This is an automated email from the ASF dual-hosted git repository.
adoroszlai pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/ozone.git
The following commit(s) were added to refs/heads/master by this push:
new 6ae92dab30d HDDS-16506. [STS] Use Consistent DurationSeconds
Validation Message, minor doc updates (#11261)
6ae92dab30d is described below
commit 6ae92dab30d559f3a3522a5d55a70f5bba796309
Author: fmorg-git <[email protected]>
AuthorDate: Tue Sep 22 06:23:10 2026 -0700
HDDS-16506. [STS] Use Consistent DurationSeconds Validation Message, minor
doc updates (#11261)
---
hadoop-hdds/docs/content/design/ozone-sts.md | 5 +-
.../apache/hadoop/ozone/om/helpers/S3STSUtils.java | 32 ++++-
.../hadoop/ozone/om/helpers/TestS3STSUtils.java | 98 +++++++++++++
.../smoketest/security/ozone-secure-sts.resource | 3 +-
.../main/smoketest/security/ozone-secure-sts.robot | 8 ++
.../s3/security/TestS3AssumeRoleRequest.java | 4 +-
.../apache/hadoop/ozone/s3sts/S3STSConfigKeys.java | 3 +-
.../apache/hadoop/ozone/s3sts/S3STSEndpoint.java | 38 ++---
.../hadoop/ozone/s3sts/TestS3STSEndpoint.java | 159 +++++++++++++++++----
9 files changed, 283 insertions(+), 67 deletions(-)
diff --git a/hadoop-hdds/docs/content/design/ozone-sts.md
b/hadoop-hdds/docs/content/design/ozone-sts.md
index ccca985ae57..f886d6b1fdc 100644
--- a/hadoop-hdds/docs/content/design/ozone-sts.md
+++ b/hadoop-hdds/docs/content/design/ozone-sts.md
@@ -3,7 +3,7 @@ title: AWS STS Design for Ozone S3
summary: STS Support in Ozone
date: 2025-10-30
jira: HDDS-13323
-status: implementing
+status: implemented
author: Madhan Neethiraj, Ren Koike, Fabian Morgan, Stephen O'Donnell, Istvan
Fajth, Uma Maheswara Rao Gangumalla
---
<!--
@@ -247,8 +247,9 @@ originalAccessKeyId in the session token and perform the
following checks:
- Ensure the sessionToken is not expired
- Ensure the STS credentials are not revoked by looking up the revocation
cutoff for the token's originalAccessKeyId
and comparing it against the token's signed creationTime
+ - Ensure that the Kerberos identity associated with the originalAccessKeyId
is not revoked
- Validate the HMAC-SHA256 signature in the sessionToken
- Decrypt the secretAccessKey from the sessionToken and validate the AWS
signature
- - Authorize the call with either RangerOzoneAuthorizer or
OzoneNativeAuthorizer
+ - Authorize the call with RangerOzoneAuthorizer
Assuming all these checks pass, the S3 API call will be invoked.
diff --git
a/hadoop-ozone/common/src/main/java/org/apache/hadoop/ozone/om/helpers/S3STSUtils.java
b/hadoop-ozone/common/src/main/java/org/apache/hadoop/ozone/om/helpers/S3STSUtils.java
index 17bf084f9b3..96627a1b9ea 100644
---
a/hadoop-ozone/common/src/main/java/org/apache/hadoop/ozone/om/helpers/S3STSUtils.java
+++
b/hadoop-ozone/common/src/main/java/org/apache/hadoop/ozone/om/helpers/S3STSUtils.java
@@ -47,6 +47,10 @@ public final class S3STSUtils {
public static final String OZONE_STATIC_ACCOUNT_ID = "123456789012";
+ public static final String DURATION_VALIDATION_ERROR_MESSAGE =
+ "Invalid Value: DurationSeconds must be a number between " +
MIN_DURATION_SECONDS + " and " +
+ MAX_DURATION_SECONDS + " seconds";
+
private S3STSUtils() {
}
@@ -101,18 +105,32 @@ public static void addAssumeRoleAuditParams(Map<String,
String> auditParams, Str
* @return validated duration
* @throws OMException if duration is invalid
*/
- public static int validateDuration(Integer durationSeconds) throws
OMException {
+ public static int validateDuration(int durationSeconds) throws OMException {
+ if (durationSeconds < MIN_DURATION_SECONDS || durationSeconds >
MAX_DURATION_SECONDS) {
+ throw new OMException(DURATION_VALIDATION_ERROR_MESSAGE,
INVALID_REQUEST);
+ }
+
+ return durationSeconds;
+ }
+
+ /**
+ * Validates the duration in seconds from a raw request value.
