|
||
an inline session policy. You can also specify up to 10 managed policies to use as
|
||
managed session policies. The plaintext that you use for both inline and managed session
|
||
policies can't exceed 2,048 characters.
|
||
</para>
|
||
|
||
<para>
|
||
Though the session policy parameters are optional, if you do not pass a policy, then
|
||
the resulting federated user session has no permissions. When you pass session policies,
|
||
the session permissions are the intersection of the IAM user policies and the session
|
||
policies that you pass. This gives you a way to further restrict the permissions for
|
||
a federated user. You cannot use session policies to grant more permissions than those
|
||
that are defined in the permissions policy of the IAM user. For more information,
|
||
see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">Session
|
||
Policies</a> in the <i>IAM User Guide</i>. For information about using <code>GetFederationToken</code>
|
||
to create temporary security credentials, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#api_getfederationtoken">GetFederationToken—Federation
|
||
Through a Custom Identity Broker</a>.
|
||
</para>
|
||
|
||
<para>
|
||
You can use the credentials to access a resource that has a resource-based policy.
|
||
If that policy specifically references the federated user session in the <code>Principal</code>
|
||
element of the policy, the session has the permissions allowed by the policy. These
|
||
permissions are granted in addition to the permissions granted by the session policies.
|
||
</para>
|
||
|
||
<para>
|
||
<b>Tags</b>
|
||
</para>
|
||
|
||
<para>
|
||
(Optional) You can pass tag key-value pairs to your session. These are called session
|
||
tags. For more information about session tags, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html">Passing
|
||
Session Tags in STS</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
<note>
|
||
<para>
|
||
You can create a mobile-based or browser-based app that can authenticate users using
|
||
a web identity provider like Login with Amazon, Facebook, Google, or an OpenID Connect-compatible
|
||
identity provider. In this case, we recommend that you use <a href="http://aws.amazon.com/cognito/">Amazon
|
||
Cognito</a> or <code>AssumeRoleWithWebIdentity</code>. For more information, see <a
|
||
href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#api_assumerolewithwebidentity">Federation
|
||
Through a Web-based Identity Provider</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
</note>
|
||
<para>
|
||
An administrator must grant you the permissions necessary to pass session tags. The
|
||
administrator can also create granular permissions to allow you to pass only specific
|
||
session tags. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_attribute-based-access-control.html">Tutorial:
|
||
Using Tags for Attribute-Based Access Control</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
Tag key–value pairs are not case sensitive, but case is preserved. This means that
|
||
you cannot have separate <code>Department</code> and <code>department</code> tag keys.
|
||
Assume that the user that you are federating has the <code>Department</code>=<code>Marketing</code>
|
||
tag and you pass the <code>department</code>=<code>engineering</code> session tag.
|
||
<code>Department</code> and <code>department</code> are not saved as separate tags,
|
||
and the session tag passed in the request takes precedence over the user tag.
|
||
</para>
|
||
</summary>
|
||
<param name="request">Container for the necessary parameters to execute the GetFederationToken service method.</param>
|
||
|
||
<returns>The response from the GetFederationToken service method, as returned by SecurityTokenService.</returns>
|
||
<exception cref="T:Amazon.SecurityToken.Model.MalformedPolicyDocumentException">
|
||
The request was rejected because the policy document was malformed. The error message
|
||
describes the specific error.
|
||
</exception>
|
||
<exception cref="T:Amazon.SecurityToken.Model.PackedPolicyTooLargeException">
|
||
The request was rejected because the total packed size of the session policies and
|
||
session tags combined was too large. An Amazon Web Services conversion compresses
|
||
the session policy document, session policy ARNs, and session tags into a packed binary
|
||
format that has a separate limit. The error message indicates by percentage how close
|
||
the policies and tags are to the upper size limit. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html">Passing
|
||
Session Tags in STS</a> in the <i>IAM User Guide</i>.
|
||
|
||
|
||
<para>
|
||
You could receive this error even though you meet other defined session policy and
|
||
session tag limits. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html#reference_iam-limits-entity-length">IAM
|
||
and STS Entity Character Limits</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
</exception>
|
||
<exception cref="T:Amazon.SecurityToken.Model.RegionDisabledException">
|
||
STS is not activated in the requested region for the account that is being asked to
|
||
generate credentials. The account administrator must use the IAM console to activate
|
||
STS in that region. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html">Activating
|
||
and Deactivating Amazon Web Services STS in an Amazon Web Services Region</a> in the
|
||
<i>IAM User Guide</i>.
|
||
</exception>
|
||
<seealso href="http://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/GetFederationToken">REST API Reference for GetFederationToken Operation</seealso>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.IAmazonSecurityTokenService.BeginGetFederationToken(Amazon.SecurityToken.Model.GetFederationTokenRequest,System.AsyncCallback,System.Object)">
|
||
<summary>
|
||
Initiates the asynchronous execution of the GetFederationToken operation.
|
||
</summary>
|
||
|
||
<param name="request">Container for the necessary parameters to execute the GetFederationToken operation on AmazonSecurityTokenServiceClient.</param>
|
||
<param name="callback">An AsyncCallback delegate that is invoked when the operation completes.</param>
|
||
<param name="state">A user-defined state object that is passed to the callback procedure. Retrieve this object from within the callback
|
||
procedure using the AsyncState property.</param>
|
||
|
||
<returns>An IAsyncResult that can be used to poll or wait for results, or both; this value is also needed when invoking EndGetFederationToken
|
||
operation.</returns>
|
||
<seealso href="http://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/GetFederationToken">REST API Reference for GetFederationToken Operation</seealso>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.IAmazonSecurityTokenService.EndGetFederationToken(System.IAsyncResult)">
|
||
<summary>
|
||
Finishes the asynchronous execution of the GetFederationToken operation.
|
||
</summary>
|
||
|
||
<param name="asyncResult">The IAsyncResult returned by the call to BeginGetFederationToken.</param>
|
||
|
||
<returns>Returns a GetFederationTokenResult from SecurityTokenService.</returns>
|
||
<seealso href="http://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/GetFederationToken">REST API Reference for GetFederationToken Operation</seealso>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.IAmazonSecurityTokenService.GetSessionToken">
|
||
<summary>
|
||
Returns a set of temporary credentials for an Amazon Web Services account or IAM user.
|
||
The credentials consist of an access key ID, a secret access key, and a security token.
|
||
Typically, you use <code>GetSessionToken</code> if you want to use MFA to protect
|
||
programmatic calls to specific Amazon Web Services API operations like Amazon EC2
|
||
<code>StopInstances</code>. MFA-enabled IAM users would need to call <code>GetSessionToken</code>
|
||
and submit an MFA code that is associated with their MFA device. Using the temporary
|
||
security credentials that are returned from the call, IAM users can then make programmatic
|
||
calls to API operations that require MFA authentication. If you do not supply a correct
|
||
MFA code, then the API returns an access denied error. For a comparison of <code>GetSessionToken</code>
|
||
with the other API operations that produce temporary credentials, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html">Requesting
|
||
Temporary Security Credentials</a> and <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#stsapi_comparison">Comparing
|
||
the Amazon Web Services STS API operations</a> in the <i>IAM User Guide</i>.
|
||
|
||
<note>
|
||
<para>
|
||
No permissions are required for users to perform this operation. The purpose of the
|
||
<code>sts:GetSessionToken</code> operation is to authenticate the user using MFA.
|
||
You cannot use policies to control authentication operations. For more information,
|
||
see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_getsessiontoken.html">Permissions
|
||
for GetSessionToken</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
</note>
|
||
<para>
|
||
<b>Session Duration</b>
|
||
</para>
|
||
|
||
<para>
|
||
The <code>GetSessionToken</code> operation must be called by using the long-term Amazon
|
||
Web Services security credentials of the Amazon Web Services account root user or
|
||
an IAM user. Credentials that are created by IAM users are valid for the duration
|
||
that you specify. This duration can range from 900 seconds (15 minutes) up to a maximum
|
||
of 129,600 seconds (36 hours), with a default of 43,200 seconds (12 hours). Credentials
|
||
based on account credentials can range from 900 seconds (15 minutes) up to 3,600 seconds
|
||
(1 hour), with a default of 1 hour.
|
||
</para>
|
||
|
||
<para>
|
||
<b>Permissions</b>
|
||
</para>
|
||
|
||
<para>
|
||
The temporary security credentials created by <code>GetSessionToken</code> can be
|
||
used to make API calls to any Amazon Web Services service with the following exceptions:
|
||
</para>
|
||
<ul> <li>
|
||
<para>
|
||
You cannot call any IAM API operations unless MFA authentication information is included
|
||
in the request.
|
||
</para>
|
||
</li> <li>
|
||
<para>
|
||
You cannot call any STS API <i>except</i> <code>AssumeRole</code> or <code>GetCallerIdentity</code>.
|
||
</para>
|
||
</li> </ul> <note>
|
||
<para>
|
||
We recommend that you do not call <code>GetSessionToken</code> with Amazon Web Services
|
||
account root user credentials. Instead, follow our <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#create-iam-users">best
|
||
practices</a> by creating one or more IAM users, giving them the necessary permissions,
|
||
and using IAM users for everyday interaction with Amazon Web Services.
|
||
</para>
|
||
</note>
|
||
<para>
|
||
The credentials that are returned by <code>GetSessionToken</code> are based on permissions
|
||
associated with the user whose credentials were used to call the operation. If <code>GetSessionToken</code>
|
||
is called using Amazon Web Services account root user credentials, the temporary credentials
|
||
have root user permissions. Similarly, if <code>GetSessionToken</code> is called using
|
||
the credentials of an IAM user, the temporary credentials have the same permissions
|
||
as the IAM user.
|
||
</para>
|
||
|
||
<para>
|
||
For more information about using <code>GetSessionToken</code> to create temporary
|
||
credentials, go to <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#api_getsessiontoken">Temporary
|
||
Credentials for Users in Untrusted Environments</a> in the <i>IAM User Guide</i>.
|
||
|
||
</para>
|
||
</summary>
|
||
|
||
<returns>The response from the GetSessionToken service method, as returned by SecurityTokenService.</returns>
|
||
<exception cref="T:Amazon.SecurityToken.Model.RegionDisabledException">
|
||
STS is not activated in the requested region for the account that is being asked to
|
||
generate credentials. The account administrator must use the IAM console to activate
|
||
STS in that region. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html">Activating
|
||
and Deactivating Amazon Web Services STS in an Amazon Web Services Region</a> in the
|
||
<i>IAM User Guide</i>.
|
||
</exception>
|
||
<seealso href="http://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/GetSessionToken">REST API Reference for GetSessionToken Operation</seealso>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.IAmazonSecurityTokenService.GetSessionToken(Amazon.SecurityToken.Model.GetSessionTokenRequest)">
|
||
<summary>
|
||
Returns a set of temporary credentials for an Amazon Web Services account or IAM user.
|
||
The credentials consist of an access key ID, a secret access key, and a security token.
|
||
Typically, you use <code>GetSessionToken</code> if you want to use MFA to protect
|
||
programmatic calls to specific Amazon Web Services API operations like Amazon EC2
|
||
<code>StopInstances</code>. MFA-enabled IAM users would need to call <code>GetSessionToken</code>
|
||
and submit an MFA code that is associated with their MFA device. Using the temporary
|
||
security credentials that are returned from the call, IAM users can then make programmatic
|
||
calls to API operations that require MFA authentication. If you do not supply a correct
|
||
MFA code, then the API returns an access denied error. For a comparison of <code>GetSessionToken</code>
|
||
with the other API operations that produce temporary credentials, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html">Requesting
|
||
Temporary Security Credentials</a> and <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#stsapi_comparison">Comparing
|
||
the Amazon Web Services STS API operations</a> in the <i>IAM User Guide</i>.
|
||
|
||
<note>
|
||
<para>
|
||
No permissions are required for users to perform this operation. The purpose of the
|
||
<code>sts:GetSessionToken</code> operation is to authenticate the user using MFA.
|
||
You cannot use policies to control authentication operations. For more information,
|
||
see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_getsessiontoken.html">Permissions
|
||
for GetSessionToken</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
</note>
|
||
<para>
|
||
<b>Session Duration</b>
|
||
</para>
|
||
|
||
<para>
|
||
The <code>GetSessionToken</code> operation must be called by using the long-term Amazon
|
||
Web Services security credentials of the Amazon Web Services account root user or
|
||
an IAM user. Credentials that are created by IAM users are valid for the duration
|
||
that you specify. This duration can range from 900 seconds (15 minutes) up to a maximum
|
||
of 129,600 seconds (36 hours), with a default of 43,200 seconds (12 hours). Credentials
|
||
based on account credentials can range from 900 seconds (15 minutes) up to 3,600 seconds
|
||
(1 hour), with a default of 1 hour.
|
||
</para>
|
||
|
||
<para>
|
||
<b>Permissions</b>
|
||
</para>
|
||
|
||
<para>
|
||
The temporary security credentials created by <code>GetSessionToken</code> can be
|
||
used to make API calls to any Amazon Web Services service with the following exceptions:
|
||
</para>
|
||
<ul> <li>
|
||
<para>
|
||
You cannot call any IAM API operations unless MFA authentication information is included
|
||
in the request.
|
||
</para>
|
||
</li> <li>
|
||
<para>
|
||
You cannot call any STS API <i>except</i> <code>AssumeRole</code> or <code>GetCallerIdentity</code>.
|
||
</para>
|
||
</li> </ul> <note>
|
||
<para>
|
||
We recommend that you do not call <code>GetSessionToken</code> with Amazon Web Services
|
||
account root user credentials. Instead, follow our <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#create-iam-users">best
|
||
practices</a> by creating one or more IAM users, giving them the necessary permissions,
|
||
and using IAM users for everyday interaction with Amazon Web Services.
|
||
</para>
|
||
</note>
|
||
<para>
|
||
The credentials that are returned by <code>GetSessionToken</code> are based on permissions
|
||
associated with the user whose credentials were used to call the operation. If <code>GetSessionToken</code>
|
||
is called using Amazon Web Services account root user credentials, the temporary credentials
|
||
have root user permissions. Similarly, if <code>GetSessionToken</code> is called using
|
||
the credentials of an IAM user, the temporary credentials have the same permissions
|
||
as the IAM user.
|
||
</para>
|
||
|
||
<para>
|
||
For more information about using <code>GetSessionToken</code> to create temporary
|
||
credentials, go to <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#api_getsessiontoken">Temporary
|
||
Credentials for Users in Untrusted Environments</a> in the <i>IAM User Guide</i>.
|
||
|
||
</para>
|
||
</summary>
|
||
<param name="request">Container for the necessary parameters to execute the GetSessionToken service method.</param>
|
||
|
||
<returns>The response from the GetSessionToken service method, as returned by SecurityTokenService.</returns>
|
||
<exception cref="T:Amazon.SecurityToken.Model.RegionDisabledException">
|
||
STS is not activated in the requested region for the account that is being asked to
|
||
generate credentials. The account administrator must use the IAM console to activate
|
||
STS in that region. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html">Activating
|
||
and Deactivating Amazon Web Services STS in an Amazon Web Services Region</a> in the
|
||
<i>IAM User Guide</i>.
|
||
</exception>
|
||
<seealso href="http://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/GetSessionToken">REST API Reference for GetSessionToken Operation</seealso>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.IAmazonSecurityTokenService.BeginGetSessionToken(Amazon.SecurityToken.Model.GetSessionTokenRequest,System.AsyncCallback,System.Object)">
|
||
<summary>
|
||
Initiates the asynchronous execution of the GetSessionToken operation.
|
||
</summary>
|
||
|
||
<param name="request">Container for the necessary parameters to execute the GetSessionToken operation on AmazonSecurityTokenServiceClient.</param>
|
||
<param name="callback">An AsyncCallback delegate that is invoked when the operation completes.</param>
|
||
<param name="state">A user-defined state object that is passed to the callback procedure. Retrieve this object from within the callback
|
||
procedure using the AsyncState property.</param>
|
||
|
||
<returns>An IAsyncResult that can be used to poll or wait for results, or both; this value is also needed when invoking EndGetSessionToken
|
||
operation.</returns>
|
||
<seealso href="http://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/GetSessionToken">REST API Reference for GetSessionToken Operation</seealso>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.IAmazonSecurityTokenService.EndGetSessionToken(System.IAsyncResult)">
|
||
<summary>
|
||
Finishes the asynchronous execution of the GetSessionToken operation.
|
||
</summary>
|
||
|
||
<param name="asyncResult">The IAsyncResult returned by the call to BeginGetSessionToken.</param>
|
||
|
||
<returns>Returns a GetSessionTokenResult from SecurityTokenService.</returns>
|
||
<seealso href="http://docs.aws.amazon.com/goto/WebAPI/sts-2011-06-15/GetSessionToken">REST API Reference for GetSessionToken Operation</seealso>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.Credentials">
|
||
<summary>
|
||
<para>AWS credentials for API authentication.</para>
|
||
</summary>
|
||
<summary>
|
||
Amazon Web Services credentials for API authentication.
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Credentials.GetCredentials">
|
||
<summary>
|
||
Returns a copy of ImmutableCredentials corresponding to these credentials
|
||
</summary>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Credentials.#ctor">
|
||
<summary>
|
||
Empty constructor used to set properties independently even when a simple constructor is available
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Credentials.#ctor(System.String,System.String,System.String,System.DateTime)">
|
||
<summary>
|
||
Instantiates Credentials with the parameterized properties
|
||
</summary>
|
||
<param name="accessKeyId">The access key ID that identifies the temporary security credentials.</param>
|
||
<param name="secretAccessKey">The secret access key that can be used to sign requests.</param>
|
||
<param name="sessionToken">The token that users must pass to the service API to use the temporary credentials.</param>
|
||
<param name="expiration">The date on which the current credentials expire.</param>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.Credentials.AccessKeyId">
|
||
<summary>
|
||
Gets and sets the property AccessKeyId.
|
||
<para>
|
||
The access key ID that identifies the temporary security credentials.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.Credentials.Expiration">
|
||
<summary>
|
||
Gets and sets the property Expiration.
|
||
<para>
|
||
The date on which the current credentials expire.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.Credentials.SecretAccessKey">
|
||
<summary>
|
||
Gets and sets the property SecretAccessKey.
|
||
<para>
|
||
The secret access key that can be used to sign requests.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.Credentials.SessionToken">
|
||
<summary>
|
||
Gets and sets the property SessionToken.
|
||
<para>
|
||
The token that users must pass to the service API to use the temporary credentials.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.AssumedRoleUser">
|
||
<summary>
|
||
The identifiers for the temporary security credentials that the operation returns.
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.AssumedRoleUser.Arn">
|
||
<summary>
|
||
Gets and sets the property Arn.
|
||
<para>
|
||
The ARN of the temporary security credentials that are returned from the <a>AssumeRole</a>
|
||
action. For more information about ARNs and how to use them in policies, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html">IAM
|
||
Identifiers</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.AssumedRoleUser.AssumedRoleId">
|
||
<summary>
|
||
Gets and sets the property AssumedRoleId.
|
||
<para>
|
||
A unique identifier that contains the role ID and the role session name of the role
|
||
that is being assumed. The role ID is generated by Amazon Web Services when the role
|
||
is created.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.AssumeRoleRequest">
|
||
<summary>
|
||
Container for the parameters to the AssumeRole operation.
|
||
Returns a set of temporary security credentials that you can use to access Amazon
|
||
Web Services resources that you might not normally have access to. These temporary
|
||
credentials consist of an access key ID, a secret access key, and a security token.
|
||
Typically, you use <code>AssumeRole</code> within your account or for cross-account
|
||
access. For a comparison of <code>AssumeRole</code> with other API operations that
|
||
produce temporary credentials, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html">Requesting
|
||
Temporary Security Credentials</a> and <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#stsapi_comparison">Comparing
|
||
the Amazon Web Services STS API operations</a> in the <i>IAM User Guide</i>.
|
||
|
||
|
||
<para>
|
||
<b>Permissions</b>
|
||
</para>
|
||
|
||
<para>
|
||
The temporary security credentials created by <code>AssumeRole</code> can be used
|
||
to make API calls to any Amazon Web Services service with the following exception:
|
||
You cannot call the Amazon Web Services STS <code>GetFederationToken</code> or <code>GetSessionToken</code>
|
||
API operations.
|
||
</para>
|
||
|
||
<para>
|
||
(Optional) You can pass inline or managed <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">session
|
||
policies</a> to this operation. You can pass a single JSON policy document to use
|
||
as an inline session policy. You can also specify up to 10 managed policies to use
|
||
as managed session policies. The plaintext that you use for both inline and managed
|
||
session policies can't exceed 2,048 characters. Passing policies to this operation
|
||
returns new temporary credentials. The resulting session's permissions are the intersection
|
||
of the role's identity-based policy and the session policies. You can use the role's
|
||
temporary credentials in subsequent Amazon Web Services API calls to access resources
|
||
in the account that owns the role. You cannot use session policies to grant more permissions
|
||
than those allowed by the identity-based policy of the role that is being assumed.
|
||
For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">Session
|
||
Policies</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
When you create a role, you create two policies: A role trust policy that specifies
|
||
<i>who</i> can assume the role and a permissions policy that specifies <i>what</i>
|
||
can be done with the role. You specify the trusted principal who is allowed to assume
|
||
the role in the role trust policy.
|
||
</para>
|
||
|
||
<para>
|
||
To assume a role from a different account, your Amazon Web Services account must be
|
||
trusted by the role. The trust relationship is defined in the role's trust policy
|
||
when the role is created. That trust policy states which accounts are allowed to delegate
|
||
that access to users in the account.
|
||
</para>
|
||
|
||
<para>
|
||
A user who wants to access a role in a different account must also have permissions
|
||
that are delegated from the user account administrator. The administrator must attach
|
||
a policy that allows the user to call <code>AssumeRole</code> for the ARN of the role
|
||
in the other account.
|
||
</para>
|
||
|
||
<para>
|
||
To allow a user to assume a role in the same account, you can do either of the following:
|
||
</para>
|
||
<ul> <li>
|
||
<para>
|
||
Attach a policy to the user that allows the user to call <code>AssumeRole</code> (as
|
||
long as the role's trust policy trusts the account).
|
||
</para>
|
||
</li> <li>
|
||
<para>
|
||
Add the user as a principal directly in the role's trust policy.
|
||
</para>
|
||
</li> </ul>
|
||
<para>
|
||
You can do either because the role’s trust policy acts as an IAM resource-based policy.
|
||
When a resource-based policy grants access to a principal in the same account, no
|
||
additional identity-based policy is required. For more information about trust policies
|
||
and resource-based policies, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html">IAM
|
||
Policies</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
<b>Tags</b>
|
||
</para>
|
||
|
||
<para>
|
||
(Optional) You can pass tag key-value pairs to your session. These tags are called
|
||
session tags. For more information about session tags, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html">Passing
|
||
Session Tags in STS</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
An administrator must grant you the permissions necessary to pass session tags. The
|
||
administrator can also create granular permissions to allow you to pass only specific
|
||
session tags. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_attribute-based-access-control.html">Tutorial:
|
||
Using Tags for Attribute-Based Access Control</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
You can set the session tags as transitive. Transitive tags persist during role chaining.
|
||
For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html#id_session-tags_role-chaining">Chaining
|
||
Roles with Session Tags</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
<b>Using MFA with AssumeRole</b>
|
||
</para>
|
||
|
||
<para>
|
||
(Optional) You can include multi-factor authentication (MFA) information when you
|
||
call <code>AssumeRole</code>. This is useful for cross-account scenarios to ensure
|
||
that the user that assumes the role has been authenticated with an Amazon Web Services
|
||
MFA device. In that scenario, the trust policy of the role being assumed includes
|
||
a condition that tests for MFA authentication. If the caller does not include valid
|
||
MFA information, the request to assume the role is denied. The condition in a trust
|
||
policy that tests for MFA authentication might look like the following example.
