Authorizers: Support AuthorizationScopes #652

keetonian · 2018-11-06T18:38:53Z

Description:

This was brought up in Slack:

Starting to work on a PoC using the new authorizer features in SAM and already notice one huge shortcoming I didn't think about.
AuthorizationScopes - this would have been really powerful to include so I could define required scopes for authenticating tokens at the API level instead of inside the code.

This is also necessary for using access_tokens.

Docs: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-apigateway-method.html#cfn-apigateway-method-authorizationscopes

SAM should support AuthorizationScopes.

The text was updated successfully, but these errors were encountered:

brysontyrrell · 2018-11-07T17:13:56Z

This was my thread in the channel. My proposal would look something like this:

  MyApi:
    Type: AWS::Serverless::Api
    Properties:
      StageName: Prod
      Auth:
        DefaultAuthorizer: MyCognitoAuthorizer
        Authorizers:
          MyCognitoAuthorizer:
            UserPoolArn: !Ref CognitoUserPoolArn
            OAuthScopes:
              - scope1
              - scope2

  MyFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: ./src
      Handler: lambda.handler
      MemorySize: 1024
      Runtime: nodejs8.10
      Events:
        Root:
          Type: Api
          Properties:
            RestApiId: !Ref MyApi
            Path: /
            Method: GET
            Auth:
              Authorizer: MyCognitoAuthorizer
              OAuthScopes:
                - scope3

This is a swagger doc from one of my templates to show what it looks like with scopes defined:

ApiGateway:
    Type: AWS::Serverless::Api
    Properties:
      StageName: Prod
      EndpointConfiguration: EDGE

      DefinitionBody:
        swagger: 2.0
        info:
          title: !Ref AWS::StackName
        securityDefinitions:
          CognitoAuth:
            type: apiKey
            name: Authorization
            in: header
            x-amazon-apigateway-authtype: cognito_user_pools
            x-amazon-apigateway-authorizer:
              type: cognito_user_pools
              providerARNs:
                - !Ref CognitoUserPoolArn

        paths:
          "/messages":
            post:
              x-amazon-apigateway-integration:
                httpMethod: post
                type: aws_proxy
                uri: !Sub arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${SendMessage.Arn}/invocations
              responses: {}
              security:
                - CognitoAuth:
                  - "rds-worker/send_message"

          "/errors":
            get:
              x-amazon-apigateway-integration:
                httpMethod: post
                type: aws_proxy
                uri: !Sub arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${Errors.Arn}/invocations
              responses: {}
              security:
                - CognitoAuth:
                  - "rds-worker/read_errors

Edit: Noticed a bad indent.

keetonian · 2018-11-13T18:26:44Z

Leaving this issue open for +1's and further comments. Happy to work with anyone that wants to implement this feature.

mau-fyayc · 2019-01-31T11:38:17Z

+1
I find it quite an important feature to use the full power of OAuth and Cognito.

uokitomer · 2019-03-13T08:04:35Z

Is there any plan to include this feature in the near future?

klmz · 2019-05-03T14:55:13Z

I can look into implementing this. The transformation to swagger is simple enough, although I'm not sure if there are other steps that need to be implemented.
In any case, what would be the expected behavior when only a scope is specified? Without an authorizer like this:

MyApi:
    Type: AWS::Serverless::Api
    Properties:
      StageName: Prod
      Auth:
        DefaultAuthorizer: MyCognitoAuthorizer
        Authorizers:
          MyCognitoAuthorizer:
            UserPoolArn: !Ref CognitoUserPoolArn
              OAuthScopes:
                - scope1
                - scope2

  MyFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: ./src
      Handler: lambda.handler
      MemorySize: 1024
      Runtime: nodejs8.10
      Events:
        Root:
          Type: Api
          Properties:
            RestApiId: !Ref MyApi
            Path: /
            Method: GET
            Auth:
              OAuthScopes:
                - scope3

I would propose choosing the default authorizer in this case.