+ * @param durationSeconds duration in seconds as a string
+ * @return validated duration
+ * @throws OMException if duration is invalid
+ */
+ public static int validateDuration(String durationSeconds) throws
OMException {
if (durationSeconds == null) {
return DEFAULT_DURATION_SECONDS;
}
- if (durationSeconds < MIN_DURATION_SECONDS || durationSeconds >
MAX_DURATION_SECONDS) {
- throw new OMException(
- "Invalid Value: DurationSeconds must be between " +
MIN_DURATION_SECONDS + " and " + MAX_DURATION_SECONDS +
- " seconds", INVALID_REQUEST);
+ final int value;
+ try {
+ value = Integer.parseInt(durationSeconds);
+ } catch (NumberFormatException e) {
+ throw new OMException(DURATION_VALIDATION_ERROR_MESSAGE,
INVALID_REQUEST);
}
-
- return durationSeconds;
+ return validateDuration(value);
}
/**
diff --git
a/hadoop-ozone/common/src/test/java/org/apache/hadoop/ozone/om/helpers/TestS3STSUtils.java
b/hadoop-ozone/common/src/test/java/org/apache/hadoop/ozone/om/helpers/TestS3STSUtils.java
new file mode 100644
index 00000000000..9fb7b0eb3f1
--- /dev/null
+++
b/hadoop-ozone/common/src/test/java/org/apache/hadoop/ozone/om/helpers/TestS3STSUtils.java
@@ -0,0 +1,98 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.hadoop.ozone.om.helpers;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+
+import org.apache.hadoop.ozone.om.exceptions.OMException;
+import org.junit.jupiter.api.Test;
+
+/**
+ * Unit tests for S3STSUtils.
+ */
+public class TestS3STSUtils {
+
+ private static final String DURATION_VALIDATION_ERROR_MESSAGE =
+ "Invalid Value: DurationSeconds must be a number between 900 and 43200
seconds";
+
+ @Test
+ public void testValidateDurationStringNullUsesDefault() throws OMException {
+ assertEquals(S3STSUtils.DEFAULT_DURATION_SECONDS,
S3STSUtils.validateDuration((String) null));
+ }
+
+ @Test
+ public void testValidateDurationStringBlankIsInvalid() {
+ final OMException empty = assertThrows(OMException.class, () ->
S3STSUtils.validateDuration(""));
+
assertThat(empty.getMessage()).isEqualTo(DURATION_VALIDATION_ERROR_MESSAGE);
+
+ final OMException whitespace = assertThrows(OMException.class, () ->
S3STSUtils.validateDuration(" "));
+
assertThat(whitespace.getMessage()).isEqualTo(DURATION_VALIDATION_ERROR_MESSAGE);
+ }
+
+ @Test
+ public void testValidateDurationStringValidValues() throws OMException {
+ assertEquals(900, S3STSUtils.validateDuration("900"));
+ assertEquals(3600, S3STSUtils.validateDuration("3600"));
+ assertEquals(43200, S3STSUtils.validateDuration("43200"));
+ }
+
+ @Test
+ public void testValidateDurationStringOutOfRange() {
+ final OMException tooShort = assertThrows(OMException.class, () ->
S3STSUtils.validateDuration("899"));
+
assertThat(tooShort.getMessage()).isEqualTo(DURATION_VALIDATION_ERROR_MESSAGE);
+
+ final OMException tooLong = assertThrows(OMException.class, () ->
S3STSUtils.validateDuration("43201"));
+
assertThat(tooLong.getMessage()).isEqualTo(DURATION_VALIDATION_ERROR_MESSAGE);
+ }
+
+ @Test
+ public void testValidateDurationStringOverflowsInt() {
+ final OMException ex = assertThrows(OMException.class, () ->
S3STSUtils.validateDuration("4320010000"));
+ assertThat(ex.getMessage()).isEqualTo(DURATION_VALIDATION_ERROR_MESSAGE);
+ }
+
+ @Test
+ public void testValidateDurationStringNonNumeric() {
+ final OMException abc = assertThrows(OMException.class, () ->
S3STSUtils.validateDuration("abc"));