|
||
</para>
|
||
|
||
<para>
|
||
<code>"Condition": {"Bool": {"aws:MultiFactorAuthPresent": true}}</code>
|
||
</para>
|
||
|
||
<para>
|
||
For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/MFAProtectedAPI.html">Configuring
|
||
MFA-Protected API Access</a> in the <i>IAM User Guide</i> guide.
|
||
</para>
|
||
|
||
<para>
|
||
To use MFA with <code>AssumeRole</code>, you pass values for the <code>SerialNumber</code>
|
||
and <code>TokenCode</code> parameters. The <code>SerialNumber</code> value identifies
|
||
the user's hardware or virtual MFA device. The <code>TokenCode</code> is the time-based
|
||
one-time password (TOTP) that the MFA device produces.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.AssumeRoleRequest.DurationSeconds">
|
||
<summary>
|
||
Gets and sets the property DurationSeconds.
|
||
<para>
|
||
The duration, in seconds, of the role session. The value specified can range from
|
||
900 seconds (15 minutes) up to the maximum session duration set for the role. The
|
||
maximum session duration setting can have a value from 1 hour to 12 hours. If you
|
||
specify a value higher than this setting or the administrator setting (whichever is
|
||
lower), the operation fails. For example, if you specify a session duration of 12
|
||
hours, but your administrator set the maximum session duration to 6 hours, your operation
|
||
fails.
|
||
</para>
|
||
|
||
<para>
|
||
Role chaining limits your Amazon Web Services CLI or Amazon Web Services API role
|
||
session to a maximum of one hour. When you use the <code>AssumeRole</code> API operation
|
||
to assume a role, you can specify the duration of your role session with the <code>DurationSeconds</code>
|
||
parameter. You can specify a parameter value of up to 43200 seconds (12 hours), depending
|
||
on the maximum session duration setting for your role. However, if you assume a role
|
||
using role chaining and provide a <code>DurationSeconds</code> parameter value greater
|
||
than one hour, the operation fails. To learn how to view the maximum value for your
|
||
role, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html#id_roles_use_view-role-max-session">View
|
||
the Maximum Session Duration Setting for a Role</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
By default, the value is set to <code>3600</code> seconds.
|
||
</para>
|
||
<note>
|
||
<para>
|
||
The <code>DurationSeconds</code> parameter is separate from the duration of a console
|
||
session that you might request using the returned credentials. The request to the
|
||
federation endpoint for a console sign-in token takes a <code>SessionDuration</code>
|
||
parameter that specifies the maximum length of the console session. For more information,
|
||
see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_enable-console-custom-url.html">Creating
|
||
a URL that Enables Federated Users to Access the Amazon Web Services Management Console</a>
|
||
in the <i>IAM User Guide</i>.
|
||
</para>
|
||
</note>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.AssumeRoleRequest.ExternalId">
|
||
<summary>
|
||
Gets and sets the property ExternalId.
|
||
<para>
|
||
A unique identifier that might be required when you assume a role in another account.
|
||
If the administrator of the account to which the role belongs provided you with an
|
||
external ID, then provide that value in the <code>ExternalId</code> parameter. This
|
||
value can be any string, such as a passphrase or account number. A cross-account role
|
||
is usually set up to trust everyone in an account. Therefore, the administrator of
|
||
the trusting account might send an external ID to the administrator of the trusted
|
||
account. That way, only someone with the ID can assume the role, rather than everyone
|
||
in the account. For more information about the external ID, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-user_externalid.html">How
|
||
to Use an External ID When Granting Access to Your Amazon Web Services Resources to
|
||
a Third Party</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
The regex used to validate this parameter is a string of characters consisting of
|
||
upper- and lower-case alphanumeric characters with no spaces. You can also include
|
||
underscores or any of the following characters: =,.@:/-
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.AssumeRoleRequest.Policy">
|
||
<summary>
|
||
Gets and sets the property Policy.
|
||
<para>
|
||
An IAM policy in JSON format that you want to use as an inline session policy.
|
||
</para>
|
||
|
||
<para>
|
||
This parameter is optional. Passing policies to this operation returns new temporary
|
||
credentials. The resulting session's permissions are the intersection of the role's
|
||
identity-based policy and the session policies. You can use the role's temporary credentials
|
||
in subsequent Amazon Web Services API calls to access resources in the account that
|
||
owns the role. You cannot use session policies to grant more permissions than those
|
||
allowed by the identity-based policy of the role that is being assumed. For more information,
|
||
see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">Session
|
||
Policies</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
The plaintext that you use for both inline and managed session policies can't exceed
|
||
2,048 characters. The JSON policy characters can be any ASCII character from the space
|
||
character to the end of the valid character list (\u0020 through \u00FF). It can also
|
||
include the tab (\u0009), linefeed (\u000A), and carriage return (\u000D) characters.
|
||
</para>
|
||
<note>
|
||
<para>
|
||
An Amazon Web Services conversion compresses the passed session policies and session
|
||
tags into a packed binary format that has a separate limit. Your request can fail
|
||
for this limit even if your plaintext meets the other requirements. The <code>PackedPolicySize</code>
|
||
response element indicates by percentage how close the policies and tags for your
|
||
request are to the upper size limit.
|
||
</para>
|
||
</note>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.AssumeRoleRequest.PolicyArns">
|
||
<summary>
|
||
Gets and sets the property PolicyArns.
|
||
<para>
|
||
The Amazon Resource Names (ARNs) of the IAM managed policies that you want to use
|
||
as managed session policies. The policies must exist in the same account as the role.
|
||
</para>
|
||
|
||
<para>
|
||
This parameter is optional. You can provide up to 10 managed policy ARNs. However,
|
||
the plaintext that you use for both inline and managed session policies can't exceed
|
||
2,048 characters. For more information about ARNs, see <a href="https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html">Amazon
|
||
Resource Names (ARNs) and Amazon Web Services Service Namespaces</a> in the Amazon
|
||
Web Services General Reference.
|
||
</para>
|
||
<note>
|
||
<para>
|
||
An Amazon Web Services conversion compresses the passed session policies and session
|
||
tags into a packed binary format that has a separate limit. Your request can fail
|
||
for this limit even if your plaintext meets the other requirements. The <code>PackedPolicySize</code>
|
||
response element indicates by percentage how close the policies and tags for your
|
||
request are to the upper size limit.
|
||
</para>
|
||
</note>
|
||
<para>
|
||
Passing policies to this operation returns new temporary credentials. The resulting
|
||
session's permissions are the intersection of the role's identity-based policy and
|
||
the session policies. You can use the role's temporary credentials in subsequent Amazon
|
||
Web Services API calls to access resources in the account that owns the role. You
|
||
cannot use session policies to grant more permissions than those allowed by the identity-based
|
||
policy of the role that is being assumed. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">Session
|
||
Policies</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.AssumeRoleRequest.RoleArn">
|
||
<summary>
|
||
Gets and sets the property RoleArn.
|
||
<para>
|
||
The Amazon Resource Name (ARN) of the role to assume.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.AssumeRoleRequest.RoleSessionName">
|
||
<summary>
|
||
Gets and sets the property RoleSessionName.
|
||
<para>
|
||
An identifier for the assumed role session.
|
||
</para>
|
||
|
||
<para>
|
||
Use the role session name to uniquely identify a session when the same role is assumed
|
||
by different principals or for different reasons. In cross-account scenarios, the
|
||
role session name is visible to, and can be logged by the account that owns the role.
|
||
The role session name is also used in the ARN of the assumed role principal. This
|
||
means that subsequent cross-account API requests that use the temporary security credentials
|
||
will expose the role session name to the external account in their CloudTrail logs.
|
||
</para>
|
||
|
||
<para>
|
||
The regex used to validate this parameter is a string of characters consisting of
|
||
upper- and lower-case alphanumeric characters with no spaces. You can also include
|
||
underscores or any of the following characters: =,.@-
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.AssumeRoleRequest.SerialNumber">
|
||
<summary>
|
||
Gets and sets the property SerialNumber.
|
||
<para>
|
||
The identification number of the MFA device that is associated with the user who is
|
||
making the <code>AssumeRole</code> call. Specify this value if the trust policy of
|
||
the role being assumed includes a condition that requires MFA authentication. The
|
||
value is either the serial number for a hardware device (such as <code>GAHT12345678</code>)
|
||
or an Amazon Resource Name (ARN) for a virtual device (such as <code>arn:aws:iam::123456789012:mfa/user</code>).
|
||
</para>
|
||
|
||
<para>
|
||
The regex used to validate this parameter is a string of characters consisting of
|
||
upper- and lower-case alphanumeric characters with no spaces. You can also include
|
||
underscores or any of the following characters: =,.@-
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.AssumeRoleRequest.SourceIdentity">
|
||
<summary>
|
||
Gets and sets the property SourceIdentity.
|
||
<para>
|
||
The source identity specified by the principal that is calling the <code>AssumeRole</code>
|
||
operation.
|
||
</para>
|
||
|
||
<para>
|
||
You can require users to specify a source identity when they assume a role. You do
|
||
this by using the <code>sts:SourceIdentity</code> condition key in a role trust policy.
|
||
You can use source identity information in CloudTrail logs to determine who took actions
|
||
with a role. You can use the <code>aws:SourceIdentity</code> condition key to further
|
||
control access to Amazon Web Services resources based on the value of source identity.
|
||
For more information about using source identity, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_monitor.html">Monitor
|
||
and control actions taken with assumed roles</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
The regex used to validate this parameter is a string of characters consisting of
|
||
upper- and lower-case alphanumeric characters with no spaces. You can also include
|
||
underscores or any of the following characters: =,.@-. You cannot use a value that
|
||
begins with the text <code>aws:</code>. This prefix is reserved for Amazon Web Services
|
||
internal use.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.AssumeRoleRequest.Tags">
|
||
<summary>
|
||
Gets and sets the property Tags.
|
||
<para>
|
||
A list of session tags that you want to pass. Each session tag consists of a key name
|
||
and an associated value. For more information about session tags, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html">Tagging
|
||
Amazon Web Services STS Sessions</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
This parameter is optional. You can pass up to 50 session tags. The plaintext session
|
||
tag keys can’t exceed 128 characters, and the values can’t exceed 256 characters.
|
||
For these and additional limits, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-limits.html#reference_iam-limits-entity-length">IAM
|
||
and STS Character Limits</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
<note>
|
||
<para>
|
||
An Amazon Web Services conversion compresses the passed session policies and session
|
||
tags into a packed binary format that has a separate limit. Your request can fail
|
||
for this limit even if your plaintext meets the other requirements. The <code>PackedPolicySize</code>
|
||
response element indicates by percentage how close the policies and tags for your
|
||
request are to the upper size limit.
|
||
</para>
|
||
</note>
|
||
<para>
|
||
You can pass a session tag with the same key as a tag that is already attached to
|
||
the role. When you do, session tags override a role tag with the same key.
|
||
</para>
|
||
|
||
<para>
|
||
Tag key–value pairs are not case sensitive, but case is preserved. This means that
|
||
you cannot have separate <code>Department</code> and <code>department</code> tag keys.
|
||
Assume that the role has the <code>Department</code>=<code>Marketing</code> tag and
|
||
you pass the <code>department</code>=<code>engineering</code> session tag. <code>Department</code>
|
||
and <code>department</code> are not saved as separate tags, and the session tag passed
|
||
in the request takes precedence over the role tag.
|
||
</para>
|
||
|
||
<para>
|
||
Additionally, if you used temporary credentials to perform this operation, the new
|
||
session inherits any transitive session tags from the calling session. If you pass
|
||
a session tag with the same key as an inherited tag, the operation fails. To view
|
||
the inherited tags for a session, see the CloudTrail logs. For more information, see
|
||
<a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html#id_session-tags_ctlogs">Viewing
|
||
Session Tags in CloudTrail</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.AssumeRoleRequest.TokenCode">
|
||
<summary>
|
||
Gets and sets the property TokenCode.
|
||
<para>
|
||
The value provided by the MFA device, if the trust policy of the role being assumed
|
||
requires MFA. (In other words, if the policy includes a condition that tests for MFA).
|
||
If the role being assumed requires MFA and if the <code>TokenCode</code> value is
|
||
missing or expired, the <code>AssumeRole</code> call returns an "access denied" error.
|
||
</para>
|
||
|
||
<para>
|
||
The format for this parameter, as described by its regex pattern, is a sequence of
|
||
six numeric digits.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.AssumeRoleRequest.TransitiveTagKeys">
|
||
<summary>
|
||
Gets and sets the property TransitiveTagKeys.
|
||
<para>
|
||
A list of keys for session tags that you want to set as transitive. If you set a tag
|
||
key as transitive, the corresponding key and value passes to subsequent sessions in
|
||
a role chain. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html#id_session-tags_role-chaining">Chaining
|
||
Roles with Session Tags</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
This parameter is optional. When you set session tags as transitive, the session policy
|
||
and session tags packed binary limit is not affected.
|
||
</para>
|
||
|
||
<para>
|
||
If you choose not to specify a transitive tag key, then no tags are passed from this
|
||
session to any subsequent sessions.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.AssumeRoleResponse">
|
||
<summary>
|
||
Contains the response to a successful <a>AssumeRole</a> request, including temporary
|
||
Amazon Web Services credentials that can be used to make Amazon Web Services requests.
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.AssumeRoleResponse.AssumedRoleUser">
|
||
<summary>
|
||
Gets and sets the property AssumedRoleUser.
|
||
<para>
|
||
The Amazon Resource Name (ARN) and the assumed role ID, which are identifiers that
|
||
you can use to refer to the resulting temporary security credentials. For example,
|
||
you can reference these credentials as a principal in a resource-based policy by using
|
||
the ARN or assumed role ID. The ARN and ID include the <code>RoleSessionName</code>
|
||
that you specified when you called <code>AssumeRole</code>.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.AssumeRoleResponse.Credentials">
|
||
<summary>
|
||
Gets and sets the property Credentials.
|
||
<para>
|
||
The temporary security credentials, which include an access key ID, a secret access
|
||
key, and a security (or session) token.
|
||
</para>
|
||
<note>
|
||
<para>
|
||
The size of the security token that STS API operations return is not fixed. We strongly
|
||
recommend that you make no assumptions about the maximum size.
|
||
</para>
|
||
</note>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.AssumeRoleResponse.PackedPolicySize">
|
||
<summary>
|
||
Gets and sets the property PackedPolicySize.
|
||
<para>
|
||
A percentage value that indicates the packed size of the session policies and session
|
||
tags combined passed in the request. The request fails if the packed size is greater
|
||
than 100 percent, which means the policies and tags exceeded the allowed space.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.AssumeRoleResponse.SourceIdentity">
|
||
<summary>
|
||
Gets and sets the property SourceIdentity.
|
||
<para>
|
||
The source identity specified by the principal that is calling the <code>AssumeRole</code>
|
||
operation.
|
||
</para>
|
||
|
||
<para>
|
||
You can require users to specify a source identity when they assume a role. You do
|
||
this by using the <code>sts:SourceIdentity</code> condition key in a role trust policy.
|
||
You can use source identity information in CloudTrail logs to determine who took actions
|
||
with a role. You can use the <code>aws:SourceIdentity</code> condition key to further
|
||
control access to Amazon Web Services resources based on the value of source identity.
|
||
For more information about using source identity, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_monitor.html">Monitor
|
||
and control actions taken with assumed roles</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
The regex used to validate this parameter is a string of characters consisting of
|
||
upper- and lower-case alphanumeric characters with no spaces. You can also include
|
||
underscores or any of the following characters: =,.@-
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.AssumeRoleWithSAMLRequest">
|
||
<summary>
|
||
Container for the parameters to the AssumeRoleWithSAML operation.
|
||
Returns a set of temporary security credentials for users who have been authenticated
|
||
via a SAML authentication response. This operation provides a mechanism for tying
|
||
an enterprise identity store or directory to role-based Amazon Web Services access
|
||
without user-specific credentials or configuration. For a comparison of <code>AssumeRoleWithSAML</code>
|
||
with the other API operations that produce temporary credentials, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html">Requesting
|
||
Temporary Security Credentials</a> and <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#stsapi_comparison">Comparing
|
||
the Amazon Web Services STS API operations</a> in the <i>IAM User Guide</i>.
|
||
|
||
|
||
<para>
|
||
The temporary security credentials returned by this operation consist of an access
|
||
key ID, a secret access key, and a security token. Applications can use these temporary
|
||
security credentials to sign calls to Amazon Web Services services.
|
||
</para>
|
||
|
||
<para>
|
||
<b>Session Duration</b>
|
||
</para>
|
||
|
||
<para>
|
||
By default, the temporary security credentials created by <code>AssumeRoleWithSAML</code>
|
||
last for one hour. However, you can use the optional <code>DurationSeconds</code>
|
||
parameter to specify the duration of your session. Your role session lasts for the
|
||
duration that you specify, or until the time specified in the SAML authentication
|
||
response's <code>SessionNotOnOrAfter</code> value, whichever is shorter. You can provide
|
||
a <code>DurationSeconds</code> value from 900 seconds (15 minutes) up to the maximum
|
||
session duration setting for the role. This setting can have a value from 1 hour to
|
||
12 hours. To learn how to view the maximum value for your role, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html#id_roles_use_view-role-max-session">View
|
||
the Maximum Session Duration Setting for a Role</a> in the <i>IAM User Guide</i>.
|
||
The maximum session duration limit applies when you use the <code>AssumeRole*</code>
|
||
API operations or the <code>assume-role*</code> CLI commands. However the limit does
|
||
not apply when you use those operations to create a console URL. For more information,
|
||
see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html">Using
|
||
IAM Roles</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
<note>
|
||
<para>
|
||
<a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts.html#iam-term-role-chaining">Role
|
||
chaining</a> limits your CLI or Amazon Web Services API role session to a maximum
|
||
of one hour. When you use the <code>AssumeRole</code> API operation to assume a role,
|
||
you can specify the duration of your role session with the <code>DurationSeconds</code>
|
||
parameter. You can specify a parameter value of up to 43200 seconds (12 hours), depending
|
||
on the maximum session duration setting for your role. However, if you assume a role
|
||
using role chaining and provide a <code>DurationSeconds</code> parameter value greater
|
||
than one hour, the operation fails.
|
||
</para>
|
||
</note>
|
||
<para>
|
||
<b>Permissions</b>
|
||
</para>
|
||
|
||
<para>
|
||
The temporary security credentials created by <code>AssumeRoleWithSAML</code> can
|
||
be used to make API calls to any Amazon Web Services service with the following exception:
|
||
you cannot call the STS <code>GetFederationToken</code> or <code>GetSessionToken</code>
|
||
API operations.
|
||
</para>
|
||
|
||
<para>
|
||
(Optional) You can pass inline or managed <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">session
|
||
policies</a> to this operation. You can pass a single JSON policy document to use
|
||
as an inline session policy. You can also specify up to 10 managed policies to use
|
||
as managed session policies. The plaintext that you use for both inline and managed
|
||
session policies can't exceed 2,048 characters. Passing policies to this operation
|
||
returns new temporary credentials. The resulting session's permissions are the intersection
|
||
of the role's identity-based policy and the session policies. You can use the role's
|
||
temporary credentials in subsequent Amazon Web Services API calls to access resources
|
||
in the account that owns the role. You cannot use session policies to grant more permissions
|
||
than those allowed by the identity-based policy of the role that is being assumed.
|
||
For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">Session
|
||
Policies</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
Calling <code>AssumeRoleWithSAML</code> does not require the use of Amazon Web Services
|
||
security credentials. The identity of the caller is validated by using keys in the
|
||
metadata document that is uploaded for the SAML provider entity for your identity
|
||
provider.
|
||
</para>
|
||
<important>
|
||
<para>
|
||
Calling <code>AssumeRoleWithSAML</code> can result in an entry in your CloudTrail
|
||
logs. The entry includes the value in the <code>NameID</code> element of the SAML
|
||
assertion. We recommend that you use a <code>NameIDType</code> that is not associated
|
||
with any personally identifiable information (PII). For example, you could instead
|
||
use the persistent identifier (<code>urn:oasis:names:tc:SAML:2.0:nameid-format:persistent</code>).
|
||
</para>
|
||
</important>
|
||
<para>
|
||
<b>Tags</b>
|
||
</para>
|
||
|
||
<para>
|
||
(Optional) You can configure your IdP to pass attributes into your SAML assertion
|
||
as session tags. Each session tag consists of a key name and an associated value.
|
||
For more information about session tags, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html">Passing
|
||
Session Tags in STS</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
You can pass up to 50 session tags. The plaintext session tag keys can’t exceed 128
|
||
characters and the values can’t exceed 256 characters. For these and additional limits,
|
||
see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-limits.html#reference_iam-limits-entity-length">IAM
|
||
and STS Character Limits</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
<note>
|
||
<para>
|
||
An Amazon Web Services conversion compresses the passed session policies and session
|
||
tags into a packed binary format that has a separate limit. Your request can fail
|
||
for this limit even if your plaintext meets the other requirements. The <code>PackedPolicySize</code>
|
||
response element indicates by percentage how close the policies and tags for your
|
||
request are to the upper size limit.
|
||
</para>
|
||
</note>
|
||
<para>
|
||
You can pass a session tag with the same key as a tag that is attached to the role.
|
||
When you do, session tags override the role's tags with the same key.
|
||
</para>
|
||
|
||
<para>
|
||
An administrator must grant you the permissions necessary to pass session tags. The
|
||
administrator can also create granular permissions to allow you to pass only specific
|
||
session tags. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_attribute-based-access-control.html">Tutorial:
|
||
Using Tags for Attribute-Based Access Control</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
You can set the session tags as transitive. Transitive tags persist during role chaining.
|
||
For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html#id_session-tags_role-chaining">Chaining
|
||
Roles with Session Tags</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
<b>SAML Configuration</b>
|
||
</para>
|
||
|
||
<para>
|
||
Before your application can call <code>AssumeRoleWithSAML</code>, you must configure
|
||
your SAML identity provider (IdP) to issue the claims required by Amazon Web Services.
|
||
Additionally, you must use Identity and Access Management (IAM) to create a SAML provider
|
||
entity in your Amazon Web Services account that represents your identity provider.
|
||
You must also create an IAM role that specifies this SAML provider in its trust policy.
|
||
|
||
</para>
|
||
|
||
<para>
|
||
For more information, see the following resources:
|
||
</para>
|
||
<ul> <li>
|
||
<para>
|
||
<a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_saml.html">About
|
||
SAML 2.0-based Federation</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
</li> <li>
|
||
<para>
|
||
<a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_saml.html">Creating
|
||
SAML Identity Providers</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
</li> <li>
|
||
<para>
|
||
<a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_create_saml_relying-party.html">Configuring
|
||
a Relying Party and Claims</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
</li> <li>
|
||
<para>
|
||
<a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-idp_saml.html">Creating
|
||
a Role for SAML 2.0 Federation</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
</li> </ul>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.AssumeRoleWithSAMLRequest.DurationSeconds">
|
||
<summary>
|
||
Gets and sets the property DurationSeconds.
|
||
<para>
|
||
The duration, in seconds, of the role session. Your role session lasts for the duration
|
||
that you specify for the <code>DurationSeconds</code> parameter, or until the time
|
||
specified in the SAML authentication response's <code>SessionNotOnOrAfter</code> value,
|
||
whichever is shorter. You can provide a <code>DurationSeconds</code> value from 900
|
||
seconds (15 minutes) up to the maximum session duration setting for the role. This
|
||
setting can have a value from 1 hour to 12 hours. If you specify a value higher than
|
||
this setting, the operation fails. For example, if you specify a session duration
|
||
of 12 hours, but your administrator set the maximum session duration to 6 hours, your
|
||
operation fails. To learn how to view the maximum value for your role, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html#id_roles_use_view-role-max-session">View
|
||
the Maximum Session Duration Setting for a Role</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
By default, the value is set to <code>3600</code> seconds.
