sso

README

IAM Identity Center Portal

Parity grade: B · SDK aws-sdk-go-v2/service/sso@v1.37.0 · last audited 2026-10-12 (94a8059bf)

Coverage

Metric	Value
PARITY entries audited	4 (4 ok)
Known gaps	2
Structural gaps (can't be emulated)	1
Deferred items	0
Resource leaks	clean

Known gaps

• ListAccountRoles/GetRoleCredentials for an unassigned account or role: answers ResourceNotFoundException "No access"; real AWS reports ForbiddenException, which the pinned SDK does not model (bd: gopherstack-cefu7.3)
• max_result bounds: default 10, cap 1000, below 1 is InvalidRequestException; AWS bounds are not in the SDK (bd: gopherstack-cefu7.3)

Structural gaps

These do not block an A grade — no implementation could produce real data here because the underlying data source cannot exist in an emulator.

• Role ARNs and assumed-role ARNs use the emulator's single IAM account; an assignment to another account ID still resolves to a role in the emulator account

More

• Full parity audit
• All services

Documentation

Index

• type AccountInfo
• type Credentials
• type Directory
• type Entitlement
• type Handler
  • func NewHandler() *Handler
  • func (h *Handler) ChaosOperations() []string
  • func (h *Handler) ChaosRegions() []string
  • func (h *Handler) ChaosServiceName() string
  • func (h *Handler) ExtractOperation(c *echo.Context) string
  • func (h *Handler) ExtractResource(_ *echo.Context) string
  • func (h *Handler) GetSupportedOperations() []string
  • func (h *Handler) Handler() echo.HandlerFunc
  • func (h *Handler) MatchPriority() int
  • func (h *Handler) Name() string
  • func (h *Handler) RouteMatcher() service.Matcher
  • func (h *Handler) SetDirectory(d Directory)
  • func (h *Handler) SetTokenSource(s TokenSource)
• type Provider
  • func (p *Provider) Init(_ *service.AppContext) (service.Registerable, error)
  • func (p *Provider) Name() string
• type TokenSource

Types

type AccountInfo

type AccountInfo struct {
	Name  string
	Email string
}

AccountInfo is the display data of an account.

type Credentials

type Credentials struct {
	Expiration      time.Time
	AccessKeyID     string
	SecretAccessKey string
	SessionToken    string
}

Credentials are short-lived role credentials.

type Directory

type Directory interface {
	Entitlements(subject ssooidc.Subject) ([]Entitlement, error)
	AccountInfo(accountID string) AccountInfo
	IssueCredentials(e Entitlement, subject ssooidc.Subject) (Credentials, error)
}

Directory resolves entitlements and mints role credentials. Implementations look up sibling services lazily, at call time.

type Entitlement

type Entitlement struct {
	AccountID         string
	PermissionSetArn  string
	PermissionSetName string
	InstanceArn       string
}

Entitlement is one permission set assigned to a user (directly or through a group) in an account.

type Handler

type Handler struct {
	// contains filtered or unexported fields
}

Handler is the Echo handler for the IAM Identity Center portal API.

func NewHandler

func NewHandler() *Handler

NewHandler creates an unwired Handler.

func (*Handler) ChaosOperations

func (h *Handler) ChaosOperations() []string

ChaosOperations returns the fault-injectable operations.

func (*Handler) ChaosRegions

func (h *Handler) ChaosRegions() []string

ChaosRegions returns the regions served.

func (*Handler) ChaosServiceName

func (h *Handler) ChaosServiceName() string

ChaosServiceName returns the lowercase service name for fault rules.

func (*Handler) ExtractOperation

func (h *Handler) ExtractOperation(c *echo.Context) string

ExtractOperation returns the operation name.

func (*Handler) ExtractResource

func (h *Handler) ExtractResource(_ *echo.Context) string

ExtractResource returns a fixed label to avoid high-cardinality metrics.

func (*Handler) GetSupportedOperations

func (h *Handler) GetSupportedOperations() []string

GetSupportedOperations returns the supported operations.

func (*Handler) Handler

func (h *Handler) Handler() echo.HandlerFunc

Handler returns the Echo handler.

func (*Handler) MatchPriority

func (h *Handler) MatchPriority() int

MatchPriority returns the routing priority.

func (*Handler) Name

func (h *Handler) Name() string

Name returns the service name.

func (*Handler) RouteMatcher

func (h *Handler) RouteMatcher() service.Matcher

RouteMatcher matches portal calls. The SDK sends them unsigned with the bearer token header, which is what separates them from S3 path-style requests on the same paths.

func (*Handler) SetDirectory

func (h *Handler) SetDirectory(d Directory)

SetDirectory wires the entitlement and credential directory.

func (*Handler) SetTokenSource

func (h *Handler) SetTokenSource(s TokenSource)

SetTokenSource wires the OIDC token validator.

type Provider

type Provider struct{}

Provider implements service.Provider for the IAM Identity Center portal API.

func (*Provider) Init

func (p *Provider) Init(_ *service.AppContext) (service.Registerable, error)

Init builds the handler; the cli wires the token source and directory lazily.

func (*Provider) Name

func (p *Provider) Name() string

Name returns the provider name.

type TokenSource

type TokenSource interface {
	SessionForAccessToken(token string) (ssooidc.Session, error)
	RevokeSession(token string) error
}

TokenSource validates the bearer access tokens minted by the OIDC service.