+ assertThat(abc.getMessage()).isEqualTo(DURATION_VALIDATION_ERROR_MESSAGE);
+
+ final OMException decimal = assertThrows(OMException.class, () ->
S3STSUtils.validateDuration("3.5"));
+
assertThat(decimal.getMessage()).isEqualTo(DURATION_VALIDATION_ERROR_MESSAGE);
+
+ final OMException invalidSign = assertThrows(OMException.class, () ->
S3STSUtils.validateDuration("+-3"));
+
assertThat(invalidSign.getMessage()).isEqualTo(DURATION_VALIDATION_ERROR_MESSAGE);
+ }
+
+ @Test
+ public void testValidateDurationIntValidValues() throws OMException {
+ assertEquals(900, S3STSUtils.validateDuration(900));
+ assertEquals(3600, S3STSUtils.validateDuration(3600));
+ assertEquals(43200, S3STSUtils.validateDuration(43200));
+ }
+
+ @Test
+ public void testValidateDurationIntOutOfRange() {
+ final OMException tooShort = assertThrows(OMException.class, () ->
S3STSUtils.validateDuration(899));
+
assertThat(tooShort.getMessage()).isEqualTo(DURATION_VALIDATION_ERROR_MESSAGE);
+
+ final OMException tooLong = assertThrows(OMException.class, () ->
S3STSUtils.validateDuration(43201));
+
assertThat(tooLong.getMessage()).isEqualTo(DURATION_VALIDATION_ERROR_MESSAGE);
+ }
+}
diff --git
a/hadoop-ozone/dist/src/main/smoketest/security/ozone-secure-sts.resource
b/hadoop-ozone/dist/src/main/smoketest/security/ozone-secure-sts.resource
index 4ebf2ec1b3b..e125e44e3e9 100644
--- a/hadoop-ozone/dist/src/main/smoketest/security/ozone-secure-sts.resource
+++ b/hadoop-ozone/dist/src/main/smoketest/security/ozone-secure-sts.resource
@@ -220,13 +220,14 @@ Assume Role Should Fail
Assume Role Should Fail Using Curl
# This keyword is needed to test boundary cases that the aws client
prevents you from issuing, such as too short duration for token
- [Arguments] ${perm_access_key_id} ${perm_secret_key}
${policy_json}=${EMPTY} ${expected_error}=AccessDenied
${expected_http_code}=400 ${role_arn}=${ROLE_ARN_OBS}
${role_session_name}=${ROLE_SESSION_NAME} ${duration_seconds}=900
${extra_curl_params}=${EMPTY}
+ [Arguments] ${perm_access_key_id} ${perm_secret_key}
${policy_json}=${EMPTY} ${expected_error}=AccessDenied
${expected_http_code}=400 ${role_arn}=${ROLE_ARN_OBS}
${role_session_name}=${ROLE_SESSION_NAME} ${duration_seconds}=900
${extra_curl_params}=${EMPTY} ${expected_message}=${EMPTY}
${cmd} = Set Variable curl --silent
--show-error --include --request POST --aws-sigv4 "aws:amz:us-east-1:sts"
--user '${perm_access_key_id}:${perm_secret_key}' --header "Content-Type:
application/x-www-form-urlencoded" --data-urlencode "Action=AssumeRole"
--data-urlencode "Version=2011-06-15" --data-urlencode "RoleArn=${role_arn}"
--data-urlencode "RoleSessionName=${role_session_name}" ${STS_ENDPOINT_URL}
${cmd} = Set Variable If
'${duration_seconds}' != '${EMPTY}' ${cmd} --data-urlencode
"DurationSeconds=${duration_seconds}" ${cmd}
${cmd} = Set Variable If
'${policy_json}' != '${EMPTY}' ${cmd} --data-urlencode
"Policy=${policy_json}" ${cmd}
${cmd} = Set Variable If
'${extra_curl_params}' != '${EMPTY}' ${cmd} ${extra_curl_params} ${cmd}
${output} = Execute And Ignore Error ${cmd}
Should Contain ${output}
${expected_error}
+ Run Keyword If '${expected_message}' != '${EMPTY}'
Should Contain ${output} ${expected_message}
@{http_codes} = Get Regexp Matches ${output}
(?m)^HTTP/[0-9.]+ ([0-9]{3}) 1
${code_count} = Get Length ${http_codes}
Should Be True ${code_count} > 0 Expected to
find an HTTP status code in curl output, but none was found.