klmz · 2019-05-03T14:57:17Z

I also want to propose calling it AuthorizationScopes instead of OAuthScopes since it is more consistent with the naming of the AWS::ApiGateway::Method in normal CloudFormation.
Or is it better to make the naming different to ensure there is no mix up for inexperienced users?

keetonian · 2019-05-03T21:55:07Z

@klmz Keeping the naming the same should be fine. I think the transformation into swagger + some supporting tests are all that are needed for this feature, correct me if I'm wrong.

klmz · 2019-05-04T11:07:15Z

Yes, that is what I figured. I got most of it working. Is there any documentation on what is expected in terms of tests? I saw some end-to-end test that will be needed, anything else?

keetonian · 2019-05-10T17:35:19Z

@klmz we don't have any docs on what is expected for tests, but I would recommend some end-to-end tests like you suggested, as well as some tests for the new swagger that is generated in https://github.com/awslabs/serverless-application-model/blob/develop/tests/swagger/test_swagger.py.

brettstack · 2019-05-10T17:37:13Z

I would propose choosing the default authorizer in this case.

This is correct. Looking forward to the PR!

MohammedAlSafwanOld · 2019-08-15T00:31:53Z

How long would it be until this get pushed in with the next release !? +1

praneetap · 2019-08-20T17:53:39Z

@MohammedAlSafwan We are still working on reviewing the PR, once that's reviewed and merged in we will assign a release tag on it.

MohammedAlSafwanOld · 2019-08-20T17:56:52Z

@praneetap ... thank you, I just noticed that it had conflict... I really hope that could be done soon

ghost · 2019-09-03T06:15:36Z

Looking forward to having this functionality!

ross-humphrey · 2019-09-05T15:13:52Z

+1 on looking forward to this functionality - having to work round this was a pain today. Any ETA on the release?

keetonian · 2019-09-10T15:17:58Z

I've been looking into this (both fixing merge conflicts in the code and the actual spec).

Using scopes in method authorization for Cognito is possible as per APIGW Cognito Docs, and is also consistent with the example shared by @brysontyrrell

This issue is for scopes on methods using Cognito auth, and does not address adding generic OAuth 2.0 support yet.

Some existing questions:

With the current proposal (included below for reference), would scopes scope1 and scope2 be applied to all methods using MyCognitoAuthorizer, meaning that the root event would have scope1, scope2, and scope3 as scopes?

  MyApi:
    Type: AWS::Serverless::Api
    Properties:
      StageName: Prod
      Auth:
        DefaultAuthorizer: MyCognitoAuthorizer
        Authorizers:
          MyCognitoAuthorizer:
            UserPoolArn: !Ref CognitoUserPoolArn
              OAuthScopes:
                - scope1
                - scope2

  MyFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: ./src
      Handler: lambda.handler
      MemorySize: 1024
      Runtime: nodejs8.10
      Events:
        Root:
          Type: Api
          Properties:
            RestApiId: !Ref MyApi
            Path: /
            Method: GET
            Auth:
              Authorizer: MyCognitoAuthorizer
              OAuthScopes:
                - scope3

DavidVergison · 2019-10-04T09:04:30Z

@keetonian : logically, yes :)
I can't wait to use this !

brysontyrrell · 2019-10-04T13:55:57Z

@keetonian @David-v2 That was the intent of my original example, but it might be more appropriate to have that be a part of Globals:

Globals:
  Function:
    Auth:
      OAuthScopes:
        - scope-1
        - scope-2

Note that Auth is not yet listed as a supported value in Globals.

reshavk · 2019-10-21T13:30:29Z

Any pointers on ETA of this feature ?

MohammedAlSafwanOld · 2019-11-26T17:01:19Z

I know that I'm asking again about this feature and I know that you guys are working hard. The feature is related to [WIP] Add authorizationscopes #917. The reason why I'm asking is because we are in need of defining a scope so that we are able to use Access Token instead of ID Token through the API Gateway. is there any solution around the problem other than adding the scope manually to every API method?

klmz · 2019-11-26T18:36:34Z

Unfortunately, I will not have time to work on this in the foreseeable future. It shouldn't be super hard to complete this PR though, so feel free to complete it.