|
||
</para>
|
||
<note>
|
||
<para>
|
||
The <code>DurationSeconds</code> parameter is separate from the duration of a console
|
||
session that you might request using the returned credentials. The request to the
|
||
federation endpoint for a console sign-in token takes a <code>SessionDuration</code>
|
||
parameter that specifies the maximum length of the console session. For more information,
|
||
see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_enable-console-custom-url.html">Creating
|
||
a URL that Enables Federated Users to Access the Amazon Web Services Management Console</a>
|
||
in the <i>IAM User Guide</i>.
|
||
</para>
|
||
</note>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.AssumeRoleWithSAMLRequest.Policy">
|
||
<summary>
|
||
Gets and sets the property Policy.
|
||
<para>
|
||
An IAM policy in JSON format that you want to use as an inline session policy.
|
||
</para>
|
||
|
||
<para>
|
||
This parameter is optional. Passing policies to this operation returns new temporary
|
||
credentials. The resulting session's permissions are the intersection of the role's
|
||
identity-based policy and the session policies. You can use the role's temporary credentials
|
||
in subsequent Amazon Web Services API calls to access resources in the account that
|
||
owns the role. You cannot use session policies to grant more permissions than those
|
||
allowed by the identity-based policy of the role that is being assumed. For more information,
|
||
see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">Session
|
||
Policies</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
The plaintext that you use for both inline and managed session policies can't exceed
|
||
2,048 characters. The JSON policy characters can be any ASCII character from the space
|
||
character to the end of the valid character list (\u0020 through \u00FF). It can also
|
||
include the tab (\u0009), linefeed (\u000A), and carriage return (\u000D) characters.
|
||
</para>
|
||
<note>
|
||
<para>
|
||
An Amazon Web Services conversion compresses the passed session policies and session
|
||
tags into a packed binary format that has a separate limit. Your request can fail
|
||
for this limit even if your plaintext meets the other requirements. The <code>PackedPolicySize</code>
|
||
response element indicates by percentage how close the policies and tags for your
|
||
request are to the upper size limit.
|
||
</para>
|
||
</note>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.AssumeRoleWithSAMLRequest.PolicyArns">
|
||
<summary>
|
||
Gets and sets the property PolicyArns.
|
||
<para>
|
||
The Amazon Resource Names (ARNs) of the IAM managed policies that you want to use
|
||
as managed session policies. The policies must exist in the same account as the role.
|
||
</para>
|
||
|
||
<para>
|
||
This parameter is optional. You can provide up to 10 managed policy ARNs. However,
|
||
the plaintext that you use for both inline and managed session policies can't exceed
|
||
2,048 characters. For more information about ARNs, see <a href="https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html">Amazon
|
||
Resource Names (ARNs) and Amazon Web Services Service Namespaces</a> in the Amazon
|
||
Web Services General Reference.
|
||
</para>
|
||
<note>
|
||
<para>
|
||
An Amazon Web Services conversion compresses the passed session policies and session
|
||
tags into a packed binary format that has a separate limit. Your request can fail
|
||
for this limit even if your plaintext meets the other requirements. The <code>PackedPolicySize</code>
|
||
response element indicates by percentage how close the policies and tags for your
|
||
request are to the upper size limit.
|
||
</para>
|
||
</note>
|
||
<para>
|
||
Passing policies to this operation returns new temporary credentials. The resulting
|
||
session's permissions are the intersection of the role's identity-based policy and
|
||
the session policies. You can use the role's temporary credentials in subsequent Amazon
|
||
Web Services API calls to access resources in the account that owns the role. You
|
||
cannot use session policies to grant more permissions than those allowed by the identity-based
|
||
policy of the role that is being assumed. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">Session
|
||
Policies</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.AssumeRoleWithSAMLRequest.PrincipalArn">
|
||
<summary>
|
||
Gets and sets the property PrincipalArn.
|
||
<para>
|
||
The Amazon Resource Name (ARN) of the SAML provider in IAM that describes the IdP.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.AssumeRoleWithSAMLRequest.RoleArn">
|
||
<summary>
|
||
Gets and sets the property RoleArn.
|
||
<para>
|
||
The Amazon Resource Name (ARN) of the role that the caller is assuming.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.AssumeRoleWithSAMLRequest.SAMLAssertion">
|
||
<summary>
|
||
Gets and sets the property SAMLAssertion.
|
||
<para>
|
||
The base64 encoded SAML authentication response provided by the IdP.
|
||
</para>
|
||
|
||
<para>
|
||
For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/create-role-saml-IdP-tasks.html">Configuring
|
||
a Relying Party and Adding Claims</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.AssumeRoleWithSAMLResponse">
|
||
<summary>
|
||
Contains the response to a successful <a>AssumeRoleWithSAML</a> request, including
|
||
temporary Amazon Web Services credentials that can be used to make Amazon Web Services
|
||
requests.
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.AssumeRoleWithSAMLResponse.AssumedRoleUser">
|
||
<summary>
|
||
Gets and sets the property AssumedRoleUser.
|
||
<para>
|
||
The identifiers for the temporary security credentials that the operation returns.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.AssumeRoleWithSAMLResponse.Audience">
|
||
<summary>
|
||
Gets and sets the property Audience.
|
||
<para>
|
||
The value of the <code>Recipient</code> attribute of the <code>SubjectConfirmationData</code>
|
||
element of the SAML assertion.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.AssumeRoleWithSAMLResponse.Credentials">
|
||
<summary>
|
||
Gets and sets the property Credentials.
|
||
<para>
|
||
The temporary security credentials, which include an access key ID, a secret access
|
||
key, and a security (or session) token.
|
||
</para>
|
||
<note>
|
||
<para>
|
||
The size of the security token that STS API operations return is not fixed. We strongly
|
||
recommend that you make no assumptions about the maximum size.
|
||
</para>
|
||
</note>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.AssumeRoleWithSAMLResponse.Issuer">
|
||
<summary>
|
||
Gets and sets the property Issuer.
|
||
<para>
|
||
The value of the <code>Issuer</code> element of the SAML assertion.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.AssumeRoleWithSAMLResponse.NameQualifier">
|
||
<summary>
|
||
Gets and sets the property NameQualifier.
|
||
<para>
|
||
A hash value based on the concatenation of the following:
|
||
</para>
|
||
<ul> <li>
|
||
<para>
|
||
The <code>Issuer</code> response value.
|
||
</para>
|
||
</li> <li>
|
||
<para>
|
||
The Amazon Web Services account ID.
|
||
</para>
|
||
</li> <li>
|
||
<para>
|
||
The friendly name (the last part of the ARN) of the SAML provider in IAM.
|
||
</para>
|
||
</li> </ul>
|
||
<para>
|
||
The combination of <code>NameQualifier</code> and <code>Subject</code> can be used
|
||
to uniquely identify a federated user.
|
||
</para>
|
||
|
||
<para>
|
||
The following pseudocode shows how the hash value is calculated:
|
||
</para>
|
||
|
||
<para>
|
||
<code>BASE64 ( SHA1 ( "https://example.com/saml" + "123456789012" + "/MySAMLIdP"
|
||
) )</code>
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.AssumeRoleWithSAMLResponse.PackedPolicySize">
|
||
<summary>
|
||
Gets and sets the property PackedPolicySize.
|
||
<para>
|
||
A percentage value that indicates the packed size of the session policies and session
|
||
tags combined passed in the request. The request fails if the packed size is greater
|
||
than 100 percent, which means the policies and tags exceeded the allowed space.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.AssumeRoleWithSAMLResponse.SourceIdentity">
|
||
<summary>
|
||
Gets and sets the property SourceIdentity.
|
||
<para>
|
||
The value in the <code>SourceIdentity</code> attribute in the SAML assertion.
|
||
</para>
|
||
|
||
<para>
|
||
You can require users to set a source identity value when they assume a role. You
|
||
do this by using the <code>sts:SourceIdentity</code> condition key in a role trust
|
||
policy. That way, actions that are taken with the role are associated with that user.
|
||
After the source identity is set, the value cannot be changed. It is present in the
|
||
request for all actions that are taken by the role and persists across <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts#iam-term-role-chaining">chained
|
||
role</a> sessions. You can configure your SAML identity provider to use an attribute
|
||
associated with your users, like user name or email, as the source identity when calling
|
||
<code>AssumeRoleWithSAML</code>. You do this by adding an attribute to the SAML assertion.
|
||
For more information about using source identity, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_monitor.html">Monitor
|
||
and control actions taken with assumed roles</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
The regex used to validate this parameter is a string of characters consisting of
|
||
upper- and lower-case alphanumeric characters with no spaces. You can also include
|
||
underscores or any of the following characters: =,.@-
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.AssumeRoleWithSAMLResponse.Subject">
|
||
<summary>
|
||
Gets and sets the property Subject.
|
||
<para>
|
||
The value of the <code>NameID</code> element in the <code>Subject</code> element of
|
||
the SAML assertion.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.AssumeRoleWithSAMLResponse.SubjectType">
|
||
<summary>
|
||
Gets and sets the property SubjectType.
|
||
<para>
|
||
The format of the name ID, as defined by the <code>Format</code> attribute in the
|
||
<code>NameID</code> element of the SAML assertion. Typical examples of the format
|
||
are <code>transient</code> or <code>persistent</code>.
|
||
</para>
|
||
|
||
<para>
|
||
If the format includes the prefix <code>urn:oasis:names:tc:SAML:2.0:nameid-format</code>,
|
||
that prefix is removed. For example, <code>urn:oasis:names:tc:SAML:2.0:nameid-format:transient</code>
|
||
is returned as <code>transient</code>. If the format includes any other prefix, the
|
||
format is returned with no modifications.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.AssumeRoleWithWebIdentityRequest">
|
||
<summary>
|
||
Container for the parameters to the AssumeRoleWithWebIdentity operation.
|
||
Returns a set of temporary security credentials for users who have been authenticated
|
||
in a mobile or web application with a web identity provider. Example providers include
|
||
the OAuth 2.0 providers Login with Amazon and Facebook, or any OpenID Connect-compatible
|
||
identity provider such as Google or <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-identity.html">Amazon
|
||
Cognito federated identities</a>.
|
||
|
||
<note>
|
||
<para>
|
||
For mobile applications, we recommend that you use Amazon Cognito. You can use Amazon
|
||
Cognito with the <a href="http://aws.amazon.com/sdkforios/">Amazon Web Services SDK
|
||
for iOS Developer Guide</a> and the <a href="http://aws.amazon.com/sdkforandroid/">Amazon
|
||
Web Services SDK for Android Developer Guide</a> to uniquely identify a user. You
|
||
can also supply the user with a consistent identity throughout the lifetime of an
|
||
application.
|
||
</para>
|
||
|
||
<para>
|
||
To learn more about Amazon Cognito, see <a href="https://docs.aws.amazon.com/mobile/sdkforandroid/developerguide/cognito-auth.html#d0e840">Amazon
|
||
Cognito Overview</a> in <i>Amazon Web Services SDK for Android Developer Guide</i>
|
||
and <a href="https://docs.aws.amazon.com/mobile/sdkforios/developerguide/cognito-auth.html#d0e664">Amazon
|
||
Cognito Overview</a> in the <i>Amazon Web Services SDK for iOS Developer Guide</i>.
|
||
</para>
|
||
</note>
|
||
<para>
|
||
Calling <code>AssumeRoleWithWebIdentity</code> does not require the use of Amazon
|
||
Web Services security credentials. Therefore, you can distribute an application (for
|
||
example, on mobile devices) that requests temporary security credentials without including
|
||
long-term Amazon Web Services credentials in the application. You also don't need
|
||
to deploy server-based proxy services that use long-term Amazon Web Services credentials.
|
||
Instead, the identity of the caller is validated by using a token from the web identity
|
||
provider. For a comparison of <code>AssumeRoleWithWebIdentity</code> with the other
|
||
API operations that produce temporary credentials, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html">Requesting
|
||
Temporary Security Credentials</a> and <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#stsapi_comparison">Comparing
|
||
the Amazon Web Services STS API operations</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
The temporary security credentials returned by this API consist of an access key ID,
|
||
a secret access key, and a security token. Applications can use these temporary security
|
||
credentials to sign calls to Amazon Web Services service API operations.
|
||
</para>
|
||
|
||
<para>
|
||
<b>Session Duration</b>
|
||
</para>
|
||
|
||
<para>
|
||
By default, the temporary security credentials created by <code>AssumeRoleWithWebIdentity</code>
|
||
last for one hour. However, you can use the optional <code>DurationSeconds</code>
|
||
parameter to specify the duration of your session. You can provide a value from 900
|
||
seconds (15 minutes) up to the maximum session duration setting for the role. This
|
||
setting can have a value from 1 hour to 12 hours. To learn how to view the maximum
|
||
value for your role, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html#id_roles_use_view-role-max-session">View
|
||
the Maximum Session Duration Setting for a Role</a> in the <i>IAM User Guide</i>.
|
||
The maximum session duration limit applies when you use the <code>AssumeRole*</code>
|
||
API operations or the <code>assume-role*</code> CLI commands. However the limit does
|
||
not apply when you use those operations to create a console URL. For more information,
|
||
see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html">Using
|
||
IAM Roles</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
<b>Permissions</b>
|
||
</para>
|
||
|
||
<para>
|
||
The temporary security credentials created by <code>AssumeRoleWithWebIdentity</code>
|
||
can be used to make API calls to any Amazon Web Services service with the following
|
||
exception: you cannot call the STS <code>GetFederationToken</code> or <code>GetSessionToken</code>
|
||
API operations.
|
||
</para>
|
||
|
||
<para>
|
||
(Optional) You can pass inline or managed <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">session
|
||
policies</a> to this operation. You can pass a single JSON policy document to use
|
||
as an inline session policy. You can also specify up to 10 managed policies to use
|
||
as managed session policies. The plaintext that you use for both inline and managed
|
||
session policies can't exceed 2,048 characters. Passing policies to this operation
|
||
returns new temporary credentials. The resulting session's permissions are the intersection
|
||
of the role's identity-based policy and the session policies. You can use the role's
|
||
temporary credentials in subsequent Amazon Web Services API calls to access resources
|
||
in the account that owns the role. You cannot use session policies to grant more permissions
|
||
than those allowed by the identity-based policy of the role that is being assumed.
|
||
For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">Session
|
||
Policies</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
<b>Tags</b>
|
||
</para>
|
||
|
||
<para>
|
||
(Optional) You can configure your IdP to pass attributes into your web identity token
|
||
as session tags. Each session tag consists of a key name and an associated value.
|
||
For more information about session tags, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html">Passing
|
||
Session Tags in STS</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
You can pass up to 50 session tags. The plaintext session tag keys can’t exceed 128
|
||
characters and the values can’t exceed 256 characters. For these and additional limits,
|
||
see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-limits.html#reference_iam-limits-entity-length">IAM
|
||
and STS Character Limits</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
<note>
|
||
<para>
|
||
An Amazon Web Services conversion compresses the passed session policies and session
|
||
tags into a packed binary format that has a separate limit. Your request can fail
|
||
for this limit even if your plaintext meets the other requirements. The <code>PackedPolicySize</code>
|
||
response element indicates by percentage how close the policies and tags for your
|
||
request are to the upper size limit.
|
||
</para>
|
||
</note>
|
||
<para>
|
||
You can pass a session tag with the same key as a tag that is attached to the role.
|
||
When you do, the session tag overrides the role tag with the same key.
|
||
</para>
|
||
|
||
<para>
|
||
An administrator must grant you the permissions necessary to pass session tags. The
|
||
administrator can also create granular permissions to allow you to pass only specific
|
||
session tags. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_attribute-based-access-control.html">Tutorial:
|
||
Using Tags for Attribute-Based Access Control</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
You can set the session tags as transitive. Transitive tags persist during role chaining.
|
||
For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html#id_session-tags_role-chaining">Chaining
|
||
Roles with Session Tags</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
<b>Identities</b>
|
||
</para>
|
||
|
||
<para>
|
||
Before your application can call <code>AssumeRoleWithWebIdentity</code>, you must
|
||
have an identity token from a supported identity provider and create a role that the
|
||
application can assume. The role that your application assumes must trust the identity
|
||
provider that is associated with the identity token. In other words, the identity
|
||
provider must be specified in the role's trust policy.
|
||
</para>
|
||
<important>
|
||
<para>
|
||
Calling <code>AssumeRoleWithWebIdentity</code> can result in an entry in your CloudTrail
|
||
logs. The entry includes the <a href="http://openid.net/specs/openid-connect-core-1_0.html#Claims">Subject</a>
|
||
of the provided web identity token. We recommend that you avoid using any personally
|
||
identifiable information (PII) in this field. For example, you could instead use a
|
||
GUID or a pairwise identifier, as <a href="http://openid.net/specs/openid-connect-core-1_0.html#SubjectIDTypes">suggested
|
||
in the OIDC specification</a>.
|
||
</para>
|
||
</important>
|
||
<para>
|
||
For more information about how to use web identity federation and the <code>AssumeRoleWithWebIdentity</code>
|
||
API, see the following resources:
|
||
</para>
|
||
<ul> <li>
|
||
<para>
|
||
<a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_oidc_manual.html">Using
|
||
Web Identity Federation API Operations for Mobile Apps</a> and <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#api_assumerolewithwebidentity">Federation
|
||
Through a Web-based Identity Provider</a>.
|
||
</para>
|
||
</li> <li>
|
||
<para>
|
||
<a href="https://aws.amazon.com/blogs/aws/the-aws-web-identity-federation-playground/">
|
||
Web Identity Federation Playground</a>. Walk through the process of authenticating
|
||
through Login with Amazon, Facebook, or Google, getting temporary security credentials,
|
||
and then using those credentials to make a request to Amazon Web Services.
|
||
</para>
|
||
</li> <li>
|
||
<para>
|
||
<a href="http://aws.amazon.com/sdkforios/">Amazon Web Services SDK for iOS Developer
|
||
Guide</a> and <a href="http://aws.amazon.com/sdkforandroid/">Amazon Web Services SDK
|
||
for Android Developer Guide</a>. These toolkits contain sample apps that show how
|
||
to invoke the identity providers. The toolkits then show how to use the information
|
||
from these providers to get and use temporary security credentials.
|
||
</para>
|
||
</li> <li>
|
||
<para>
|
||
<a href="http://aws.amazon.com/articles/web-identity-federation-with-mobile-applications">Web
|
||
Identity Federation with Mobile Applications</a>. This article discusses web identity
|
||
federation and shows an example of how to use web identity federation to get access
|
||
to content in Amazon S3.
|
||
</para>
|
||
</li> </ul>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.AssumeRoleWithWebIdentityRequest.DurationSeconds">
|
||
<summary>
|
||
Gets and sets the property DurationSeconds.
|
||
<para>
|
||
The duration, in seconds, of the role session. The value can range from 900 seconds
|
||
(15 minutes) up to the maximum session duration setting for the role. This setting
|
||
can have a value from 1 hour to 12 hours. If you specify a value higher than this
|
||
setting, the operation fails. For example, if you specify a session duration of 12
|
||
hours, but your administrator set the maximum session duration to 6 hours, your operation
|
||
fails. To learn how to view the maximum value for your role, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use.html#id_roles_use_view-role-max-session">View
|
||
the Maximum Session Duration Setting for a Role</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
By default, the value is set to <code>3600</code> seconds.
|
||
</para>
|
||
<note>
|
||
<para>
|
||
The <code>DurationSeconds</code> parameter is separate from the duration of a console
|
||
session that you might request using the returned credentials. The request to the
|
||
federation endpoint for a console sign-in token takes a <code>SessionDuration</code>
|
||
parameter that specifies the maximum length of the console session. For more information,
|
||
see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_providers_enable-console-custom-url.html">Creating
|
||
a URL that Enables Federated Users to Access the Amazon Web Services Management Console</a>
|
||
in the <i>IAM User Guide</i>.
|
||
</para>
|
||
</note>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.AssumeRoleWithWebIdentityRequest.Policy">
|
||
<summary>
|
||
Gets and sets the property Policy.
|
||
<para>
|
||
An IAM policy in JSON format that you want to use as an inline session policy.
|
||
</para>
|
||
|
||
<para>
|
||
This parameter is optional. Passing policies to this operation returns new temporary
|
||
credentials. The resulting session's permissions are the intersection of the role's
|
||
identity-based policy and the session policies. You can use the role's temporary credentials
|
||
in subsequent Amazon Web Services API calls to access resources in the account that
|
||
owns the role. You cannot use session policies to grant more permissions than those
|
||
allowed by the identity-based policy of the role that is being assumed. For more information,
|
||
see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">Session
|
||
Policies</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
The plaintext that you use for both inline and managed session policies can't exceed
|
||
2,048 characters. The JSON policy characters can be any ASCII character from the space
|
||
character to the end of the valid character list (\u0020 through \u00FF). It can also
|
||
include the tab (\u0009), linefeed (\u000A), and carriage return (\u000D) characters.
|
||
</para>
|
||
<note>
|
||
<para>
|
||
An Amazon Web Services conversion compresses the passed session policies and session
|
||
tags into a packed binary format that has a separate limit. Your request can fail
|
||
for this limit even if your plaintext meets the other requirements. The <code>PackedPolicySize</code>
|
||
response element indicates by percentage how close the policies and tags for your
|
||
request are to the upper size limit.
|
||
</para>
|
||
</note>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.AssumeRoleWithWebIdentityRequest.PolicyArns">
|
||
<summary>
|
||
Gets and sets the property PolicyArns.
|
||
<para>
|
||
The Amazon Resource Names (ARNs) of the IAM managed policies that you want to use
|
||
as managed session policies. The policies must exist in the same account as the role.
|
||
</para>
|
||
|
||
<para>
|
||
This parameter is optional. You can provide up to 10 managed policy ARNs. However,
|
||
the plaintext that you use for both inline and managed session policies can't exceed
|
||
2,048 characters. For more information about ARNs, see <a href="https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html">Amazon
|
||
Resource Names (ARNs) and Amazon Web Services Service Namespaces</a> in the Amazon
|
||
Web Services General Reference.
|
||
</para>
|
||
<note>
|
||
<para>
|
||
An Amazon Web Services conversion compresses the passed session policies and session
|
||
tags into a packed binary format that has a separate limit. Your request can fail
|
||
for this limit even if your plaintext meets the other requirements. The <code>PackedPolicySize</code>
|
||
response element indicates by percentage how close the policies and tags for your
|
||
request are to the upper size limit.
|
||
</para>
|
||
</note>
|
||
<para>
|
||
Passing policies to this operation returns new temporary credentials. The resulting
|
||
session's permissions are the intersection of the role's identity-based policy and
|
||
the session policies. You can use the role's temporary credentials in subsequent Amazon
|
||
Web Services API calls to access resources in the account that owns the role. You
|
||
cannot use session policies to grant more permissions than those allowed by the identity-based
|
||
policy of the role that is being assumed. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">Session
|
||
Policies</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.AssumeRoleWithWebIdentityRequest.ProviderId">
|
||
<summary>
|
||
Gets and sets the property ProviderId.
|
||
<para>
|
||
The fully qualified host component of the domain name of the OAuth 2.0 identity provider.
|
||
Do not specify this value for an OpenID Connect identity provider.
|
||
</para>
|
||
|
||
<para>
|
||
Currently <code>www.amazon.com</code> and <code>graph.facebook.com</code> are the
|
||
only supported identity providers for OAuth 2.0 access tokens. Do not include URL
|
||
schemes and port numbers.
|
||
</para>
|
||
|
||
<para>
|
||
Do not specify this value for OpenID Connect ID tokens.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.AssumeRoleWithWebIdentityRequest.RoleArn">
|
||
<summary>
|
||
Gets and sets the property RoleArn.
|
||
<para>
|
||
The Amazon Resource Name (ARN) of the role that the caller is assuming.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.AssumeRoleWithWebIdentityRequest.RoleSessionName">
|
||
<summary>
|
||
Gets and sets the property RoleSessionName.
|
||
<para>
|
||
An identifier for the assumed role session. Typically, you pass the name or identifier
|
||
that is associated with the user who is using your application. That way, the temporary
|
||
security credentials that your application will use are associated with that user.
|
||
This session name is included as part of the ARN and assumed role ID in the <code>AssumedRoleUser</code>
|
||
response element.
|
||
</para>
|
||
|
||
<para>
|
||
The regex used to validate this parameter is a string of characters consisting of
|
||
upper- and lower-case alphanumeric characters with no spaces. You can also include
|
||
underscores or any of the following characters: =,.@-
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.AssumeRoleWithWebIdentityRequest.WebIdentityToken">
|
||
<summary>
|
||
Gets and sets the property WebIdentityToken.
|
||
<para>
|
||
The OAuth 2.0 access token or OpenID Connect ID token that is provided by the identity
|
||
provider. Your application must get this token by authenticating the user who is using
|
||
your application with a web identity provider before the application makes an <code>AssumeRoleWithWebIdentity</code>
|
||
call.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.AssumeRoleWithWebIdentityResponse">
|
||
<summary>
|
||
Contains the response to a successful <a>AssumeRoleWithWebIdentity</a> request, including
|
||
temporary Amazon Web Services credentials that can be used to make Amazon Web Services
|
||
requests.