diff --git
a/hadoop-ozone/dist/src/main/smoketest/security/ozone-secure-sts.robot
b/hadoop-ozone/dist/src/main/smoketest/security/ozone-secure-sts.robot
index 2368b1da68e..407cf60f105 100644
--- a/hadoop-ozone/dist/src/main/smoketest/security/ozone-secure-sts.robot
+++ b/hadoop-ozone/dist/src/main/smoketest/security/ozone-secure-sts.robot
@@ -735,6 +735,14 @@ Assume Role Should Fail For Too Short Role Arn
Assume Role Should Fail For Too Short Role Session Name
Assume Role Should Fail Using Curl
perm_access_key_id=${PERMANENT_ACCESS_KEY_ID}
perm_secret_key=${PERMANENT_SECRET_KEY} expected_error=ValidationError
expected_http_code=400 role_arn=${ICEBERG_ALL_ACCESS_ROLE_OBS_ARN}
role_session_name=a
+Assume Role Should Fail For Invalid Duration
+ # AWS CLI rejects out-of-range DurationSeconds before the request is sent,
so use curl.
+ Assume Role Should Fail Using Curl
perm_access_key_id=${PERMANENT_ACCESS_KEY_ID}
perm_secret_key=${PERMANENT_SECRET_KEY} expected_error=ValidationError
expected_http_code=400 role_arn=${ICEBERG_ALL_ACCESS_ROLE_OBS_ARN}
duration_seconds=43201 expected_message=must be a number between 900 and 43200
seconds
+ # Check duration that overflows integer as well
+ Assume Role Should Fail Using Curl
perm_access_key_id=${PERMANENT_ACCESS_KEY_ID}
perm_secret_key=${PERMANENT_SECRET_KEY} expected_error=ValidationError
expected_http_code=400 role_arn=${ICEBERG_ALL_ACCESS_ROLE_OBS_ARN}
duration_seconds=43200100000 expected_message=must be a number between 900 and
43200 seconds
+ # Whitespace-only DurationSeconds must be rejected
+ Assume Role Should Fail Using Curl
perm_access_key_id=${PERMANENT_ACCESS_KEY_ID}
perm_secret_key=${PERMANENT_SECRET_KEY} expected_error=ValidationError
expected_http_code=400 role_arn=${ICEBERG_ALL_ACCESS_ROLE_OBS_ARN}
duration_seconds=${SPACE}${SPACE}${SPACE}${SPACE}${SPACE}
expected_message=must be a number between 900 and 43200 seconds
+
Assume Role With ExternalId Should Fail As UnsupportedOperation
Assume Role Should Fail
perm_access_key_id=${PERMANENT_ACCESS_KEY_ID}
perm_secret_key=${PERMANENT_SECRET_KEY} expected_error=UnsupportedOperation
expected_http_code=501 role_arn=${ICEBERG_ALL_ACCESS_ROLE_OBS_ARN}
extra_cli_args=--external-id test-external-id
diff --git
a/hadoop-ozone/ozone-manager/src/test/java/org/apache/hadoop/ozone/om/request/s3/security/TestS3AssumeRoleRequest.java
b/hadoop-ozone/ozone-manager/src/test/java/org/apache/hadoop/ozone/om/request/s3/security/TestS3AssumeRoleRequest.java
index f779a349d0f..3d073c7b71e 100644
---
a/hadoop-ozone/ozone-manager/src/test/java/org/apache/hadoop/ozone/om/request/s3/security/TestS3AssumeRoleRequest.java
+++
b/hadoop-ozone/ozone-manager/src/test/java/org/apache/hadoop/ozone/om/request/s3/security/TestS3AssumeRoleRequest.java
@@ -168,7 +168,7 @@ public void testInvalidDurationTooShort() {