MohammedAlSafwanOld · 2019-11-26T19:32:10Z

@klmz ... thank you so much for letting us know. It would be nice if [WIP] Add authorizationscopes #917 get moved to "To do" or removed so people don't get confused. Thank you so much for your effort.

keetonian · 2019-12-06T19:14:28Z

Updated the PR, should get this merged soon!

brysontyrrell · 2020-01-08T06:47:12Z

Is there any chance v1.20.0 is going to be released this week?

praneetap · 2020-01-08T17:55:25Z

Is there any chance v1.20.0 is going to be released this week?

Just updated the tracker. We are deploying in multiple regions right now. We should be releasing early next week, if everything goes okay!

keetonian added area/resource/api type/feature stage/request-for-comments labels Nov 13, 2018

klmz mentioned this issue May 14, 2019

Add authorizationscopes #917

Merged

4 tasks

keetonian mentioned this issue May 24, 2019

RFC: Allow customizations on AWS::Serverless::Function API event types #931

Closed

praneetap removed the stage/request-for-comments label Aug 16, 2019

praneetap added the stage/waiting-for-release label Dec 6, 2019

praneetap added the v1.20.0 label Dec 6, 2019

praneetap closed this as completed Jan 14, 2020

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Authorizers: Support AuthorizationScopes #652

Authorizers: Support AuthorizationScopes #652

keetonian commented Nov 6, 2018

brysontyrrell commented Nov 7, 2018 •

edited

Loading

keetonian commented Nov 13, 2018

mau-fyayc commented Jan 31, 2019 •

edited

Loading

uokitomer commented Mar 13, 2019

klmz commented May 3, 2019 •

edited

Loading

klmz commented May 3, 2019

keetonian commented May 3, 2019

klmz commented May 4, 2019 •

edited

Loading

keetonian commented May 10, 2019

brettstack commented May 10, 2019

MohammedAlSafwanOld commented Aug 15, 2019

praneetap commented Aug 20, 2019

MohammedAlSafwanOld commented Aug 20, 2019

ghost commented Sep 3, 2019

ross-humphrey commented Sep 5, 2019

keetonian commented Sep 10, 2019

DavidVergison commented Oct 4, 2019

brysontyrrell commented Oct 4, 2019

reshavk commented Oct 21, 2019

MohammedAlSafwanOld commented Nov 26, 2019

klmz commented Nov 26, 2019

MohammedAlSafwanOld commented Nov 26, 2019

keetonian commented Dec 6, 2019

brysontyrrell commented Jan 8, 2020

praneetap commented Jan 8, 2020

Authorizers: Support AuthorizationScopes #652

Authorizers: Support AuthorizationScopes #652

Comments

keetonian commented Nov 6, 2018

brysontyrrell commented Nov 7, 2018 • edited Loading

keetonian commented Nov 13, 2018

mau-fyayc commented Jan 31, 2019 • edited Loading

uokitomer commented Mar 13, 2019

klmz commented May 3, 2019 • edited Loading

klmz commented May 3, 2019

keetonian commented May 3, 2019

klmz commented May 4, 2019 • edited Loading

keetonian commented May 10, 2019

brettstack commented May 10, 2019

MohammedAlSafwanOld commented Aug 15, 2019

praneetap commented Aug 20, 2019

MohammedAlSafwanOld commented Aug 20, 2019

ghost commented Sep 3, 2019

ross-humphrey commented Sep 5, 2019

keetonian commented Sep 10, 2019

DavidVergison commented Oct 4, 2019

brysontyrrell commented Oct 4, 2019

reshavk commented Oct 21, 2019

MohammedAlSafwanOld commented Nov 26, 2019

klmz commented Nov 26, 2019

MohammedAlSafwanOld commented Nov 26, 2019

keetonian commented Dec 6, 2019

brysontyrrell commented Jan 8, 2020

praneetap commented Jan 8, 2020

brysontyrrell commented Nov 7, 2018 •

edited

Loading

mau-fyayc commented Jan 31, 2019 •

edited

Loading

klmz commented May 3, 2019 •

edited

Loading

klmz commented May 4, 2019 •

edited

Loading