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.AssumeRoleWithWebIdentityResponse.AssumedRoleUser">
|
||
<summary>
|
||
Gets and sets the property AssumedRoleUser.
|
||
<para>
|
||
The Amazon Resource Name (ARN) and the assumed role ID, which are identifiers that
|
||
you can use to refer to the resulting temporary security credentials. For example,
|
||
you can reference these credentials as a principal in a resource-based policy by using
|
||
the ARN or assumed role ID. The ARN and ID include the <code>RoleSessionName</code>
|
||
that you specified when you called <code>AssumeRole</code>.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.AssumeRoleWithWebIdentityResponse.Audience">
|
||
<summary>
|
||
Gets and sets the property Audience.
|
||
<para>
|
||
The intended audience (also known as client ID) of the web identity token. This is
|
||
traditionally the client identifier issued to the application that requested the web
|
||
identity token.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.AssumeRoleWithWebIdentityResponse.Credentials">
|
||
<summary>
|
||
Gets and sets the property Credentials.
|
||
<para>
|
||
The temporary security credentials, which include an access key ID, a secret access
|
||
key, and a security token.
|
||
</para>
|
||
<note>
|
||
<para>
|
||
The size of the security token that STS API operations return is not fixed. We strongly
|
||
recommend that you make no assumptions about the maximum size.
|
||
</para>
|
||
</note>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.AssumeRoleWithWebIdentityResponse.PackedPolicySize">
|
||
<summary>
|
||
Gets and sets the property PackedPolicySize.
|
||
<para>
|
||
A percentage value that indicates the packed size of the session policies and session
|
||
tags combined passed in the request. The request fails if the packed size is greater
|
||
than 100 percent, which means the policies and tags exceeded the allowed space.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.AssumeRoleWithWebIdentityResponse.Provider">
|
||
<summary>
|
||
Gets and sets the property Provider.
|
||
<para>
|
||
The issuing authority of the web identity token presented. For OpenID Connect ID
|
||
tokens, this contains the value of the <code>iss</code> field. For OAuth 2.0 access
|
||
tokens, this contains the value of the <code>ProviderId</code> parameter that was
|
||
passed in the <code>AssumeRoleWithWebIdentity</code> request.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.AssumeRoleWithWebIdentityResponse.SourceIdentity">
|
||
<summary>
|
||
Gets and sets the property SourceIdentity.
|
||
<para>
|
||
The value of the source identity that is returned in the JSON web token (JWT) from
|
||
the identity provider.
|
||
</para>
|
||
|
||
<para>
|
||
You can require users to set a source identity value when they assume a role. You
|
||
do this by using the <code>sts:SourceIdentity</code> condition key in a role trust
|
||
policy. That way, actions that are taken with the role are associated with that user.
|
||
After the source identity is set, the value cannot be changed. It is present in the
|
||
request for all actions that are taken by the role and persists across <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_terms-and-concepts#iam-term-role-chaining">chained
|
||
role</a> sessions. You can configure your identity provider to use an attribute associated
|
||
with your users, like user name or email, as the source identity when calling <code>AssumeRoleWithWebIdentity</code>.
|
||
You do this by adding a claim to the JSON web token. To learn more about OIDC tokens
|
||
and claims, see <a href="https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-using-tokens-with-identity-providers.html">Using
|
||
Tokens with User Pools</a> in the <i>Amazon Cognito Developer Guide</i>. For more
|
||
information about using source identity, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_monitor.html">Monitor
|
||
and control actions taken with assumed roles</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
The regex used to validate this parameter is a string of characters consisting of
|
||
upper- and lower-case alphanumeric characters with no spaces. You can also include
|
||
underscores or any of the following characters: =,.@-
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.AssumeRoleWithWebIdentityResponse.SubjectFromWebIdentityToken">
|
||
<summary>
|
||
Gets and sets the property SubjectFromWebIdentityToken.
|
||
<para>
|
||
The unique user identifier that is returned by the identity provider. This identifier
|
||
is associated with the <code>WebIdentityToken</code> that was submitted with the <code>AssumeRoleWithWebIdentity</code>
|
||
call. The identifier is typically unique to the user and the application that acquired
|
||
the <code>WebIdentityToken</code> (pairwise identifier). For OpenID Connect ID tokens,
|
||
this field contains the value returned by the identity provider as the token's <code>sub</code>
|
||
(Subject) claim.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.DecodeAuthorizationMessageRequest">
|
||
<summary>
|
||
Container for the parameters to the DecodeAuthorizationMessage operation.
|
||
Decodes additional information about the authorization status of a request from an
|
||
encoded message returned in response to an Amazon Web Services request.
|
||
|
||
|
||
<para>
|
||
For example, if a user is not authorized to perform an operation that he or she has
|
||
requested, the request returns a <code>Client.UnauthorizedOperation</code> response
|
||
(an HTTP 403 response). Some Amazon Web Services operations additionally return an
|
||
encoded message that can provide details about this authorization failure.
|
||
</para>
|
||
<note>
|
||
<para>
|
||
Only certain Amazon Web Services operations return an encoded authorization message.
|
||
The documentation for an individual operation indicates whether that operation returns
|
||
an encoded message in addition to returning an HTTP code.
|
||
</para>
|
||
</note>
|
||
<para>
|
||
The message is encoded because the details of the authorization status can contain
|
||
privileged information that the user who requested the operation should not see. To
|
||
decode an authorization status message, a user must be granted permissions through
|
||
an IAM <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html">policy</a>
|
||
to request the <code>DecodeAuthorizationMessage</code> (<code>sts:DecodeAuthorizationMessage</code>)
|
||
action.
|
||
</para>
|
||
|
||
<para>
|
||
The decoded message includes the following type of information:
|
||
</para>
|
||
<ul> <li>
|
||
<para>
|
||
Whether the request was denied due to an explicit deny or due to the absence of an
|
||
explicit allow. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html#policy-eval-denyallow">Determining
|
||
Whether a Request is Allowed or Denied</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
</li> <li>
|
||
<para>
|
||
The principal who made the request.
|
||
</para>
|
||
</li> <li>
|
||
<para>
|
||
The requested action.
|
||
</para>
|
||
</li> <li>
|
||
<para>
|
||
The requested resource.
|
||
</para>
|
||
</li> <li>
|
||
<para>
|
||
The values of condition keys in the context of the user's request.
|
||
</para>
|
||
</li> </ul>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.DecodeAuthorizationMessageRequest.EncodedMessage">
|
||
<summary>
|
||
Gets and sets the property EncodedMessage.
|
||
<para>
|
||
The encoded message that was returned with the response.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.DecodeAuthorizationMessageResponse">
|
||
<summary>
|
||
A document that contains additional information about the authorization status of
|
||
a request from an encoded message that is returned in response to an Amazon Web Services
|
||
request.
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.DecodeAuthorizationMessageResponse.DecodedMessage">
|
||
<summary>
|
||
Gets and sets the property DecodedMessage.
|
||
<para>
|
||
The API returns a response with the decoded message.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.ExpiredTokenException">
|
||
<summary>
|
||
The web identity token that was passed is expired or is not valid. Get a new identity
|
||
token from the identity provider and then retry the request.
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.ExpiredTokenException.#ctor(System.String)">
|
||
<summary>
|
||
Constructs a new ExpiredTokenException with the specified error
|
||
message.
|
||
</summary>
|
||
<param name="message">
|
||
Describes the error encountered.
|
||
</param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.ExpiredTokenException.#ctor(System.String,System.Exception)">
|
||
<summary>
|
||
Construct instance of ExpiredTokenException
|
||
</summary>
|
||
<param name="message"></param>
|
||
<param name="innerException"></param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.ExpiredTokenException.#ctor(System.Exception)">
|
||
<summary>
|
||
Construct instance of ExpiredTokenException
|
||
</summary>
|
||
<param name="innerException"></param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.ExpiredTokenException.#ctor(System.String,System.Exception,Amazon.Runtime.ErrorType,System.String,System.String,System.Net.HttpStatusCode)">
|
||
<summary>
|
||
Construct instance of ExpiredTokenException
|
||
</summary>
|
||
<param name="message"></param>
|
||
<param name="innerException"></param>
|
||
<param name="errorType"></param>
|
||
<param name="errorCode"></param>
|
||
<param name="requestId"></param>
|
||
<param name="statusCode"></param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.ExpiredTokenException.#ctor(System.String,Amazon.Runtime.ErrorType,System.String,System.String,System.Net.HttpStatusCode)">
|
||
<summary>
|
||
Construct instance of ExpiredTokenException
|
||
</summary>
|
||
<param name="message"></param>
|
||
<param name="errorType"></param>
|
||
<param name="errorCode"></param>
|
||
<param name="requestId"></param>
|
||
<param name="statusCode"></param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.ExpiredTokenException.#ctor(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext)">
|
||
<summary>
|
||
Constructs a new instance of the ExpiredTokenException class with serialized data.
|
||
</summary>
|
||
<param name="info">The <see cref="T:System.Runtime.Serialization.SerializationInfo" /> that holds the serialized object data about the exception being thrown.</param>
|
||
<param name="context">The <see cref="T:System.Runtime.Serialization.StreamingContext" /> that contains contextual information about the source or destination.</param>
|
||
<exception cref="T:System.ArgumentNullException">The <paramref name="info" /> parameter is null. </exception>
|
||
<exception cref="T:System.Runtime.Serialization.SerializationException">The class name is null or <see cref="P:System.Exception.HResult" /> is zero (0). </exception>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.ExpiredTokenException.GetObjectData(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext)">
|
||
<summary>
|
||
Sets the <see cref="T:System.Runtime.Serialization.SerializationInfo" /> with information about the exception.
|
||
</summary>
|
||
<param name="info">The <see cref="T:System.Runtime.Serialization.SerializationInfo" /> that holds the serialized object data about the exception being thrown.</param>
|
||
<param name="context">The <see cref="T:System.Runtime.Serialization.StreamingContext" /> that contains contextual information about the source or destination.</param>
|
||
<exception cref="T:System.ArgumentNullException">The <paramref name="info" /> parameter is a null reference (Nothing in Visual Basic). </exception>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.FederatedUser">
|
||
<summary>
|
||
Identifiers for the federated user that is associated with the credentials.
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.FederatedUser.#ctor">
|
||
<summary>
|
||
Empty constructor used to set properties independently even when a simple constructor is available
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.FederatedUser.#ctor(System.String,System.String)">
|
||
<summary>
|
||
Instantiates FederatedUser with the parameterized properties
|
||
</summary>
|
||
<param name="federatedUserId">The string that identifies the federated user associated with the credentials, similar to the unique ID of an IAM user.</param>
|
||
<param name="arn">The ARN that specifies the federated user that is associated with the credentials. For more information about ARNs and how to use them in policies, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html">IAM Identifiers</a> in the <i>IAM User Guide</i>. </param>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.FederatedUser.Arn">
|
||
<summary>
|
||
Gets and sets the property Arn.
|
||
<para>
|
||
The ARN that specifies the federated user that is associated with the credentials.
|
||
For more information about ARNs and how to use them in policies, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_identifiers.html">IAM
|
||
Identifiers</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.FederatedUser.FederatedUserId">
|
||
<summary>
|
||
Gets and sets the property FederatedUserId.
|
||
<para>
|
||
The string that identifies the federated user associated with the credentials, similar
|
||
to the unique ID of an IAM user.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.GetAccessKeyInfoRequest">
|
||
<summary>
|
||
Container for the parameters to the GetAccessKeyInfo operation.
|
||
Returns the account identifier for the specified access key ID.
|
||
|
||
|
||
<para>
|
||
Access keys consist of two parts: an access key ID (for example, <code>AKIAIOSFODNN7EXAMPLE</code>)
|
||
and a secret access key (for example, <code>wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY</code>).
|
||
For more information about access keys, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_access-keys.html">Managing
|
||
Access Keys for IAM Users</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
When you pass an access key ID to this operation, it returns the ID of the Amazon
|
||
Web Services account to which the keys belong. Access key IDs beginning with <code>AKIA</code>
|
||
are long-term credentials for an IAM user or the Amazon Web Services account root
|
||
user. Access key IDs beginning with <code>ASIA</code> are temporary credentials that
|
||
are created using STS operations. If the account in the response belongs to you, you
|
||
can sign in as the root user and review your root user access keys. Then, you can
|
||
pull a <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_getting-report.html">credentials
|
||
report</a> to learn which IAM user owns the keys. To learn who requested the temporary
|
||
credentials for an <code>ASIA</code> access key, view the STS events in your <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html">CloudTrail
|
||
logs</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
This operation does not indicate the state of the access key. The key might be active,
|
||
inactive, or deleted. Active keys might not have permissions to perform an operation.
|
||
Providing a deleted access key might return an error that the key doesn't exist.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.GetAccessKeyInfoRequest.AccessKeyId">
|
||
<summary>
|
||
Gets and sets the property AccessKeyId.
|
||
<para>
|
||
The identifier of an access key.
|
||
</para>
|
||
|
||
<para>
|
||
This parameter allows (through its regex pattern) a string of characters that can
|
||
consist of any upper- or lowercase letter or digit.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.GetAccessKeyInfoResponse">
|
||
<summary>
|
||
This is the response object from the GetAccessKeyInfo operation.
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.GetAccessKeyInfoResponse.Account">
|
||
<summary>
|
||
Gets and sets the property Account.
|
||
<para>
|
||
The number used to identify the Amazon Web Services account.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.GetCallerIdentityRequest">
|
||
<summary>
|
||
Container for the parameters to the GetCallerIdentity operation.
|
||
Returns details about the IAM user or role whose credentials are used to call the
|
||
operation.
|
||
|
||
<note>
|
||
<para>
|
||
No permissions are required to perform this operation. If an administrator adds a
|
||
policy to your IAM user or role that explicitly denies access to the <code>sts:GetCallerIdentity</code>
|
||
action, you can still perform this operation. Permissions are not required because
|
||
the same information is returned when an IAM user or role is denied access. To view
|
||
an example response, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/troubleshoot_general.html#troubleshoot_general_access-denied-delete-mfa">I
|
||
Am Not Authorized to Perform: iam:DeleteVirtualMFADevice</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
</note>
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.GetCallerIdentityResponse">
|
||
<summary>
|
||
Contains the response to a successful <a>GetCallerIdentity</a> request, including
|
||
information about the entity making the request.
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.GetCallerIdentityResponse.Account">
|
||
<summary>
|
||
Gets and sets the property Account.
|
||
<para>
|
||
The Amazon Web Services account ID number of the account that owns or contains the
|
||
calling entity.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.GetCallerIdentityResponse.Arn">
|
||
<summary>
|
||
Gets and sets the property Arn.
|
||
<para>
|
||
The Amazon Web Services ARN associated with the calling entity.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.GetCallerIdentityResponse.UserId">
|
||
<summary>
|
||
Gets and sets the property UserId.
|
||
<para>
|
||
The unique identifier of the calling entity. The exact value depends on the type of
|
||
entity that is making the call. The values returned are those listed in the <b>aws:userid</b>
|
||
column in the <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_variables.html#principaltable">Principal
|
||
table</a> found on the <b>Policy Variables</b> reference page in the <i>IAM User Guide</i>.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.GetFederationTokenRequest">
|
||
<summary>
|
||
Container for the parameters to the GetFederationToken operation.
|
||
Returns a set of temporary security credentials (consisting of an access key ID, a
|
||
secret access key, and a security token) for a federated user. A typical use is in
|
||
a proxy application that gets temporary security credentials on behalf of distributed
|
||
applications inside a corporate network. You must call the <code>GetFederationToken</code>
|
||
operation using the long-term security credentials of an IAM user. As a result, this
|
||
call is appropriate in contexts where those credentials can be safely stored, usually
|
||
in a server-based application. For a comparison of <code>GetFederationToken</code>
|
||
with the other API operations that produce temporary credentials, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html">Requesting
|
||
Temporary Security Credentials</a> and <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#stsapi_comparison">Comparing
|
||
the Amazon Web Services STS API operations</a> in the <i>IAM User Guide</i>.
|
||
|
||
<note>
|
||
<para>
|
||
You can create a mobile-based or browser-based app that can authenticate users using
|
||
a web identity provider like Login with Amazon, Facebook, Google, or an OpenID Connect-compatible
|
||
identity provider. In this case, we recommend that you use <a href="http://aws.amazon.com/cognito/">Amazon
|
||
Cognito</a> or <code>AssumeRoleWithWebIdentity</code>. For more information, see <a
|
||
href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#api_assumerolewithwebidentity">Federation
|
||
Through a Web-based Identity Provider</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
</note>
|
||
<para>
|
||
You can also call <code>GetFederationToken</code> using the security credentials of
|
||
an Amazon Web Services account root user, but we do not recommend it. Instead, we
|
||
recommend that you create an IAM user for the purpose of the proxy application. Then
|
||
attach a policy to the IAM user that limits federated users to only the actions and
|
||
resources that they need to access. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html">IAM
|
||
Best Practices</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
<b>Session duration</b>
|
||
</para>
|
||
|
||
<para>
|
||
The temporary credentials are valid for the specified duration, from 900 seconds (15
|
||
minutes) up to a maximum of 129,600 seconds (36 hours). The default session duration
|
||
is 43,200 seconds (12 hours). Temporary credentials obtained by using the Amazon Web
|
||
Services account root user credentials have a maximum duration of 3,600 seconds (1
|
||
hour).
|
||
</para>
|
||
|
||
<para>
|
||
<b>Permissions</b>
|
||
</para>
|
||
|
||
<para>
|
||
You can use the temporary credentials created by <code>GetFederationToken</code> in
|
||
any Amazon Web Services service except the following:
|
||
</para>
|
||
<ul> <li>
|
||
<para>
|
||
You cannot call any IAM operations using the CLI or the Amazon Web Services API.
|
||
</para>
|
||
</li> <li>
|
||
<para>
|
||
You cannot call any STS operations except <code>GetCallerIdentity</code>.
|
||
</para>
|
||
</li> </ul>
|
||
<para>
|
||
You must pass an inline or managed <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">session
|
||
policy</a> to this operation. You can pass a single JSON policy document to use as
|
||
an inline session policy. You can also specify up to 10 managed policies to use as
|
||
managed session policies. The plaintext that you use for both inline and managed session
|
||
policies can't exceed 2,048 characters.
|
||
</para>
|
||
|
||
<para>
|
||
Though the session policy parameters are optional, if you do not pass a policy, then
|
||
the resulting federated user session has no permissions. When you pass session policies,
|
||
the session permissions are the intersection of the IAM user policies and the session
|
||
policies that you pass. This gives you a way to further restrict the permissions for
|
||
a federated user. You cannot use session policies to grant more permissions than those
|
||
that are defined in the permissions policy of the IAM user. For more information,
|
||
see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">Session
|
||
Policies</a> in the <i>IAM User Guide</i>. For information about using <code>GetFederationToken</code>
|
||
to create temporary security credentials, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#api_getfederationtoken">GetFederationToken—Federation
|
||
Through a Custom Identity Broker</a>.
|
||
</para>
|
||
|
||
<para>
|
||
You can use the credentials to access a resource that has a resource-based policy.
|
||
If that policy specifically references the federated user session in the <code>Principal</code>
|
||
element of the policy, the session has the permissions allowed by the policy. These
|
||
permissions are granted in addition to the permissions granted by the session policies.
|
||
</para>
|
||
|
||
<para>
|
||
<b>Tags</b>
|
||
</para>
|
||
|
||
<para>
|
||
(Optional) You can pass tag key-value pairs to your session. These are called session
|
||
tags. For more information about session tags, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html">Passing
|
||
Session Tags in STS</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
<note>
|
||
<para>
|
||
You can create a mobile-based or browser-based app that can authenticate users using
|
||
a web identity provider like Login with Amazon, Facebook, Google, or an OpenID Connect-compatible
|
||
identity provider. In this case, we recommend that you use <a href="http://aws.amazon.com/cognito/">Amazon
|
||
Cognito</a> or <code>AssumeRoleWithWebIdentity</code>. For more information, see <a
|
||
href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#api_assumerolewithwebidentity">Federation
|
||
Through a Web-based Identity Provider</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
</note>
|
||
<para>
|
||
An administrator must grant you the permissions necessary to pass session tags. The
|
||
administrator can also create granular permissions to allow you to pass only specific
|
||
session tags. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_attribute-based-access-control.html">Tutorial:
|
||
Using Tags for Attribute-Based Access Control</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
Tag key–value pairs are not case sensitive, but case is preserved. This means that
|
||
you cannot have separate <code>Department</code> and <code>department</code> tag keys.
|
||
Assume that the user that you are federating has the <code>Department</code>=<code>Marketing</code>
|
||
tag and you pass the <code>department</code>=<code>engineering</code> session tag.
|
||
<code>Department</code> and <code>department</code> are not saved as separate tags,
|
||
and the session tag passed in the request takes precedence over the user tag.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.GetFederationTokenRequest.#ctor">
|
||
<summary>
|
||
Empty constructor used to set properties independently even when a simple constructor is available
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.GetFederationTokenRequest.#ctor(System.String)">
|
||
<summary>
|
||
Instantiates GetFederationTokenRequest with the parameterized properties
|
||
</summary>
|
||
<param name="name">The name of the federated user. The name is used as an identifier for the temporary security credentials (such as <code>Bob</code>). For example, you can reference the federated user name in a resource-based policy, such as in an Amazon S3 bucket policy. The regex used to validate this parameter is a string of characters consisting of upper- and lower-case alphanumeric characters with no spaces. You can also include underscores or any of the following characters: =,.@-</param>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.GetFederationTokenRequest.DurationSeconds">
|
||
<summary>
|
||
Gets and sets the property DurationSeconds.
|
||
<para>
|
||
The duration, in seconds, that the session should last. Acceptable durations for federation
|
||
sessions range from 900 seconds (15 minutes) to 129,600 seconds (36 hours), with 43,200
|
||
seconds (12 hours) as the default. Sessions obtained using Amazon Web Services account
|
||
root user credentials are restricted to a maximum of 3,600 seconds (one hour). If
|
||
the specified duration is longer than one hour, the session obtained by using root
|
||
user credentials defaults to one hour.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.GetFederationTokenRequest.Name">
|
||
<summary>
|
||
Gets and sets the property Name.
|
||
<para>
|
||
The name of the federated user. The name is used as an identifier for the temporary
|
||
security credentials (such as <code>Bob</code>). For example, you can reference the
|
||
federated user name in a resource-based policy, such as in an Amazon S3 bucket policy.
|
||
</para>
|
||
|
||
<para>
|
||
The regex used to validate this parameter is a string of characters consisting of
|
||
upper- and lower-case alphanumeric characters with no spaces. You can also include
|
||
underscores or any of the following characters: =,.@-
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.GetFederationTokenRequest.Policy">
|
||
<summary>
|
||
Gets and sets the property Policy.
|
||
<para>
|
||
An IAM policy in JSON format that you want to use as an inline session policy.
|
||
</para>
|
||
|
||
<para>
|
||
You must pass an inline or managed <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">session
|
||
policy</a> to this operation. You can pass a single JSON policy document to use as
|
||
an inline session policy. You can also specify up to 10 managed policies to use as
|
||
managed session policies.
|
||
</para>
|
||
|
||
<para>
|
||
This parameter is optional. However, if you do not pass any session policies, then
|
||
the resulting federated user session has no permissions.
|
||
</para>
|
||
|
||
<para>
|
||
When you pass session policies, the session permissions are the intersection of the
|
||
IAM user policies and the session policies that you pass. This gives you a way to
|
||
further restrict the permissions for a federated user. You cannot use session policies
|
||
to grant more permissions than those that are defined in the permissions policy of
|
||
the IAM user. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">Session
|
||
Policies</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
The resulting credentials can be used to access a resource that has a resource-based
|
||
policy. If that policy specifically references the federated user session in the <code>Principal</code>
|
||
element of the policy, the session has the permissions allowed by the policy. These
|
||
permissions are granted in addition to the permissions that are granted by the session
|
||
policies.
|
||
</para>
|
||
|
||
<para>
|
||
The plaintext that you use for both inline and managed session policies can't exceed
|
||
2,048 characters. The JSON policy characters can be any ASCII character from the space
|
||
character to the end of the valid character list (\u0020 through \u00FF). It can also
|
||
include the tab (\u0009), linefeed (\u000A), and carriage return (\u000D) characters.
|
||
</para>
|
||
<note>
|
||
<para>
|
||
An Amazon Web Services conversion compresses the passed session policies and session
|
||
tags into a packed binary format that has a separate limit. Your request can fail
|
||
for this limit even if your plaintext meets the other requirements. The <code>PackedPolicySize</code>
|
||
response element indicates by percentage how close the policies and tags for your
|
||
request are to the upper size limit.
|
||
</para>
|
||
</note>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.GetFederationTokenRequest.PolicyArns">
|
||
<summary>
|
||
Gets and sets the property PolicyArns.
|
||
<para>
|
||
The Amazon Resource Names (ARNs) of the IAM managed policies that you want to use
|
||
as a managed session policy. The policies must exist in the same account as the IAM
|
||
user that is requesting federated access.
|
||
</para>
|
||
|
||
<para>
|
||
You must pass an inline or managed <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">session
|
||
policy</a> to this operation. You can pass a single JSON policy document to use as
|
||
an inline session policy. You can also specify up to 10 managed policies to use as
|
||
managed session policies. The plaintext that you use for both inline and managed session
|
||
policies can't exceed 2,048 characters. You can provide up to 10 managed policy ARNs.
|
||
For more information about ARNs, see <a href="https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html">Amazon
|
||
Resource Names (ARNs) and Amazon Web Services Service Namespaces</a> in the Amazon
|
||
Web Services General Reference.
|
||
</para>
|
||
|
||
<para>
|
||
This parameter is optional. However, if you do not pass any session policies, then
|
||
the resulting federated user session has no permissions.
|
||
</para>
|
||
|
||
<para>
|
||
When you pass session policies, the session permissions are the intersection of the
|
||
IAM user policies and the session policies that you pass. This gives you a way to
|
||
further restrict the permissions for a federated user. You cannot use session policies
|
||
to grant more permissions than those that are defined in the permissions policy of
|
||
the IAM user. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies.html#policies_session">Session
|
||
Policies</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
The resulting credentials can be used to access a resource that has a resource-based
|
||
policy. If that policy specifically references the federated user session in the <code>Principal</code>
|
||
element of the policy, the session has the permissions allowed by the policy. These
|
||
permissions are granted in addition to the permissions that are granted by the session
|
||
policies.
|
||
</para>
|
||
<note>
|
||
<para>
|
||
An Amazon Web Services conversion compresses the passed session policies and session
|
||
tags into a packed binary format that has a separate limit. Your request can fail
|
||
for this limit even if your plaintext meets the other requirements. The <code>PackedPolicySize</code>
|
||
response element indicates by percentage how close the policies and tags for your
|
||
request are to the upper size limit.
|
||
</para>
|
||
</note>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.GetFederationTokenRequest.Tags">
|
||
<summary>
|
||
Gets and sets the property Tags.
|
||
<para>
|
||
A list of session tags. Each session tag consists of a key name and an associated
|
||
value. For more information about session tags, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html">Passing
|
||
Session Tags in STS</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
|
||
<para>
|
||
This parameter is optional. You can pass up to 50 session tags. The plaintext session
|
||
tag keys can’t exceed 128 characters and the values can’t exceed 256 characters. For
|
||
these and additional limits, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-limits.html#reference_iam-limits-entity-length">IAM
|
||
and STS Character Limits</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
<note>
|
||
<para>
|
||
An Amazon Web Services conversion compresses the passed session policies and session
|
||
tags into a packed binary format that has a separate limit. Your request can fail
|
||
for this limit even if your plaintext meets the other requirements. The <code>PackedPolicySize</code>
|
||
response element indicates by percentage how close the policies and tags for your
|
||
request are to the upper size limit.
|
||
</para>
|
||
</note>
|
||
<para>
|
||
You can pass a session tag with the same key as a tag that is already attached to
|
||
the user you are federating. When you do, session tags override a user tag with the
|
||
same key.
|
||
</para>
|
||
|
||
<para>
|
||
Tag key–value pairs are not case sensitive, but case is preserved. This means that
|
||
you cannot have separate <code>Department</code> and <code>department</code> tag keys.
|
||
Assume that the role has the <code>Department</code>=<code>Marketing</code> tag and
|
||
you pass the <code>department</code>=<code>engineering</code> session tag. <code>Department</code>
|
||
and <code>department</code> are not saved as separate tags, and the session tag passed
|
||
in the request takes precedence over the role tag.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.GetFederationTokenResponse">
|
||
<summary>
|
||
Contains the response to a successful <a>GetFederationToken</a> request, including
|
||
temporary Amazon Web Services credentials that can be used to make Amazon Web Services
|
||
requests.
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.GetFederationTokenResponse.Credentials">
|
||
<summary>
|
||
Gets and sets the property Credentials.
|
||
<para>
|
||
The temporary security credentials, which include an access key ID, a secret access
|
||
key, and a security (or session) token.
|
||
</para>
|
||
<note>
|
||
<para>
|
||
The size of the security token that STS API operations return is not fixed. We strongly
|
||
recommend that you make no assumptions about the maximum size.
|
||
</para>
|
||
</note>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.GetFederationTokenResponse.FederatedUser">
|
||
<summary>
|
||
Gets and sets the property FederatedUser.
|
||
<para>
|
||
Identifiers for the federated user associated with the credentials (such as <code>arn:aws:sts::123456789012:federated-user/Bob</code>
|
||
or <code>123456789012:Bob</code>). You can use the federated user's ARN in your resource-based
|
||
policies, such as an Amazon S3 bucket policy.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.GetFederationTokenResponse.PackedPolicySize">
|
||
<summary>
|
||
Gets and sets the property PackedPolicySize.
|
||
<para>
|
||
A percentage value that indicates the packed size of the session policies and session
|
||
tags combined passed in the request. The request fails if the packed size is greater
|
||
than 100 percent, which means the policies and tags exceeded the allowed space.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.GetSessionTokenRequest">
|
||
<summary>
|
||
Container for the parameters to the GetSessionToken operation.
|
||
Returns a set of temporary credentials for an Amazon Web Services account or IAM user.
|
||
The credentials consist of an access key ID, a secret access key, and a security token.
|
||
Typically, you use <code>GetSessionToken</code> if you want to use MFA to protect
|
||
programmatic calls to specific Amazon Web Services API operations like Amazon EC2
|
||
<code>StopInstances</code>. MFA-enabled IAM users would need to call <code>GetSessionToken</code>
|
||
and submit an MFA code that is associated with their MFA device. Using the temporary
|
||
security credentials that are returned from the call, IAM users can then make programmatic
|
||
calls to API operations that require MFA authentication. If you do not supply a correct
|
||
MFA code, then the API returns an access denied error. For a comparison of <code>GetSessionToken</code>
|
||
with the other API operations that produce temporary credentials, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html">Requesting
|
||
Temporary Security Credentials</a> and <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#stsapi_comparison">Comparing
|
||
the Amazon Web Services STS API operations</a> in the <i>IAM User Guide</i>.
|
||
|
||
<note>
|
||
<para>
|
||
No permissions are required for users to perform this operation. The purpose of the
|
||
<code>sts:GetSessionToken</code> operation is to authenticate the user using MFA.
|
||
You cannot use policies to control authentication operations. For more information,
|
||
see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_getsessiontoken.html">Permissions
|
||
for GetSessionToken</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
</note>
|
||
<para>
|
||
<b>Session Duration</b>
|
||
</para>
|
||
|
||
<para>
|
||
The <code>GetSessionToken</code> operation must be called by using the long-term Amazon
|
||
Web Services security credentials of the Amazon Web Services account root user or
|
||
an IAM user. Credentials that are created by IAM users are valid for the duration
|
||
that you specify. This duration can range from 900 seconds (15 minutes) up to a maximum
|
||
of 129,600 seconds (36 hours), with a default of 43,200 seconds (12 hours). Credentials
|
||
based on account credentials can range from 900 seconds (15 minutes) up to 3,600 seconds
|
||
(1 hour), with a default of 1 hour.
|
||
</para>
|
||
|
||
<para>
|
||
<b>Permissions</b>
|
||
</para>
|
||
|
||
<para>
|
||
The temporary security credentials created by <code>GetSessionToken</code> can be
|
||
used to make API calls to any Amazon Web Services service with the following exceptions:
|
||
</para>
|
||
<ul> <li>
|
||
<para>
|
||
You cannot call any IAM API operations unless MFA authentication information is included
|
||
in the request.
|
||
</para>
|
||
</li> <li>
|
||
<para>
|
||
You cannot call any STS API <i>except</i> <code>AssumeRole</code> or <code>GetCallerIdentity</code>.
|
||
</para>
|
||
</li> </ul> <note>
|
||
<para>
|
||
We recommend that you do not call <code>GetSessionToken</code> with Amazon Web Services
|
||
account root user credentials. Instead, follow our <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#create-iam-users">best
|
||
practices</a> by creating one or more IAM users, giving them the necessary permissions,
|
||
and using IAM users for everyday interaction with Amazon Web Services.
|
||
</para>
|
||
</note>
|
||
<para>
|
||
The credentials that are returned by <code>GetSessionToken</code> are based on permissions
|
||
associated with the user whose credentials were used to call the operation. If <code>GetSessionToken</code>
|
||
is called using Amazon Web Services account root user credentials, the temporary credentials
|
||
have root user permissions. Similarly, if <code>GetSessionToken</code> is called using
|
||
the credentials of an IAM user, the temporary credentials have the same permissions
|
||
as the IAM user.
|
||
</para>
|
||
|
||
<para>
|
||
For more information about using <code>GetSessionToken</code> to create temporary
|
||
credentials, go to <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_request.html#api_getsessiontoken">Temporary
|
||
Credentials for Users in Untrusted Environments</a> in the <i>IAM User Guide</i>.
|
||
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.GetSessionTokenRequest.#ctor">
|
||
<summary>
|
||
Empty constructor used to set properties independently even when a simple constructor is available
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.GetSessionTokenRequest.DurationSeconds">
|
||
<summary>
|
||
Gets and sets the property DurationSeconds.
|
||
<para>
|
||
The duration, in seconds, that the credentials should remain valid. Acceptable durations
|
||
for IAM user sessions range from 900 seconds (15 minutes) to 129,600 seconds (36 hours),
|
||
with 43,200 seconds (12 hours) as the default. Sessions for Amazon Web Services account
|
||
owners are restricted to a maximum of 3,600 seconds (one hour). If the duration is
|
||
longer than one hour, the session for Amazon Web Services account owners defaults
|
||
to one hour.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.GetSessionTokenRequest.SerialNumber">
|
||
<summary>
|
||
Gets and sets the property SerialNumber.
|
||
<para>
|
||
The identification number of the MFA device that is associated with the IAM user who
|
||
is making the <code>GetSessionToken</code> call. Specify this value if the IAM user
|
||
has a policy that requires MFA authentication. The value is either the serial number
|
||
for a hardware device (such as <code>GAHT12345678</code>) or an Amazon Resource Name
|
||
(ARN) for a virtual device (such as <code>arn:aws:iam::123456789012:mfa/user</code>).
|
||
You can find the device for an IAM user by going to the Amazon Web Services Management
|
||
Console and viewing the user's security credentials.
|
||
</para>
|
||
|
||
<para>
|
||
The regex used to validate this parameter is a string of characters consisting of
|
||
upper- and lower-case alphanumeric characters with no spaces. You can also include
|
||
underscores or any of the following characters: =,.@:/-
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.GetSessionTokenRequest.TokenCode">
|
||
<summary>
|
||
Gets and sets the property TokenCode.
|
||
<para>
|
||
The value provided by the MFA device, if MFA is required. If any policy requires the
|
||
IAM user to submit an MFA code, specify this value. If MFA authentication is required,
|
||
the user must provide a code when requesting a set of temporary security credentials.
|
||
A user who fails to provide the code receives an "access denied" response when requesting
|
||
resources that require MFA authentication.
|
||
</para>
|
||
|
||
<para>
|
||
The format for this parameter, as described by its regex pattern, is a sequence of
|
||
six numeric digits.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.GetSessionTokenResponse">
|
||
<summary>
|
||
Contains the response to a successful <a>GetSessionToken</a> request, including temporary
|
||
Amazon Web Services credentials that can be used to make Amazon Web Services requests.
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.GetSessionTokenResponse.Credentials">
|
||
<summary>
|
||
Gets and sets the property Credentials.
|
||
<para>
|
||
The temporary security credentials, which include an access key ID, a secret access
|
||
key, and a security (or session) token.
|
||
</para>
|
||
<note>
|
||
<para>
|
||
The size of the security token that STS API operations return is not fixed. We strongly
|
||
recommend that you make no assumptions about the maximum size.
|
||
</para>
|
||
</note>
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.IDPCommunicationErrorException">
|
||
<summary>
|
||
The request could not be fulfilled because the identity provider (IDP) that was asked
|
||
to verify the incoming identity token could not be reached. This is often a transient
|
||
error caused by network conditions. Retry the request a limited number of times so
|
||
that you don't exceed the request rate. If the error persists, the identity provider
|
||
might be down or not responding.
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.IDPCommunicationErrorException.#ctor(System.String)">
|
||
<summary>
|
||
Constructs a new IDPCommunicationErrorException with the specified error
|
||
message.
|
||
</summary>
|
||
<param name="message">
|
||
Describes the error encountered.
|
||
</param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.IDPCommunicationErrorException.#ctor(System.String,System.Exception)">
|
||
<summary>
|
||
Construct instance of IDPCommunicationErrorException
|
||
</summary>
|
||
<param name="message"></param>
|
||
<param name="innerException"></param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.IDPCommunicationErrorException.#ctor(System.Exception)">
|
||
<summary>
|
||
Construct instance of IDPCommunicationErrorException
|
||
</summary>
|
||
<param name="innerException"></param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.IDPCommunicationErrorException.#ctor(System.String,System.Exception,Amazon.Runtime.ErrorType,System.String,System.String,System.Net.HttpStatusCode)">
|
||
<summary>
|
||
Construct instance of IDPCommunicationErrorException
|
||
</summary>
|
||
<param name="message"></param>
|
||
<param name="innerException"></param>
|
||
<param name="errorType"></param>
|
||
<param name="errorCode"></param>
|
||
<param name="requestId"></param>
|
||
<param name="statusCode"></param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.IDPCommunicationErrorException.#ctor(System.String,Amazon.Runtime.ErrorType,System.String,System.String,System.Net.HttpStatusCode)">
|
||
<summary>
|
||
Construct instance of IDPCommunicationErrorException
|
||
</summary>
|
||
<param name="message"></param>
|
||
<param name="errorType"></param>
|
||
<param name="errorCode"></param>
|
||
<param name="requestId"></param>
|
||
<param name="statusCode"></param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.IDPCommunicationErrorException.#ctor(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext)">
|
||
<summary>
|
||
Constructs a new instance of the IDPCommunicationErrorException class with serialized data.
|
||
</summary>
|
||
<param name="info">The <see cref="T:System.Runtime.Serialization.SerializationInfo" /> that holds the serialized object data about the exception being thrown.</param>
|
||
<param name="context">The <see cref="T:System.Runtime.Serialization.StreamingContext" /> that contains contextual information about the source or destination.</param>
|
||
<exception cref="T:System.ArgumentNullException">The <paramref name="info" /> parameter is null. </exception>
|
||
<exception cref="T:System.Runtime.Serialization.SerializationException">The class name is null or <see cref="P:System.Exception.HResult" /> is zero (0). </exception>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.IDPCommunicationErrorException.GetObjectData(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext)">
|
||
<summary>
|
||
Sets the <see cref="T:System.Runtime.Serialization.SerializationInfo" /> with information about the exception.
|
||
</summary>
|
||
<param name="info">The <see cref="T:System.Runtime.Serialization.SerializationInfo" /> that holds the serialized object data about the exception being thrown.</param>
|
||
<param name="context">The <see cref="T:System.Runtime.Serialization.StreamingContext" /> that contains contextual information about the source or destination.</param>
|
||
<exception cref="T:System.ArgumentNullException">The <paramref name="info" /> parameter is a null reference (Nothing in Visual Basic). </exception>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.IDPRejectedClaimException">
|
||
<summary>
|
||
The identity provider (IdP) reported that authentication failed. This might be because
|
||
the claim is invalid.
|
||
|
||
|
||
<para>
|
||
If this error is returned for the <code>AssumeRoleWithWebIdentity</code> operation,
|
||
it can also mean that the claim has expired or has been explicitly revoked.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.IDPRejectedClaimException.#ctor(System.String)">
|
||
<summary>
|
||
Constructs a new IDPRejectedClaimException with the specified error
|
||
message.
|
||
</summary>
|
||
<param name="message">
|
||
Describes the error encountered.
|
||
</param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.IDPRejectedClaimException.#ctor(System.String,System.Exception)">
|
||
<summary>
|
||
Construct instance of IDPRejectedClaimException
|
||
</summary>
|
||
<param name="message"></param>
|
||
<param name="innerException"></param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.IDPRejectedClaimException.#ctor(System.Exception)">
|
||
<summary>
|
||
Construct instance of IDPRejectedClaimException
|
||
</summary>
|
||
<param name="innerException"></param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.IDPRejectedClaimException.#ctor(System.String,System.Exception,Amazon.Runtime.ErrorType,System.String,System.String,System.Net.HttpStatusCode)">
|
||
<summary>
|
||
Construct instance of IDPRejectedClaimException
|
||
</summary>
|
||
<param name="message"></param>
|
||
<param name="innerException"></param>
|
||
<param name="errorType"></param>
|
||
<param name="errorCode"></param>
|
||
<param name="requestId"></param>
|
||
<param name="statusCode"></param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.IDPRejectedClaimException.#ctor(System.String,Amazon.Runtime.ErrorType,System.String,System.String,System.Net.HttpStatusCode)">
|
||
<summary>
|
||
Construct instance of IDPRejectedClaimException
|
||
</summary>
|
||
<param name="message"></param>
|
||
<param name="errorType"></param>
|
||
<param name="errorCode"></param>
|
||
<param name="requestId"></param>
|
||
<param name="statusCode"></param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.IDPRejectedClaimException.#ctor(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext)">
|
||
<summary>
|
||
Constructs a new instance of the IDPRejectedClaimException class with serialized data.
|
||
</summary>
|
||
<param name="info">The <see cref="T:System.Runtime.Serialization.SerializationInfo" /> that holds the serialized object data about the exception being thrown.</param>
|
||
<param name="context">The <see cref="T:System.Runtime.Serialization.StreamingContext" /> that contains contextual information about the source or destination.</param>
|
||
<exception cref="T:System.ArgumentNullException">The <paramref name="info" /> parameter is null. </exception>
|
||
<exception cref="T:System.Runtime.Serialization.SerializationException">The class name is null or <see cref="P:System.Exception.HResult" /> is zero (0). </exception>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.IDPRejectedClaimException.GetObjectData(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext)">
|
||
<summary>
|
||
Sets the <see cref="T:System.Runtime.Serialization.SerializationInfo" /> with information about the exception.
|
||
</summary>
|
||
<param name="info">The <see cref="T:System.Runtime.Serialization.SerializationInfo" /> that holds the serialized object data about the exception being thrown.</param>
|
||
<param name="context">The <see cref="T:System.Runtime.Serialization.StreamingContext" /> that contains contextual information about the source or destination.</param>
|
||
<exception cref="T:System.ArgumentNullException">The <paramref name="info" /> parameter is a null reference (Nothing in Visual Basic). </exception>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.Internal.MarshallTransformations.AssumedRoleUserUnmarshaller">
|
||
<summary>
|
||
Response Unmarshaller for AssumedRoleUser Object
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Internal.MarshallTransformations.AssumedRoleUserUnmarshaller.Unmarshall(Amazon.Runtime.Internal.Transform.XmlUnmarshallerContext)">
|
||
<summary>
|
||
Unmarshaller the response from the service to the response class.
|
||
</summary>
|
||
<param name="context"></param>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Internal.MarshallTransformations.AssumedRoleUserUnmarshaller.Unmarshall(Amazon.Runtime.Internal.Transform.JsonUnmarshallerContext)">
|
||
<summary>
|
||
Unmarshaller error response to exception.
|
||
</summary>
|
||
<param name="context"></param>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.Internal.MarshallTransformations.AssumedRoleUserUnmarshaller.Instance">
|
||
<summary>
|
||
Gets the singleton.
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.Internal.MarshallTransformations.AssumeRoleRequestMarshaller">
|
||
<summary>
|
||
AssumeRole Request Marshaller
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Internal.MarshallTransformations.AssumeRoleRequestMarshaller.Marshall(Amazon.Runtime.AmazonWebServiceRequest)">
|
||
<summary>
|
||
Marshaller the request object to the HTTP request.
|
||
</summary>
|
||
<param name="input"></param>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Internal.MarshallTransformations.AssumeRoleRequestMarshaller.Marshall(Amazon.SecurityToken.Model.AssumeRoleRequest)">
|
||
<summary>
|
||
Marshaller the request object to the HTTP request.
|
||
</summary>
|
||
<param name="publicRequest"></param>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.Internal.MarshallTransformations.AssumeRoleRequestMarshaller.Instance">
|
||
<summary>
|
||
Gets the singleton.
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.Internal.MarshallTransformations.AssumeRoleResponseUnmarshaller">
|
||
<summary>
|
||
Response Unmarshaller for AssumeRole operation
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Internal.MarshallTransformations.AssumeRoleResponseUnmarshaller.Unmarshall(Amazon.Runtime.Internal.Transform.XmlUnmarshallerContext)">
|
||
<summary>
|
||
Unmarshaller the response from the service to the response class.
|
||
</summary>
|
||
<param name="context"></param>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Internal.MarshallTransformations.AssumeRoleResponseUnmarshaller.UnmarshallException(Amazon.Runtime.Internal.Transform.XmlUnmarshallerContext,System.Exception,System.Net.HttpStatusCode)">
|
||
<summary>
|
||
Unmarshaller error response to exception.
|
||
</summary>
|
||
<param name="context"></param>
|
||
<param name="innerException"></param>
|
||
<param name="statusCode"></param>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.Internal.MarshallTransformations.AssumeRoleResponseUnmarshaller.Instance">
|
||
<summary>
|
||
Gets the singleton.
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.Internal.MarshallTransformations.AssumeRoleWithSAMLRequestMarshaller">
|
||
<summary>
|
||
AssumeRoleWithSAML Request Marshaller
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Internal.MarshallTransformations.AssumeRoleWithSAMLRequestMarshaller.Marshall(Amazon.Runtime.AmazonWebServiceRequest)">
|
||
<summary>
|
||
Marshaller the request object to the HTTP request.
|
||
</summary>
|
||
<param name="input"></param>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Internal.MarshallTransformations.AssumeRoleWithSAMLRequestMarshaller.Marshall(Amazon.SecurityToken.Model.AssumeRoleWithSAMLRequest)">
|
||
<summary>
|
||
Marshaller the request object to the HTTP request.
|
||
</summary>
|
||
<param name="publicRequest"></param>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.Internal.MarshallTransformations.AssumeRoleWithSAMLRequestMarshaller.Instance">
|
||
<summary>
|
||
Gets the singleton.
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.Internal.MarshallTransformations.AssumeRoleWithSAMLResponseUnmarshaller">
|
||
<summary>
|
||
Response Unmarshaller for AssumeRoleWithSAML operation
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Internal.MarshallTransformations.AssumeRoleWithSAMLResponseUnmarshaller.Unmarshall(Amazon.Runtime.Internal.Transform.XmlUnmarshallerContext)">
|
||
<summary>
|
||
Unmarshaller the response from the service to the response class.
|
||
</summary>
|
||
<param name="context"></param>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Internal.MarshallTransformations.AssumeRoleWithSAMLResponseUnmarshaller.UnmarshallException(Amazon.Runtime.Internal.Transform.XmlUnmarshallerContext,System.Exception,System.Net.HttpStatusCode)">
|
||
<summary>
|
||
Unmarshaller error response to exception.
|
||
</summary>
|
||
<param name="context"></param>
|
||
<param name="innerException"></param>
|
||
<param name="statusCode"></param>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.Internal.MarshallTransformations.AssumeRoleWithSAMLResponseUnmarshaller.Instance">
|
||
<summary>
|
||
Gets the singleton.
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.Internal.MarshallTransformations.AssumeRoleWithWebIdentityRequestMarshaller">
|
||
<summary>
|
||
AssumeRoleWithWebIdentity Request Marshaller
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Internal.MarshallTransformations.AssumeRoleWithWebIdentityRequestMarshaller.Marshall(Amazon.Runtime.AmazonWebServiceRequest)">
|
||
<summary>
|
||
Marshaller the request object to the HTTP request.
|
||
</summary>
|
||
<param name="input"></param>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Internal.MarshallTransformations.AssumeRoleWithWebIdentityRequestMarshaller.Marshall(Amazon.SecurityToken.Model.AssumeRoleWithWebIdentityRequest)">
|
||
<summary>
|
||
Marshaller the request object to the HTTP request.
|
||
</summary>
|
||
<param name="publicRequest"></param>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.Internal.MarshallTransformations.AssumeRoleWithWebIdentityRequestMarshaller.Instance">
|
||
<summary>
|
||
Gets the singleton.
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.Internal.MarshallTransformations.AssumeRoleWithWebIdentityResponseUnmarshaller">
|
||
<summary>
|
||
Response Unmarshaller for AssumeRoleWithWebIdentity operation
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Internal.MarshallTransformations.AssumeRoleWithWebIdentityResponseUnmarshaller.Unmarshall(Amazon.Runtime.Internal.Transform.XmlUnmarshallerContext)">
|
||
<summary>
|
||
Unmarshaller the response from the service to the response class.
|
||
</summary>
|
||
<param name="context"></param>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Internal.MarshallTransformations.AssumeRoleWithWebIdentityResponseUnmarshaller.UnmarshallException(Amazon.Runtime.Internal.Transform.XmlUnmarshallerContext,System.Exception,System.Net.HttpStatusCode)">
|
||
<summary>
|
||
Unmarshaller error response to exception.
|
||
</summary>
|
||
<param name="context"></param>
|
||
<param name="innerException"></param>
|
||
<param name="statusCode"></param>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.Internal.MarshallTransformations.AssumeRoleWithWebIdentityResponseUnmarshaller.Instance">
|
||
<summary>
|
||
Gets the singleton.
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.Internal.MarshallTransformations.CredentialsUnmarshaller">
|
||
<summary>
|
||
Response Unmarshaller for Credentials Object
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Internal.MarshallTransformations.CredentialsUnmarshaller.Unmarshall(Amazon.Runtime.Internal.Transform.XmlUnmarshallerContext)">
|
||
<summary>
|
||
Unmarshaller the response from the service to the response class.
|
||
</summary>
|
||
<param name="context"></param>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Internal.MarshallTransformations.CredentialsUnmarshaller.Unmarshall(Amazon.Runtime.Internal.Transform.JsonUnmarshallerContext)">
|
||
<summary>
|
||
Unmarshaller error response to exception.
|
||
</summary>
|
||
<param name="context"></param>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.Internal.MarshallTransformations.CredentialsUnmarshaller.Instance">
|
||
<summary>
|
||
Gets the singleton.
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.Internal.MarshallTransformations.DecodeAuthorizationMessageRequestMarshaller">
|
||
<summary>
|
||
DecodeAuthorizationMessage Request Marshaller
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Internal.MarshallTransformations.DecodeAuthorizationMessageRequestMarshaller.Marshall(Amazon.Runtime.AmazonWebServiceRequest)">
|
||
<summary>
|
||
Marshaller the request object to the HTTP request.
|
||
</summary>
|
||
<param name="input"></param>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Internal.MarshallTransformations.DecodeAuthorizationMessageRequestMarshaller.Marshall(Amazon.SecurityToken.Model.DecodeAuthorizationMessageRequest)">
|
||
<summary>
|
||
Marshaller the request object to the HTTP request.
|
||
</summary>
|
||
<param name="publicRequest"></param>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.Internal.MarshallTransformations.DecodeAuthorizationMessageRequestMarshaller.Instance">
|
||
<summary>
|
||
Gets the singleton.
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.Internal.MarshallTransformations.DecodeAuthorizationMessageResponseUnmarshaller">
|
||
<summary>
|
||
Response Unmarshaller for DecodeAuthorizationMessage operation
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Internal.MarshallTransformations.DecodeAuthorizationMessageResponseUnmarshaller.Unmarshall(Amazon.Runtime.Internal.Transform.XmlUnmarshallerContext)">
|
||
<summary>
|
||
Unmarshaller the response from the service to the response class.
|
||
</summary>
|
||
<param name="context"></param>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Internal.MarshallTransformations.DecodeAuthorizationMessageResponseUnmarshaller.UnmarshallException(Amazon.Runtime.Internal.Transform.XmlUnmarshallerContext,System.Exception,System.Net.HttpStatusCode)">
|
||
<summary>
|
||
Unmarshaller error response to exception.
|
||
</summary>
|
||
<param name="context"></param>
|
||
<param name="innerException"></param>
|
||
<param name="statusCode"></param>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.Internal.MarshallTransformations.DecodeAuthorizationMessageResponseUnmarshaller.Instance">
|
||
<summary>
|
||
Gets the singleton.
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.Internal.MarshallTransformations.ExpiredTokenExceptionUnmarshaller">
|
||
<summary>
|
||
Response Unmarshaller for ExpiredTokenException operation
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Internal.MarshallTransformations.ExpiredTokenExceptionUnmarshaller.Unmarshall(Amazon.Runtime.Internal.Transform.XmlUnmarshallerContext)">
|
||
<summary>
|
||
Unmarshaller the response from the service to the response class.
|
||
</summary>
|
||
<param name="context"></param>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Internal.MarshallTransformations.ExpiredTokenExceptionUnmarshaller.Unmarshall(Amazon.Runtime.Internal.Transform.XmlUnmarshallerContext,Amazon.Runtime.Internal.ErrorResponse)">
|
||
<summary>
|
||
Unmarshaller error response to exception.
|
||
</summary>
|
||
<param name="context"></param>
|
||
<param name="errorResponse"></param>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.Internal.MarshallTransformations.ExpiredTokenExceptionUnmarshaller.Instance">
|
||
<summary>
|
||
Gets the singleton.
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.Internal.MarshallTransformations.FederatedUserUnmarshaller">
|
||
<summary>
|
||
Response Unmarshaller for FederatedUser Object
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Internal.MarshallTransformations.FederatedUserUnmarshaller.Unmarshall(Amazon.Runtime.Internal.Transform.XmlUnmarshallerContext)">
|
||
<summary>
|
||
Unmarshaller the response from the service to the response class.
|
||
</summary>
|
||
<param name="context"></param>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Internal.MarshallTransformations.FederatedUserUnmarshaller.Unmarshall(Amazon.Runtime.Internal.Transform.JsonUnmarshallerContext)">
|
||
<summary>
|
||
Unmarshaller error response to exception.
|
||
</summary>
|
||
<param name="context"></param>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.Internal.MarshallTransformations.FederatedUserUnmarshaller.Instance">
|
||
<summary>
|
||
Gets the singleton.
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.Internal.MarshallTransformations.GetAccessKeyInfoRequestMarshaller">
|
||
<summary>
|
||
GetAccessKeyInfo Request Marshaller
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Internal.MarshallTransformations.GetAccessKeyInfoRequestMarshaller.Marshall(Amazon.Runtime.AmazonWebServiceRequest)">
|
||
<summary>
|
||
Marshaller the request object to the HTTP request.
|
||
</summary>
|
||
<param name="input"></param>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Internal.MarshallTransformations.GetAccessKeyInfoRequestMarshaller.Marshall(Amazon.SecurityToken.Model.GetAccessKeyInfoRequest)">
|
||
<summary>
|
||
Marshaller the request object to the HTTP request.
|
||
</summary>
|
||
<param name="publicRequest"></param>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.Internal.MarshallTransformations.GetAccessKeyInfoRequestMarshaller.Instance">
|
||
<summary>
|
||
Gets the singleton.
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.Internal.MarshallTransformations.GetAccessKeyInfoResponseUnmarshaller">
|
||
<summary>
|
||
Response Unmarshaller for GetAccessKeyInfo operation
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Internal.MarshallTransformations.GetAccessKeyInfoResponseUnmarshaller.Unmarshall(Amazon.Runtime.Internal.Transform.XmlUnmarshallerContext)">
|
||
<summary>
|
||
Unmarshaller the response from the service to the response class.
|
||
</summary>
|
||
<param name="context"></param>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Internal.MarshallTransformations.GetAccessKeyInfoResponseUnmarshaller.UnmarshallException(Amazon.Runtime.Internal.Transform.XmlUnmarshallerContext,System.Exception,System.Net.HttpStatusCode)">
|
||
<summary>
|
||
Unmarshaller error response to exception.
|
||
</summary>
|
||
<param name="context"></param>
|
||
<param name="innerException"></param>
|
||
<param name="statusCode"></param>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.Internal.MarshallTransformations.GetAccessKeyInfoResponseUnmarshaller.Instance">
|
||
<summary>
|
||
Gets the singleton.
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.Internal.MarshallTransformations.GetCallerIdentityRequestMarshaller">
|
||
<summary>
|
||
GetCallerIdentity Request Marshaller
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Internal.MarshallTransformations.GetCallerIdentityRequestMarshaller.Marshall(Amazon.Runtime.AmazonWebServiceRequest)">
|
||
<summary>
|
||
Marshaller the request object to the HTTP request.
|
||
</summary>
|
||
<param name="input"></param>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Internal.MarshallTransformations.GetCallerIdentityRequestMarshaller.Marshall(Amazon.SecurityToken.Model.GetCallerIdentityRequest)">
|
||
<summary>
|
||
Marshaller the request object to the HTTP request.
|
||
</summary>
|
||
<param name="publicRequest"></param>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.Internal.MarshallTransformations.GetCallerIdentityRequestMarshaller.Instance">
|
||
<summary>
|
||
Gets the singleton.
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.Internal.MarshallTransformations.GetCallerIdentityResponseUnmarshaller">
|
||
<summary>
|
||
Response Unmarshaller for GetCallerIdentity operation
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Internal.MarshallTransformations.GetCallerIdentityResponseUnmarshaller.Unmarshall(Amazon.Runtime.Internal.Transform.XmlUnmarshallerContext)">
|
||
<summary>
|
||
Unmarshaller the response from the service to the response class.
|
||
</summary>
|
||
<param name="context"></param>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Internal.MarshallTransformations.GetCallerIdentityResponseUnmarshaller.UnmarshallException(Amazon.Runtime.Internal.Transform.XmlUnmarshallerContext,System.Exception,System.Net.HttpStatusCode)">
|
||
<summary>
|
||
Unmarshaller error response to exception.
|
||
</summary>
|
||
<param name="context"></param>
|
||
<param name="innerException"></param>
|
||
<param name="statusCode"></param>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.Internal.MarshallTransformations.GetCallerIdentityResponseUnmarshaller.Instance">
|
||
<summary>
|
||
Gets the singleton.
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.Internal.MarshallTransformations.GetFederationTokenRequestMarshaller">
|
||
<summary>
|
||
GetFederationToken Request Marshaller
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Internal.MarshallTransformations.GetFederationTokenRequestMarshaller.Marshall(Amazon.Runtime.AmazonWebServiceRequest)">
|
||
<summary>
|
||
Marshaller the request object to the HTTP request.
|
||
</summary>
|
||
<param name="input"></param>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Internal.MarshallTransformations.GetFederationTokenRequestMarshaller.Marshall(Amazon.SecurityToken.Model.GetFederationTokenRequest)">
|
||
<summary>
|
||
Marshaller the request object to the HTTP request.
|
||
</summary>
|
||
<param name="publicRequest"></param>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.Internal.MarshallTransformations.GetFederationTokenRequestMarshaller.Instance">
|
||
<summary>
|
||
Gets the singleton.
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.Internal.MarshallTransformations.GetFederationTokenResponseUnmarshaller">
|
||
<summary>
|
||
Response Unmarshaller for GetFederationToken operation
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Internal.MarshallTransformations.GetFederationTokenResponseUnmarshaller.Unmarshall(Amazon.Runtime.Internal.Transform.XmlUnmarshallerContext)">
|
||
<summary>
|
||
Unmarshaller the response from the service to the response class.
|
||
</summary>
|
||
<param name="context"></param>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Internal.MarshallTransformations.GetFederationTokenResponseUnmarshaller.UnmarshallException(Amazon.Runtime.Internal.Transform.XmlUnmarshallerContext,System.Exception,System.Net.HttpStatusCode)">
|
||
<summary>
|
||
Unmarshaller error response to exception.
|
||
</summary>
|
||
<param name="context"></param>
|
||
<param name="innerException"></param>
|
||
<param name="statusCode"></param>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.Internal.MarshallTransformations.GetFederationTokenResponseUnmarshaller.Instance">
|
||
<summary>
|
||
Gets the singleton.
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.Internal.MarshallTransformations.GetSessionTokenRequestMarshaller">
|
||
<summary>
|
||
GetSessionToken Request Marshaller
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Internal.MarshallTransformations.GetSessionTokenRequestMarshaller.Marshall(Amazon.Runtime.AmazonWebServiceRequest)">
|
||
<summary>
|
||
Marshaller the request object to the HTTP request.
|
||
</summary>
|
||
<param name="input"></param>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Internal.MarshallTransformations.GetSessionTokenRequestMarshaller.Marshall(Amazon.SecurityToken.Model.GetSessionTokenRequest)">
|
||
<summary>
|
||
Marshaller the request object to the HTTP request.
|
||
</summary>
|
||
<param name="publicRequest"></param>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.Internal.MarshallTransformations.GetSessionTokenRequestMarshaller.Instance">
|
||
<summary>
|
||
Gets the singleton.
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.Internal.MarshallTransformations.GetSessionTokenResponseUnmarshaller">
|
||
<summary>
|
||
Response Unmarshaller for GetSessionToken operation
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Internal.MarshallTransformations.GetSessionTokenResponseUnmarshaller.Unmarshall(Amazon.Runtime.Internal.Transform.XmlUnmarshallerContext)">
|
||
<summary>
|
||
Unmarshaller the response from the service to the response class.
|
||
</summary>
|
||
<param name="context"></param>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Internal.MarshallTransformations.GetSessionTokenResponseUnmarshaller.UnmarshallException(Amazon.Runtime.Internal.Transform.XmlUnmarshallerContext,System.Exception,System.Net.HttpStatusCode)">
|
||
<summary>
|
||
Unmarshaller error response to exception.
|
||
</summary>
|
||
<param name="context"></param>
|
||
<param name="innerException"></param>
|
||
<param name="statusCode"></param>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.Internal.MarshallTransformations.GetSessionTokenResponseUnmarshaller.Instance">
|
||
<summary>
|
||
Gets the singleton.
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.Internal.MarshallTransformations.IDPCommunicationErrorExceptionUnmarshaller">
|
||
<summary>
|
||
Response Unmarshaller for IDPCommunicationErrorException operation
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Internal.MarshallTransformations.IDPCommunicationErrorExceptionUnmarshaller.Unmarshall(Amazon.Runtime.Internal.Transform.XmlUnmarshallerContext)">
|
||
<summary>
|
||
Unmarshaller the response from the service to the response class.
|
||
</summary>
|
||
<param name="context"></param>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Internal.MarshallTransformations.IDPCommunicationErrorExceptionUnmarshaller.Unmarshall(Amazon.Runtime.Internal.Transform.XmlUnmarshallerContext,Amazon.Runtime.Internal.ErrorResponse)">
|
||
<summary>
|
||
Unmarshaller error response to exception.
|
||
</summary>
|
||
<param name="context"></param>
|
||
<param name="errorResponse"></param>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.Internal.MarshallTransformations.IDPCommunicationErrorExceptionUnmarshaller.Instance">
|
||
<summary>
|
||
Gets the singleton.
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.Internal.MarshallTransformations.IDPRejectedClaimExceptionUnmarshaller">
|
||
<summary>
|
||
Response Unmarshaller for IDPRejectedClaimException operation
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Internal.MarshallTransformations.IDPRejectedClaimExceptionUnmarshaller.Unmarshall(Amazon.Runtime.Internal.Transform.XmlUnmarshallerContext)">
|
||
<summary>
|
||
Unmarshaller the response from the service to the response class.
|
||
</summary>
|
||
<param name="context"></param>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Internal.MarshallTransformations.IDPRejectedClaimExceptionUnmarshaller.Unmarshall(Amazon.Runtime.Internal.Transform.XmlUnmarshallerContext,Amazon.Runtime.Internal.ErrorResponse)">
|
||
<summary>
|
||
Unmarshaller error response to exception.
|
||
</summary>
|
||
<param name="context"></param>
|
||
<param name="errorResponse"></param>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.Internal.MarshallTransformations.IDPRejectedClaimExceptionUnmarshaller.Instance">
|
||
<summary>
|
||
Gets the singleton.
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.Internal.MarshallTransformations.InvalidAuthorizationMessageExceptionUnmarshaller">
|
||
<summary>
|
||
Response Unmarshaller for InvalidAuthorizationMessageException operation
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Internal.MarshallTransformations.InvalidAuthorizationMessageExceptionUnmarshaller.Unmarshall(Amazon.Runtime.Internal.Transform.XmlUnmarshallerContext)">
|
||
<summary>
|
||
Unmarshaller the response from the service to the response class.
|
||
</summary>
|
||
<param name="context"></param>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Internal.MarshallTransformations.InvalidAuthorizationMessageExceptionUnmarshaller.Unmarshall(Amazon.Runtime.Internal.Transform.XmlUnmarshallerContext,Amazon.Runtime.Internal.ErrorResponse)">
|
||
<summary>
|
||
Unmarshaller error response to exception.
|
||
</summary>
|
||
<param name="context"></param>
|
||
<param name="errorResponse"></param>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.Internal.MarshallTransformations.InvalidAuthorizationMessageExceptionUnmarshaller.Instance">
|
||
<summary>
|
||
Gets the singleton.
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.Internal.MarshallTransformations.InvalidIdentityTokenExceptionUnmarshaller">
|
||
<summary>
|
||
Response Unmarshaller for InvalidIdentityTokenException operation
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Internal.MarshallTransformations.InvalidIdentityTokenExceptionUnmarshaller.Unmarshall(Amazon.Runtime.Internal.Transform.XmlUnmarshallerContext)">
|
||
<summary>
|
||
Unmarshaller the response from the service to the response class.
|
||
</summary>
|
||
<param name="context"></param>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Internal.MarshallTransformations.InvalidIdentityTokenExceptionUnmarshaller.Unmarshall(Amazon.Runtime.Internal.Transform.XmlUnmarshallerContext,Amazon.Runtime.Internal.ErrorResponse)">
|
||
<summary>
|
||
Unmarshaller error response to exception.
|
||
</summary>
|
||
<param name="context"></param>
|
||
<param name="errorResponse"></param>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.Internal.MarshallTransformations.InvalidIdentityTokenExceptionUnmarshaller.Instance">
|
||
<summary>
|
||
Gets the singleton.
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.Internal.MarshallTransformations.MalformedPolicyDocumentExceptionUnmarshaller">
|
||
<summary>
|
||
Response Unmarshaller for MalformedPolicyDocumentException operation
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Internal.MarshallTransformations.MalformedPolicyDocumentExceptionUnmarshaller.Unmarshall(Amazon.Runtime.Internal.Transform.XmlUnmarshallerContext)">
|
||
<summary>
|
||
Unmarshaller the response from the service to the response class.
|
||
</summary>
|
||
<param name="context"></param>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Internal.MarshallTransformations.MalformedPolicyDocumentExceptionUnmarshaller.Unmarshall(Amazon.Runtime.Internal.Transform.XmlUnmarshallerContext,Amazon.Runtime.Internal.ErrorResponse)">
|
||
<summary>
|
||
Unmarshaller error response to exception.
|
||
</summary>
|
||
<param name="context"></param>
|
||
<param name="errorResponse"></param>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.Internal.MarshallTransformations.MalformedPolicyDocumentExceptionUnmarshaller.Instance">
|
||
<summary>
|
||
Gets the singleton.
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.Internal.MarshallTransformations.PackedPolicyTooLargeExceptionUnmarshaller">
|
||
<summary>
|
||
Response Unmarshaller for PackedPolicyTooLargeException operation
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Internal.MarshallTransformations.PackedPolicyTooLargeExceptionUnmarshaller.Unmarshall(Amazon.Runtime.Internal.Transform.XmlUnmarshallerContext)">
|
||
<summary>
|
||
Unmarshaller the response from the service to the response class.
|
||
</summary>
|
||
<param name="context"></param>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Internal.MarshallTransformations.PackedPolicyTooLargeExceptionUnmarshaller.Unmarshall(Amazon.Runtime.Internal.Transform.XmlUnmarshallerContext,Amazon.Runtime.Internal.ErrorResponse)">
|
||
<summary>
|
||
Unmarshaller error response to exception.
|
||
</summary>
|
||
<param name="context"></param>
|
||
<param name="errorResponse"></param>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.Internal.MarshallTransformations.PackedPolicyTooLargeExceptionUnmarshaller.Instance">
|
||
<summary>
|
||
Gets the singleton.
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.Internal.MarshallTransformations.RegionDisabledExceptionUnmarshaller">
|
||
<summary>
|
||
Response Unmarshaller for RegionDisabledException operation
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Internal.MarshallTransformations.RegionDisabledExceptionUnmarshaller.Unmarshall(Amazon.Runtime.Internal.Transform.XmlUnmarshallerContext)">
|
||
<summary>
|
||
Unmarshaller the response from the service to the response class.
|
||
</summary>
|
||
<param name="context"></param>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.Internal.MarshallTransformations.RegionDisabledExceptionUnmarshaller.Unmarshall(Amazon.Runtime.Internal.Transform.XmlUnmarshallerContext,Amazon.Runtime.Internal.ErrorResponse)">
|
||
<summary>
|
||
Unmarshaller error response to exception.
|
||
</summary>
|
||
<param name="context"></param>
|
||
<param name="errorResponse"></param>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.Internal.MarshallTransformations.RegionDisabledExceptionUnmarshaller.Instance">
|
||
<summary>
|
||
Gets the singleton.
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.InvalidAuthorizationMessageException">
|
||
<summary>
|
||
The error returned if the message passed to <code>DecodeAuthorizationMessage</code>
|
||
was invalid. This can happen if the token contains invalid characters, such as linebreaks.
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.InvalidAuthorizationMessageException.#ctor(System.String)">
|
||
<summary>
|
||
Constructs a new InvalidAuthorizationMessageException with the specified error
|
||
message.
|
||
</summary>
|
||
<param name="message">
|
||
Describes the error encountered.
|
||
</param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.InvalidAuthorizationMessageException.#ctor(System.String,System.Exception)">
|
||
<summary>
|
||
Construct instance of InvalidAuthorizationMessageException
|
||
</summary>
|
||
<param name="message"></param>
|
||
<param name="innerException"></param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.InvalidAuthorizationMessageException.#ctor(System.Exception)">
|
||
<summary>
|
||
Construct instance of InvalidAuthorizationMessageException
|
||
</summary>
|
||
<param name="innerException"></param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.InvalidAuthorizationMessageException.#ctor(System.String,System.Exception,Amazon.Runtime.ErrorType,System.String,System.String,System.Net.HttpStatusCode)">
|
||
<summary>
|
||
Construct instance of InvalidAuthorizationMessageException
|
||
</summary>
|
||
<param name="message"></param>
|
||
<param name="innerException"></param>
|
||
<param name="errorType"></param>
|
||
<param name="errorCode"></param>
|
||
<param name="requestId"></param>
|
||
<param name="statusCode"></param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.InvalidAuthorizationMessageException.#ctor(System.String,Amazon.Runtime.ErrorType,System.String,System.String,System.Net.HttpStatusCode)">
|
||
<summary>
|
||
Construct instance of InvalidAuthorizationMessageException
|
||
</summary>
|
||
<param name="message"></param>
|
||
<param name="errorType"></param>
|
||
<param name="errorCode"></param>
|
||
<param name="requestId"></param>
|
||
<param name="statusCode"></param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.InvalidAuthorizationMessageException.#ctor(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext)">
|
||
<summary>
|
||
Constructs a new instance of the InvalidAuthorizationMessageException class with serialized data.
|
||
</summary>
|
||
<param name="info">The <see cref="T:System.Runtime.Serialization.SerializationInfo" /> that holds the serialized object data about the exception being thrown.</param>
|
||
<param name="context">The <see cref="T:System.Runtime.Serialization.StreamingContext" /> that contains contextual information about the source or destination.</param>
|
||
<exception cref="T:System.ArgumentNullException">The <paramref name="info" /> parameter is null. </exception>
|
||
<exception cref="T:System.Runtime.Serialization.SerializationException">The class name is null or <see cref="P:System.Exception.HResult" /> is zero (0). </exception>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.InvalidAuthorizationMessageException.GetObjectData(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext)">
|
||
<summary>
|
||
Sets the <see cref="T:System.Runtime.Serialization.SerializationInfo" /> with information about the exception.
|
||
</summary>
|
||
<param name="info">The <see cref="T:System.Runtime.Serialization.SerializationInfo" /> that holds the serialized object data about the exception being thrown.</param>
|
||
<param name="context">The <see cref="T:System.Runtime.Serialization.StreamingContext" /> that contains contextual information about the source or destination.</param>
|
||
<exception cref="T:System.ArgumentNullException">The <paramref name="info" /> parameter is a null reference (Nothing in Visual Basic). </exception>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.InvalidIdentityTokenException">
|
||
<summary>
|
||
The web identity token that was passed could not be validated by Amazon Web Services.
|
||
Get a new identity token from the identity provider and then retry the request.
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.InvalidIdentityTokenException.#ctor(System.String)">
|
||
<summary>
|
||
Constructs a new InvalidIdentityTokenException with the specified error
|
||
message.
|
||
</summary>
|
||
<param name="message">
|
||
Describes the error encountered.
|
||
</param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.InvalidIdentityTokenException.#ctor(System.String,System.Exception)">
|
||
<summary>
|
||
Construct instance of InvalidIdentityTokenException
|
||
</summary>
|
||
<param name="message"></param>
|
||
<param name="innerException"></param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.InvalidIdentityTokenException.#ctor(System.Exception)">
|
||
<summary>
|
||
Construct instance of InvalidIdentityTokenException
|
||
</summary>
|
||
<param name="innerException"></param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.InvalidIdentityTokenException.#ctor(System.String,System.Exception,Amazon.Runtime.ErrorType,System.String,System.String,System.Net.HttpStatusCode)">
|
||
<summary>
|
||
Construct instance of InvalidIdentityTokenException
|
||
</summary>
|
||
<param name="message"></param>
|
||
<param name="innerException"></param>
|
||
<param name="errorType"></param>
|
||
<param name="errorCode"></param>
|
||
<param name="requestId"></param>
|
||
<param name="statusCode"></param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.InvalidIdentityTokenException.#ctor(System.String,Amazon.Runtime.ErrorType,System.String,System.String,System.Net.HttpStatusCode)">
|
||
<summary>
|
||
Construct instance of InvalidIdentityTokenException
|
||
</summary>
|
||
<param name="message"></param>
|
||
<param name="errorType"></param>
|
||
<param name="errorCode"></param>
|
||
<param name="requestId"></param>
|
||
<param name="statusCode"></param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.InvalidIdentityTokenException.#ctor(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext)">
|
||
<summary>
|
||
Constructs a new instance of the InvalidIdentityTokenException class with serialized data.
|
||
</summary>
|
||
<param name="info">The <see cref="T:System.Runtime.Serialization.SerializationInfo" /> that holds the serialized object data about the exception being thrown.</param>
|
||
<param name="context">The <see cref="T:System.Runtime.Serialization.StreamingContext" /> that contains contextual information about the source or destination.</param>
|
||
<exception cref="T:System.ArgumentNullException">The <paramref name="info" /> parameter is null. </exception>
|
||
<exception cref="T:System.Runtime.Serialization.SerializationException">The class name is null or <see cref="P:System.Exception.HResult" /> is zero (0). </exception>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.InvalidIdentityTokenException.GetObjectData(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext)">
|
||
<summary>
|
||
Sets the <see cref="T:System.Runtime.Serialization.SerializationInfo" /> with information about the exception.
|
||
</summary>
|
||
<param name="info">The <see cref="T:System.Runtime.Serialization.SerializationInfo" /> that holds the serialized object data about the exception being thrown.</param>
|
||
<param name="context">The <see cref="T:System.Runtime.Serialization.StreamingContext" /> that contains contextual information about the source or destination.</param>
|
||
<exception cref="T:System.ArgumentNullException">The <paramref name="info" /> parameter is a null reference (Nothing in Visual Basic). </exception>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.MalformedPolicyDocumentException">
|
||
<summary>
|
||
The request was rejected because the policy document was malformed. The error message
|
||
describes the specific error.
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.MalformedPolicyDocumentException.#ctor(System.String)">
|
||
<summary>
|
||
Constructs a new MalformedPolicyDocumentException with the specified error
|
||
message.
|
||
</summary>
|
||
<param name="message">
|
||
Describes the error encountered.
|
||
</param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.MalformedPolicyDocumentException.#ctor(System.String,System.Exception)">
|
||
<summary>
|
||
Construct instance of MalformedPolicyDocumentException
|
||
</summary>
|
||
<param name="message"></param>
|
||
<param name="innerException"></param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.MalformedPolicyDocumentException.#ctor(System.Exception)">
|
||
<summary>
|
||
Construct instance of MalformedPolicyDocumentException
|
||
</summary>
|
||
<param name="innerException"></param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.MalformedPolicyDocumentException.#ctor(System.String,System.Exception,Amazon.Runtime.ErrorType,System.String,System.String,System.Net.HttpStatusCode)">
|
||
<summary>
|
||
Construct instance of MalformedPolicyDocumentException
|
||
</summary>
|
||
<param name="message"></param>
|
||
<param name="innerException"></param>
|
||
<param name="errorType"></param>
|
||
<param name="errorCode"></param>
|
||
<param name="requestId"></param>
|
||
<param name="statusCode"></param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.MalformedPolicyDocumentException.#ctor(System.String,Amazon.Runtime.ErrorType,System.String,System.String,System.Net.HttpStatusCode)">
|
||
<summary>
|
||
Construct instance of MalformedPolicyDocumentException
|
||
</summary>
|
||
<param name="message"></param>
|
||
<param name="errorType"></param>
|
||
<param name="errorCode"></param>
|
||
<param name="requestId"></param>
|
||
<param name="statusCode"></param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.MalformedPolicyDocumentException.#ctor(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext)">
|
||
<summary>
|
||
Constructs a new instance of the MalformedPolicyDocumentException class with serialized data.
|
||
</summary>
|
||
<param name="info">The <see cref="T:System.Runtime.Serialization.SerializationInfo" /> that holds the serialized object data about the exception being thrown.</param>
|
||
<param name="context">The <see cref="T:System.Runtime.Serialization.StreamingContext" /> that contains contextual information about the source or destination.</param>
|
||
<exception cref="T:System.ArgumentNullException">The <paramref name="info" /> parameter is null. </exception>
|
||
<exception cref="T:System.Runtime.Serialization.SerializationException">The class name is null or <see cref="P:System.Exception.HResult" /> is zero (0). </exception>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.MalformedPolicyDocumentException.GetObjectData(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext)">
|
||
<summary>
|
||
Sets the <see cref="T:System.Runtime.Serialization.SerializationInfo" /> with information about the exception.
|
||
</summary>
|
||
<param name="info">The <see cref="T:System.Runtime.Serialization.SerializationInfo" /> that holds the serialized object data about the exception being thrown.</param>
|
||
<param name="context">The <see cref="T:System.Runtime.Serialization.StreamingContext" /> that contains contextual information about the source or destination.</param>
|
||
<exception cref="T:System.ArgumentNullException">The <paramref name="info" /> parameter is a null reference (Nothing in Visual Basic). </exception>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.PackedPolicyTooLargeException">
|
||
<summary>
|
||
The request was rejected because the total packed size of the session policies and
|
||
session tags combined was too large. An Amazon Web Services conversion compresses
|
||
the session policy document, session policy ARNs, and session tags into a packed binary
|
||
format that has a separate limit. The error message indicates by percentage how close
|
||
the policies and tags are to the upper size limit. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html">Passing
|
||
Session Tags in STS</a> in the <i>IAM User Guide</i>.
|
||
|
||
|
||
<para>
|
||
You could receive this error even though you meet other defined session policy and
|
||
session tag limits. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html#reference_iam-limits-entity-length">IAM
|
||
and STS Entity Character Limits</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.PackedPolicyTooLargeException.#ctor(System.String)">
|
||
<summary>
|
||
Constructs a new PackedPolicyTooLargeException with the specified error
|
||
message.
|
||
</summary>
|
||
<param name="message">
|
||
Describes the error encountered.
|
||
</param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.PackedPolicyTooLargeException.#ctor(System.String,System.Exception)">
|
||
<summary>
|
||
Construct instance of PackedPolicyTooLargeException
|
||
</summary>
|
||
<param name="message"></param>
|
||
<param name="innerException"></param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.PackedPolicyTooLargeException.#ctor(System.Exception)">
|
||
<summary>
|
||
Construct instance of PackedPolicyTooLargeException
|
||
</summary>
|
||
<param name="innerException"></param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.PackedPolicyTooLargeException.#ctor(System.String,System.Exception,Amazon.Runtime.ErrorType,System.String,System.String,System.Net.HttpStatusCode)">
|
||
<summary>
|
||
Construct instance of PackedPolicyTooLargeException
|
||
</summary>
|
||
<param name="message"></param>
|
||
<param name="innerException"></param>
|
||
<param name="errorType"></param>
|
||
<param name="errorCode"></param>
|
||
<param name="requestId"></param>
|
||
<param name="statusCode"></param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.PackedPolicyTooLargeException.#ctor(System.String,Amazon.Runtime.ErrorType,System.String,System.String,System.Net.HttpStatusCode)">
|
||
<summary>
|
||
Construct instance of PackedPolicyTooLargeException
|
||
</summary>
|
||
<param name="message"></param>
|
||
<param name="errorType"></param>
|
||
<param name="errorCode"></param>
|
||
<param name="requestId"></param>
|
||
<param name="statusCode"></param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.PackedPolicyTooLargeException.#ctor(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext)">
|
||
<summary>
|
||
Constructs a new instance of the PackedPolicyTooLargeException class with serialized data.
|
||
</summary>
|
||
<param name="info">The <see cref="T:System.Runtime.Serialization.SerializationInfo" /> that holds the serialized object data about the exception being thrown.</param>
|
||
<param name="context">The <see cref="T:System.Runtime.Serialization.StreamingContext" /> that contains contextual information about the source or destination.</param>
|
||
<exception cref="T:System.ArgumentNullException">The <paramref name="info" /> parameter is null. </exception>
|
||
<exception cref="T:System.Runtime.Serialization.SerializationException">The class name is null or <see cref="P:System.Exception.HResult" /> is zero (0). </exception>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.PackedPolicyTooLargeException.GetObjectData(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext)">
|
||
<summary>
|
||
Sets the <see cref="T:System.Runtime.Serialization.SerializationInfo" /> with information about the exception.
|
||
</summary>
|
||
<param name="info">The <see cref="T:System.Runtime.Serialization.SerializationInfo" /> that holds the serialized object data about the exception being thrown.</param>
|
||
<param name="context">The <see cref="T:System.Runtime.Serialization.StreamingContext" /> that contains contextual information about the source or destination.</param>
|
||
<exception cref="T:System.ArgumentNullException">The <paramref name="info" /> parameter is a null reference (Nothing in Visual Basic). </exception>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.PolicyDescriptorType">
|
||
<summary>
|
||
A reference to the IAM managed policy that is passed as a session policy for a role
|
||
session or a federated user session.
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.PolicyDescriptorType.Arn">
|
||
<summary>
|
||
Gets and sets the property Arn.
|
||
<para>
|
||
The Amazon Resource Name (ARN) of the IAM managed policy to use as a session policy
|
||
for the role. For more information about ARNs, see <a href="https://docs.aws.amazon.com/general/latest/gr/aws-arns-and-namespaces.html">Amazon
|
||
Resource Names (ARNs) and Amazon Web Services Service Namespaces</a> in the <i>Amazon
|
||
Web Services General Reference</i>.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.RegionDisabledException">
|
||
<summary>
|
||
STS is not activated in the requested region for the account that is being asked to
|
||
generate credentials. The account administrator must use the IAM console to activate
|
||
STS in that region. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_enable-regions.html">Activating
|
||
and Deactivating Amazon Web Services STS in an Amazon Web Services Region</a> in the
|
||
<i>IAM User Guide</i>.
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.RegionDisabledException.#ctor(System.String)">
|
||
<summary>
|
||
Constructs a new RegionDisabledException with the specified error
|
||
message.
|
||
</summary>
|
||
<param name="message">
|
||
Describes the error encountered.
|
||
</param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.RegionDisabledException.#ctor(System.String,System.Exception)">
|
||
<summary>
|
||
Construct instance of RegionDisabledException
|
||
</summary>
|
||
<param name="message"></param>
|
||
<param name="innerException"></param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.RegionDisabledException.#ctor(System.Exception)">
|
||
<summary>
|
||
Construct instance of RegionDisabledException
|
||
</summary>
|
||
<param name="innerException"></param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.RegionDisabledException.#ctor(System.String,System.Exception,Amazon.Runtime.ErrorType,System.String,System.String,System.Net.HttpStatusCode)">
|
||
<summary>
|
||
Construct instance of RegionDisabledException
|
||
</summary>
|
||
<param name="message"></param>
|
||
<param name="innerException"></param>
|
||
<param name="errorType"></param>
|
||
<param name="errorCode"></param>
|
||
<param name="requestId"></param>
|
||
<param name="statusCode"></param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.RegionDisabledException.#ctor(System.String,Amazon.Runtime.ErrorType,System.String,System.String,System.Net.HttpStatusCode)">
|
||
<summary>
|
||
Construct instance of RegionDisabledException
|
||
</summary>
|
||
<param name="message"></param>
|
||
<param name="errorType"></param>
|
||
<param name="errorCode"></param>
|
||
<param name="requestId"></param>
|
||
<param name="statusCode"></param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.RegionDisabledException.#ctor(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext)">
|
||
<summary>
|
||
Constructs a new instance of the RegionDisabledException class with serialized data.
|
||
</summary>
|
||
<param name="info">The <see cref="T:System.Runtime.Serialization.SerializationInfo" /> that holds the serialized object data about the exception being thrown.</param>
|
||
<param name="context">The <see cref="T:System.Runtime.Serialization.StreamingContext" /> that contains contextual information about the source or destination.</param>
|
||
<exception cref="T:System.ArgumentNullException">The <paramref name="info" /> parameter is null. </exception>
|
||
<exception cref="T:System.Runtime.Serialization.SerializationException">The class name is null or <see cref="P:System.Exception.HResult" /> is zero (0). </exception>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Model.RegionDisabledException.GetObjectData(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext)">
|
||
<summary>
|
||
Sets the <see cref="T:System.Runtime.Serialization.SerializationInfo" /> with information about the exception.
|
||
</summary>
|
||
<param name="info">The <see cref="T:System.Runtime.Serialization.SerializationInfo" /> that holds the serialized object data about the exception being thrown.</param>
|
||
<param name="context">The <see cref="T:System.Runtime.Serialization.StreamingContext" /> that contains contextual information about the source or destination.</param>
|
||
<exception cref="T:System.ArgumentNullException">The <paramref name="info" /> parameter is a null reference (Nothing in Visual Basic). </exception>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Model.Tag">
|
||
<summary>
|
||
You can pass custom key-value pair attributes when you assume a role or federate a
|
||
user. These are called session tags. You can then use the session tags to control
|
||
access to resources. For more information, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/id_session-tags.html">Tagging
|
||
Amazon Web Services STS Sessions</a> in the <i>IAM User Guide</i>.
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.Tag.Key">
|
||
<summary>
|
||
Gets and sets the property Key.
|
||
<para>
|
||
The key for a session tag.
|
||
</para>
|
||
|
||
<para>
|
||
You can pass up to 50 session tags. The plain text session tag keys can’t exceed 128
|
||
characters. For these and additional limits, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-limits.html#reference_iam-limits-entity-length">IAM
|
||
and STS Character Limits</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Model.Tag.Value">
|
||
<summary>
|
||
Gets and sets the property Value.
|
||
<para>
|
||
The value for a session tag.
|
||
</para>
|
||
|
||
<para>
|
||
You can pass up to 50 session tags. The plain text session tag values can’t exceed
|
||
256 characters. For these and additional limits, see <a href="https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-limits.html#reference_iam-limits-entity-length">IAM
|
||
and STS Character Limits</a> in the <i>IAM User Guide</i>.
|
||
</para>
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.SAML.AdfsAuthenticationController">
|
||
<summary>
|
||
Implementation of IAuthenticationController, allowing authentication calls against
|
||
an AD FS endpoint.
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.SAML.AdfsAuthenticationController.Authenticate(System.Uri,System.Net.ICredentials,System.String,System.Net.WebProxy)">
|
||
<summary>
|
||
Authenticates the user with the specified AD FS endpoint and
|
||
yields the SAML response data for subsequent parsing.
|
||
</summary>
|
||
<param name="identityProvider">
|
||
The https endpoint of the federated identity provider.
|
||
</param>
|
||
<param name="credentials">
|
||
Credentials for the call. If null, the user's default network credentials
|
||
will be used in a temporary impersonation context.
|
||
</param>
|
||
<param name="authenticationType">
|
||
The authentication type to be used with the endpoint. Valid values are 'NTLM',
|
||
'Digest', 'Kerberos' and 'Negotiate'.
|
||
</param>
|
||
<param name="proxySettings">Null or configured proxy settings for the HTTPS call.</param>
|
||
<returns>The response data from a successful authentication request.</returns>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.SAML.AdfsAuthenticationControllerException">
|
||
<summary>
|
||
Custom exception thrown when authentication failure is detected against
|
||
a configured AD FS endpoint.
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.SAML.AdfsAuthenticationControllerException.#ctor(System.String)">
|
||
<summary>
|
||
Initializes a new exception instance.
|
||
</summary>
|
||
<param name="message"></param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.SAML.AdfsAuthenticationControllerException.#ctor(System.String,System.Exception)">
|
||
<summary>
|
||
Initializes a new exception instance.
|
||
</summary>
|
||
<param name="message"></param>
|
||
<param name="innerException"></param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.SAML.AdfsAuthenticationControllerException.#ctor(System.Exception)">
|
||
<summary>
|
||
Initializes a new exception instance.
|
||
</summary>
|
||
<param name="innerException"></param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.SAML.AdfsAuthenticationControllerException.#ctor(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext)">
|
||
<summary>
|
||
Constructs a new instance of the AdfsAuthenticationControllerException class with serialized data.
|
||
</summary>
|
||
<param name="info">The <see cref="T:System.Runtime.Serialization.SerializationInfo" /> that holds the serialized object data about the exception being thrown.</param>
|
||
<param name="context">The <see cref="T:System.Runtime.Serialization.StreamingContext" /> that contains contextual information about the source or destination.</param>
|
||
<exception cref="T:System.ArgumentNullException">The <paramref name="info" /> parameter is null. </exception>
|
||
<exception cref="T:System.Runtime.Serialization.SerializationException">The class name is null or <see cref="P:System.Exception.HResult" /> is zero (0). </exception>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.SAML.AdfsAuthenticationResponseParser">
|
||
<summary>
|
||
Implementation of IAuthenticationResponseParser, allowing parsing of the responses for
|
||
successful authentication calls against AD FS endpoints.
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.SAML.AdfsAuthenticationResponseParser.Parse(System.String)">
|
||
<summary>
|
||
Parses the authentication response (html) and extracts the SAML response (xml)
|
||
for further parsing.
|
||
</summary>
|
||
<param name="authenticationResponse">
|
||
The HTML response data from the successful authentication call.
|
||
</param>
|
||
<returns>
|
||
Assertion instance containing the data needed to support credential generation.
|
||
</returns>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.SAML.SAMLAssertion">
|
||
<summary>
|
||
Contains the parsed SAML response data following successful user
|
||
authentication against a federated endpoint. We only parse out the
|
||
data we need to support generation of temporary AWS credentials.
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.SAML.SAMLAssertion.AssertionDocument">
|
||
<summary>
|
||
The full SAML assertion parsed from the identity provider's
|
||
response.
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.SAML.SAMLAssertion.RoleSet">
|
||
<summary>
|
||
The collection of roles available to the authenticated user.
|
||
he parsed friendly role name is used to key the entries.
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.SAML.SAMLAssertion.GetRoleCredentials(Amazon.SecurityToken.IAmazonSecurityTokenService,System.String,System.TimeSpan)">
|
||
<summary>
|
||
Retrieves a set of temporary credentials for the specified role, valid for the specified timespan.
|
||
If the SAML authentication data yield more than one role, a valid role name must be specified.
|
||
</summary>
|
||
<param name="stsClient">The STS client to use when making the AssumeRoleWithSAML request.</param>
|
||
<param name="principalAndRoleArns">
|
||
The arns of the principal and role as returned in the SAML assertion.
|
||
</param>
|
||
<param name="duration">The valid timespan for the credentials.</param>
|
||
<returns>Temporary session credentials for the specified or default role for the user.</returns>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.SAML.SAMLAssertion.#ctor(System.String)">
|
||
<summary>
|
||
Constructs a new SAML assertion wrapper based on a successful authentication
|
||
response and extracts the role data contained in the assertion.
|
||
</summary>
|
||
<param name="assertion"></param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.SAML.SAMLAssertion.ExtractRoleData">
|
||
<summary>
|
||
Parses the role data out of the assertion using xpath queries. We additionally
|
||
parse the role ARNs to extract friendly role names that can be used in UI
|
||
prompts in tooling.
|
||
</summary>
|
||
<returns>Dictionary of friendly role names to role arn mappings.</returns>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.SAML.IAuthenticationController">
|
||
<summary>
|
||
Interface implemented by plugins supplied to the SAMLAuthenticationController
|
||
to perform the call to the authentication endpoint. The implementor returns the
|
||
final response from the authentication process for subsequent parsing.
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.SAML.IAuthenticationController.Authenticate(System.Uri,System.Net.ICredentials,System.String,System.Net.WebProxy)">
|
||
<summary>
|
||
Calls the specified endpoint, optionally providing custom credentials.
|
||
</summary>
|
||
<param name="identityProvider">The endpoint providing </param>
|
||
<param name="credentials">
|
||
Optional, if not supplied the token for the currently logged-in user is supplied to the authentication endpoint.
|
||
</param>
|
||
<param name="authenticationType">
|
||
The authentication type expected by the endpoint. Valid values are 'NTLM',
|
||
'Digest', 'Kerberos' and 'Negotiate'.
|
||
</param>
|
||
<param name="proxySettings">Null or configured proxy settings for the HTTPS call.</param>
|
||
<returns>The raw response data from the authentication request.</returns>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.SAML.IAuthenticationResponseParser">
|
||
<summary>
|
||
Interface implemented by plugins supplied to the SAMLAuthenticationController
|
||
to parse an authentication response returned by an IAuthenticator instance and
|
||
yield a SAMLAssertion instance.
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.SAML.IAuthenticationResponseParser.Parse(System.String)">
|
||
<summary>
|
||
Parses the supplied reponse data to instantiate a SAMLAssertion instance
|
||
containing IAM role and token data that can be used to generate temporary
|
||
AWS credentials.
|
||
</summary>
|
||
<param name="authenticationResponse">
|
||
The response that was returned from user authentication.
|
||
</param>
|
||
<returns>SAMLAssertion instance corresponding to the response data.</returns>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.SAML.SAMLAuthenticationController">
|
||
<summary>
|
||
Helper class to perform SAML authentication negotiation for an identity
|
||
provider and relying party combination. Yields a SAMLAssertion instance
|
||
that can be used to retrieve temporary, auto-refreshing AWS credentials.
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.SAML.SAMLAuthenticationController.AuthenticationController">
|
||
<summary>
|
||
Handler that will be called to perform the authentication process to a
|
||
defined endpoint.
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.SAML.SAMLAuthenticationController.ResponseParser">
|
||
<summary>
|
||
Handler that will be called to parse the response from a succesful
|
||
authentication request.
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.SAML.SAMLAuthenticationController.ProxySettings">
|
||
<summary>
|
||
Proxy details if required for communication with the authentication endpoint.
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.SAML.SAMLAuthenticationController.#ctor">
|
||
<summary>
|
||
Instantiates a controller instance configured to use the built-in AD FS
|
||
classes to authenticate and parse the responses.
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.SAML.SAMLAuthenticationController.#ctor(System.Net.WebProxy)">
|
||
<summary>
|
||
Instantiates a controller instance configured to use the built-in AD FS
|
||
classes to authenticate and parse the responses. The supplied proxy settings will
|
||
be used in the HTTPS calls to the authentication endpoint.
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.SAML.SAMLAuthenticationController.#ctor(Amazon.SecurityToken.SAML.IAuthenticationController,Amazon.SecurityToken.SAML.IAuthenticationResponseParser,System.Net.WebProxy)">
|
||
<summary>
|
||
Instantiates the controller to use the specified instances to perform authentication
|
||
and response parsing.
|
||
</summary>
|
||
<param name="authenticationController">
|
||
Handler that will be called to perform authentication.
|
||
</param>
|
||
<param name="responseParser">
|
||
Handler that will be called to parse successful authentication responses
|
||
</param>
|
||
<param name="proxySettings">
|
||
Null or proxy settings that should be used when communicating with the authentication endpoint.
|
||
</param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.SAML.SAMLAuthenticationController.GetSAMLAssertion(System.String,System.Net.ICredentials,System.String)">
|
||
<summary>
|
||
Authenticates the specified network credentials with a provider endpoint and
|
||
returns the SAML assertion data from which temporary AWS credentials can be obtained.
|
||
</summary>
|
||
<param name="identityProviderUrl">The authentication endpoint to be called.</param>
|
||
<param name="credentials">
|
||
Credentials for the call. If null, the users default network credentials will be used
|
||
in a temporary impersonation context.
|
||
</param>
|
||
<param name="authenticationType">
|
||
The authentication type expected by the endpoint. The default value if not specified
|
||
is 'Kerberos'. Valid values are 'NTLM', 'Digest', 'Kerberos' and 'Negotiate'.
|
||
</param>
|
||
<returns>SAMLAssertion instance wrapping the returned document on successful authentication.</returns>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.SAML.SAMLAuthenticationController.GetSAMLAssertion(System.Uri,System.Net.ICredentials,System.String)">
|
||
<summary>
|
||
Authenticates the specified network credentials with a provider endpoint and
|
||
returns the SAML assertion data from which temporary AWS credentials can be obtained.
|
||
</summary>
|
||
<param name="identityProviderUrl">The authentication endpoint to be called.</param>
|
||
<param name="credentials">
|
||
Credentials for the call. If null, the users default network credentials will be used
|
||
in a temporary impersonation context.
|
||
</param>
|
||
<param name="authenticationType">
|
||
The authentication type expected by the endpoint. The default value if not specified
|
||
is 'Kerberos'. Valid values are 'NTLM', 'Digest', 'Kerberos' and 'Negotiate'.
|
||
</param>
|
||
<returns>SAMLAssertion instance wrapping the returned document on successful authentication.</returns>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.SAML.StoredProfileSAMLCredentials">
|
||
<summary>
|
||
Temporary credentials that are created following successful authentication with
|
||
a federated endpoint supporting SAML.
|
||
</summary>
|
||
<remarks>
|
||
Currently only the SDK store supports profiles that contain the necessary data to support
|
||
authentication and role-based credential generation.
|
||
</remarks>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.SAML.StoredProfileSAMLCredentials.CustomCallbackState">
|
||
<summary>
|
||
Any custom state passed when a credential callback was registered.
|
||
</summary>
|
||
</member>
|
||
<member name="F:Amazon.SecurityToken.SAML.StoredProfileSAMLCredentials.MinimumCredentialTimespan">
|
||
<summary>
|
||
The minimum allowed timespan for generated credentials, per STS documentation.
|
||
</summary>
|
||
</member>
|
||
<member name="F:Amazon.SecurityToken.SAML.StoredProfileSAMLCredentials.MaximumCredentialTimespan">
|
||
<summary>
|
||
The maximum allowed timespan for generated credentials, per STS documentation.
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.SAML.StoredProfileSAMLCredentials.RequestUserCredential">
|
||
<summary>
|
||
Callback signature for obtaining user credentials for authentication demands when
|
||
the role profile is configured to not use the default identity.
|
||
</summary>
|
||
<param name="args">
|
||
Data about the credential demand including any custom state data that was supplied
|
||
when the callback was registered.
|
||
</param>
|
||
<returns>
|
||
The network credential to use in user authentication. Return null to signal the user
|
||
declined to provide credentials and authentication should not proceed.
|
||
</returns>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.SAML.StoredProfileSAMLCredentials.RequestUserCredentialCallback">
|
||
<summary>
|
||
Registered callback for obtaining credentials to use in authentication.
|
||
Required to be set if the role profile is not configured to use the default
|
||
identity.
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.SAML.StoredProfileSAMLCredentials.#ctor">
|
||
<summary>
|
||
Constructs an instance of StoredProfileSAMLCredentials. This constructor searches for details
|
||
of the role to assume, and optional credentials to use with the endpoint, using the
|
||
profile name specified in the App.config.
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.SAML.StoredProfileSAMLCredentials.#ctor(System.String,System.String)">
|
||
<summary>
|
||
<para>
|
||
Constructs an instance of StoredProfileSAMLCredentials. After construction call one of the Authenticate
|
||
methods to authenticate the user/process and obtain temporary AWS credentials.
|
||
</para>
|
||
<para>
|
||
For users who are domain joined (the role profile does not contain user identity information) the temporary
|
||
credentials will be refreshed automatically as needed. Non domain-joined users (those with user identity
|
||
data in the profile) are required to re-authenticate when credential refresh is required. An exception is
|
||
thrown when attempt is made to refresh credentials in this scenario. The consuming code of this class
|
||
should catch the exception and prompt the user for credentials, then call Authenticate to re-initialize
|
||
with a new set of temporary AWS credentials.
|
||
</para>
|
||
</summary>
|
||
<param name="profileName">
|
||
The name of the profile holding the necessary role data to enable authentication and credential generation.
|
||
</param>
|
||
<param name="profilesLocation">Reserved for future use.</param>
|
||
<remarks>The ini-format credentials file is not currently supported.</remarks>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.SAML.StoredProfileSAMLCredentials.ProfileName">
|
||
<summary>
|
||
Name of the profile being used.
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.SAML.StoredProfileSAMLCredentials.ProfilesLocation">
|
||
<summary>
|
||
Location of the profiles, if used.
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.SAML.StoredProfileSAMLCredentials.ProfileData">
|
||
<summary>
|
||
The data about the SAML endpoint and any required user credentials parsed from the
|
||
profile.
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.SAML.StoredProfileSAMLCredentials.Validate">
|
||
<summary>
|
||
If non-default credentials are to be used for authentication,
|
||
validates that the authentication required callback has been
|
||
populated.
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.SAML.StoredProfileSAMLCredentials.GenerateNewCredentials">
|
||
<summary>
|
||
Refresh credentials after expiry. If the role profile is configured to not
|
||
use the default user identity, an exception is thrown if the UserAuthenticationCallback
|
||
property has not been set.
|
||
</summary>
|
||
<returns></returns>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.SAML.CredentialCallbackArgs">
|
||
<summary>
|
||
State class passed on callback to demand user credentials when authentication
|
||
is performed using a non-default identity.
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.SAML.CredentialCallbackArgs.UserIdentity">
|
||
<summary>
|
||
Contains the user identity that the user should supply a password
|
||
for.
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.SAML.CredentialCallbackArgs.CustomState">
|
||
<summary>
|
||
Any custom state that was registered with the callback.
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.SAML.CredentialCallbackArgs.PreviousAuthenticationFailed">
|
||
<summary>
|
||
Set if the callback was due to a failed authentication attempt.
|
||
If false we are beginning to obtain or refresh credentials.
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.SAML.CredentialCallbackRequiredException">
|
||
<summary>
|
||
Exception thrown on validation of a StoredProfileSAMLCredentials instance if the role profile
|
||
is configured to use a non-default user identity and the QueryUserCredentialCallback on the
|
||
instance has not been set.
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.SAML.CredentialCallbackRequiredException.#ctor(System.String)">
|
||
<summary>
|
||
Initializes a new exception instance.
|
||
</summary>
|
||
<param name="msg"></param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.SAML.CredentialCallbackRequiredException.#ctor(System.String,System.Exception)">
|
||
<summary>
|
||
Initializes a new exception instance.
|
||
</summary>
|
||
<param name="msg"></param>
|
||
<param name="innerException"></param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.SAML.CredentialCallbackRequiredException.#ctor(System.Exception)">
|
||
<summary>
|
||
Initializes a new exception instance.
|
||
</summary>
|
||
<param name="innerException"></param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.SAML.CredentialCallbackRequiredException.#ctor(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext)">
|
||
<summary>
|
||
Constructs a new instance of the AdfsAuthenticationControllerException class with serialized data.
|
||
</summary>
|
||
<param name="info">The <see cref="T:System.Runtime.Serialization.SerializationInfo" /> that holds the serialized object data about the exception being thrown.</param>
|
||
<param name="context">The <see cref="T:System.Runtime.Serialization.StreamingContext" /> that contains contextual information about the source or destination.</param>
|
||
<exception cref="T:System.ArgumentNullException">The <paramref name="info" /> parameter is null. </exception>
|
||
<exception cref="T:System.Runtime.Serialization.SerializationException">The class name is null or <see cref="P:System.Exception.HResult" /> is zero (0). </exception>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.SAML.AuthenticationFailedException">
|
||
<summary>
|
||
Custom exception type thrown when authentication for a user against the
|
||
configured endpoint fails and a valid SAML assertion document could not be
|
||
obtained.
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.SAML.AuthenticationFailedException.#ctor(System.String)">
|
||
<summary>
|
||
Initializes a new exception instance.
|
||
</summary>
|
||
<param name="msg"></param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.SAML.AuthenticationFailedException.#ctor(System.String,System.Exception)">
|
||
<summary>
|
||
Initializes a new exception instance.
|
||
</summary>
|
||
<param name="msg"></param>
|
||
<param name="inner"></param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.SAML.AuthenticationFailedException.#ctor(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext)">
|
||
<summary>
|
||
Constructs a new instance of the AuthenticationFailedException class with serialized data.
|
||
</summary>
|
||
<param name="info">The <see cref="T:System.Runtime.Serialization.SerializationInfo" /> that holds the serialized object data about the exception being thrown.</param>
|
||
<param name="context">The <see cref="T:System.Runtime.Serialization.StreamingContext" /> that contains contextual information about the source or destination.</param>
|
||
<exception cref="T:System.ArgumentNullException">The <paramref name="info" /> parameter is null. </exception>
|
||
<exception cref="T:System.Runtime.Serialization.SerializationException">The class name is null or <see cref="P:System.Exception.HResult" /> is zero (0). </exception>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.SecurityTokenServiceRetryPolicy">
|
||
<summary>
|
||
An implementation of the <see cref="T:Amazon.Runtime.Internal.DefaultRetryPolicy"/> that retries certain additional
|
||
STS errors when doing AssumeRoleWithWebIdentity requests.
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.SecurityTokenServiceRetryPolicy.#ctor(Amazon.Runtime.IClientConfig)">
|
||
<summary>
|
||
Constructor for SecurityTokenServiceRetryPolicy.
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.SecurityTokenServiceRetryPolicy.RetryForException(Amazon.Runtime.IExecutionContext,System.Exception)">
|
||
<summary>
|
||
Returns true if the request should be retried.
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.SecurityTokenServiceStandardRetryPolicy">
|
||
<summary>
|
||
An implementation of the <see cref="T:Amazon.Runtime.Internal.StandardRetryPolicy"/> that retries certain additional
|
||
STS errors when doing AssumeRoleWithWebIdentity requests.
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.SecurityTokenServiceStandardRetryPolicy.#ctor(Amazon.Runtime.IClientConfig)">
|
||
<summary>
|
||
Constructor for SecurityTokenServiceStandardRetryPolicy.
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.SecurityTokenServiceStandardRetryPolicy.RetryForException(Amazon.Runtime.IExecutionContext,System.Exception)">
|
||
<summary>
|
||
Returns true if the request should be retried.
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.SecurityTokenServiceAdaptiveRetryPolicy">
|
||
<summary>
|
||
An implementation of the <see cref="T:Amazon.Runtime.Internal.AdaptiveRetryPolicy"/> that retries certain additional
|
||
STS errors when doing AssumeRoleWithWebIdentity requests.
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.SecurityTokenServiceAdaptiveRetryPolicy.#ctor(Amazon.Runtime.IClientConfig)">
|
||
<summary>
|
||
Constructor for SecurityTokenServiceAdaptiveRetryPolicy.
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.SecurityTokenServiceAdaptiveRetryPolicy.RetryForException(Amazon.Runtime.IExecutionContext,System.Exception)">
|
||
<summary>
|
||
Returns true if the request should be retried.
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.AmazonSecurityTokenServiceDefaultConfiguration">
|
||
<summary>
|
||
Configuration for accessing Amazon SecurityTokenService service
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.AmazonSecurityTokenServiceDefaultConfiguration.GetAllConfigurations">
|
||
<summary>
|
||
Collection of all <see cref="T:Amazon.Runtime.DefaultConfiguration"/>s supported by
|
||
SecurityTokenService
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.AmazonSecurityTokenServiceDefaultConfiguration.Standard">
|
||
<summary>
|
||
<p>The STANDARD mode provides the latest recommended default values that should be safe to run in most scenarios</p><p>Note that the default values vended from this mode might change as best practices may evolve. As a result, it is encouraged to perform tests when upgrading the SDK</p>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.AmazonSecurityTokenServiceDefaultConfiguration.InRegion">
|
||
<summary>
|
||
<p>The IN_REGION mode builds on the standard mode and includes optimization tailored for applications which call AWS services from within the same AWS region</p><p>Note that the default values vended from this mode might change as best practices may evolve. As a result, it is encouraged to perform tests when upgrading the SDK</p>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.AmazonSecurityTokenServiceDefaultConfiguration.CrossRegion">
|
||
<summary>
|
||
<p>The CROSS_REGION mode builds on the standard mode and includes optimization tailored for applications which call AWS services in a different region</p><p>Note that the default values vended from this mode might change as best practices may evolve. As a result, it is encouraged to perform tests when upgrading the SDK</p>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.AmazonSecurityTokenServiceDefaultConfiguration.Mobile">
|
||
<summary>
|
||
<p>The MOBILE mode builds on the standard mode and includes optimization tailored for mobile applications</p><p>Note that the default values vended from this mode might change as best practices may evolve. As a result, it is encouraged to perform tests when upgrading the SDK</p>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.AmazonSecurityTokenServiceDefaultConfiguration.Auto">
|
||
<summary>
|
||
<p>The AUTO mode is an experimental mode that builds on the standard mode. The SDK will attempt to discover the execution environment to determine the appropriate settings automatically.</p><p>Note that the auto detection is heuristics-based and does not guarantee 100% accuracy. STANDARD mode will be used if the execution environment cannot be determined. The auto detection might query <a href="https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html">EC2 Instance Metadata service</a>, which might introduce latency. Therefore we recommend choosing an explicit defaults_mode instead if startup latency is critical to your application</p>
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.AmazonSecurityTokenServiceDefaultConfiguration.Legacy">
|
||
<summary>
|
||
<p>The LEGACY mode provides default settings that vary per SDK and were used prior to establishment of defaults_mode</p>
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Endpoints.SecurityTokenServiceEndpointParameters">
|
||
<summary>
|
||
Contains parameters used for resolving SecurityTokenService endpoints
|
||
Parameters can be sourced from client config and service operations
|
||
Used by internal SecurityTokenServiceEndpointProvider and SecurityTokenServiceEndpointResolver
|
||
Can be used by custom EndpointProvider, see ClientConfig.EndpointProvider
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Endpoints.SecurityTokenServiceEndpointParameters.#ctor">
|
||
<summary>
|
||
SecurityTokenServiceEndpointParameters constructor
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Endpoints.SecurityTokenServiceEndpointParameters.Region">
|
||
<summary>
|
||
Region parameter
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Endpoints.SecurityTokenServiceEndpointParameters.UseDualStack">
|
||
<summary>
|
||
UseDualStack parameter
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Endpoints.SecurityTokenServiceEndpointParameters.UseFIPS">
|
||
<summary>
|
||
UseFIPS parameter
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Endpoints.SecurityTokenServiceEndpointParameters.Endpoint">
|
||
<summary>
|
||
Endpoint parameter
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Endpoints.SecurityTokenServiceEndpointParameters.UseGlobalEndpoint">
|
||
<summary>
|
||
UseGlobalEndpoint parameter
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.AmazonSecurityTokenServiceException">
|
||
<summary>
|
||
Common exception for the SecurityTokenService service.
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.AmazonSecurityTokenServiceException.#ctor(System.String)">
|
||
<summary>
|
||
Construct instance of AmazonSecurityTokenServiceException
|
||
</summary>
|
||
<param name="message"></param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.AmazonSecurityTokenServiceException.#ctor(System.String,System.Exception)">
|
||
<summary>
|
||
Construct instance of AmazonSecurityTokenServiceException
|
||
</summary>
|
||
<param name="message"></param>
|
||
<param name="innerException"></param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.AmazonSecurityTokenServiceException.#ctor(System.Exception)">
|
||
<summary>
|
||
Construct instance of AmazonSecurityTokenServiceException
|
||
</summary>
|
||
<param name="innerException"></param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.AmazonSecurityTokenServiceException.#ctor(System.String,Amazon.Runtime.ErrorType,System.String,System.String,System.Net.HttpStatusCode)">
|
||
<summary>
|
||
Construct instance of AmazonSecurityTokenServiceException
|
||
</summary>
|
||
<param name="message"></param>
|
||
<param name="errorType"></param>
|
||
<param name="errorCode"></param>
|
||
<param name="requestId"></param>
|
||
<param name="statusCode"></param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.AmazonSecurityTokenServiceException.#ctor(System.String,System.Exception,Amazon.Runtime.ErrorType,System.String,System.String,System.Net.HttpStatusCode)">
|
||
<summary>
|
||
Construct instance of AmazonSecurityTokenServiceException
|
||
</summary>
|
||
<param name="message"></param>
|
||
<param name="innerException"></param>
|
||
<param name="errorType"></param>
|
||
<param name="errorCode"></param>
|
||
<param name="requestId"></param>
|
||
<param name="statusCode"></param>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.AmazonSecurityTokenServiceException.#ctor(System.Runtime.Serialization.SerializationInfo,System.Runtime.Serialization.StreamingContext)">
|
||
<summary>
|
||
Constructs a new instance of the AmazonSecurityTokenServiceException class with serialized data.
|
||
</summary>
|
||
<param name="info">The <see cref="T:System.Runtime.Serialization.SerializationInfo" /> that holds the serialized object data about the exception being thrown.</param>
|
||
<param name="context">The <see cref="T:System.Runtime.Serialization.StreamingContext" /> that contains contextual information about the source or destination.</param>
|
||
<exception cref="T:System.ArgumentNullException">The <paramref name="info" /> parameter is null. </exception>
|
||
<exception cref="T:System.Runtime.Serialization.SerializationException">The class name is null or <see cref="P:System.Exception.HResult" /> is zero (0). </exception>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Internal.AmazonSecurityTokenServiceEndpointProvider">
|
||
<summary>
|
||
Amazon SecurityTokenService endpoint provider.
|
||
Resolves endpoint for given set of SecurityTokenServiceEndpointParameters.
|
||
Can throw AmazonClientException if endpoint resolution is unsuccessful.
|
||
</summary>
|
||
</member>
|
||
<member name="M:Amazon.SecurityToken.Internal.AmazonSecurityTokenServiceEndpointProvider.ResolveEndpoint(Amazon.Runtime.Endpoints.EndpointParameters)">
|
||
<summary>
|
||
Resolve endpoint for SecurityTokenServiceEndpointParameters
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Internal.AmazonSecurityTokenServiceEndpointResolver">
|
||
<summary>
|
||
Amazon SecurityTokenService endpoint resolver.
|
||
Custom PipelineHandler responsible for resolving endpoint and setting authentication parameters for SecurityTokenService service requests.
|
||
Collects values for SecurityTokenServiceEndpointParameters and then tries to resolve endpoint by calling
|
||
ResolveEndpoint method on GlobalEndpoints.Provider if present, otherwise uses SecurityTokenServiceEndpointProvider.
|
||
Responsible for setting authentication and http headers provided by resolved endpoint.
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.Internal.AmazonSecurityTokenServiceMetadata">
|
||
<summary>
|
||
Service metadata for Amazon SecurityTokenService service
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Internal.AmazonSecurityTokenServiceMetadata.ServiceId">
|
||
<summary>
|
||
Gets the value of the Service Id.
|
||
</summary>
|
||
</member>
|
||
<member name="P:Amazon.SecurityToken.Internal.AmazonSecurityTokenServiceMetadata.OperationNameMapping">
|
||
<summary>
|
||
Gets the dictionary that gives mapping of renamed operations
|
||
</summary>
|
||
</member>
|
||
<member name="T:Amazon.SecurityToken.AmazonSecurityTokenServiceRequest">
|
||
<summary>
|
||
Base class for SecurityTokenService operation requests.
|
||
</summary>
|
||
</member>
|
||
</members>
|
||
</doc>
|