assertThat(exception.getResult()).isEqualTo(OMException.ResultCodes.INVALID_REQUEST);
assertThat(exception.getMessage()).isEqualTo(
- "Invalid Value: DurationSeconds must be between 900 and 43200
seconds");
+ "Invalid Value: DurationSeconds must be a number between 900 and 43200
seconds");
assertMarkForAuditCalled(request);
}
@@ -188,7 +188,7 @@ public void testInvalidDurationTooLong() {
assertThat(exception.getResult()).isEqualTo(OMException.ResultCodes.INVALID_REQUEST);
assertThat(exception.getMessage()).isEqualTo(
- "Invalid Value: DurationSeconds must be between 900 and 43200
seconds");
+ "Invalid Value: DurationSeconds must be a number between 900 and 43200
seconds");
assertMarkForAuditCalled(request);
}
diff --git
a/hadoop-ozone/s3gateway/src/main/java/org/apache/hadoop/ozone/s3sts/S3STSConfigKeys.java
b/hadoop-ozone/s3gateway/src/main/java/org/apache/hadoop/ozone/s3sts/S3STSConfigKeys.java
index aca0cbd470b..3196c1bd078 100644
---
a/hadoop-ozone/s3gateway/src/main/java/org/apache/hadoop/ozone/s3sts/S3STSConfigKeys.java
+++
b/hadoop-ozone/s3gateway/src/main/java/org/apache/hadoop/ozone/s3sts/S3STSConfigKeys.java
@@ -41,7 +41,8 @@ public final class S3STSConfigKeys {
// Action=AssumeRole&RoleArn=...&RoleSessionName=...&DurationSeconds=...
// where RoleArn max length is 2048 and max bytes per character in UTF-8
encoding is 12
// (2048 * 12 = 24576) + other parameters and overheads, so setting to 32 KB
- // this limit can be adjusted via configuration if needed.
+ // 12 is the worst-case percent-encoded wire size for one code point in
application/x-www-form-urlencoded data:
+ // a 4-byte UTF-8 sequence can become four %XX triplets
public static final int OZONE_S3G_STS_PAYLOAD_HASH_MAX_VALUE = 32768;
/**
diff --git
a/hadoop-ozone/s3gateway/src/main/java/org/apache/hadoop/ozone/s3sts/S3STSEndpoint.java
b/hadoop-ozone/s3gateway/src/main/java/org/apache/hadoop/ozone/s3sts/S3STSEndpoint.java
index 2c6200d1e66..5d7d8785df8 100644
---
a/hadoop-ozone/s3gateway/src/main/java/org/apache/hadoop/ozone/s3sts/S3STSEndpoint.java
+++
b/hadoop-ozone/s3gateway/src/main/java/org/apache/hadoop/ozone/s3sts/S3STSEndpoint.java
@@ -146,7 +146,7 @@ public Response get(
@QueryParam("Action") String action,
@QueryParam("RoleArn") String roleArn,
@QueryParam("RoleSessionName") String roleSessionName,
- @QueryParam("DurationSeconds") Integer durationSeconds,
+ @QueryParam("DurationSeconds") String durationSeconds,
@QueryParam("Version") String version,
@QueryParam("Policy") String awsIamSessionPolicy) throws OS3Exception {
@@ -173,7 +173,7 @@ public Response post(Form form) throws OS3Exception {
final String action = formParams.getFirst("Action");
final String roleArn = formParams.getFirst("RoleArn");
final String roleSessionName = formParams.getFirst("RoleSessionName");
- final Integer durationSeconds =
parseIntegerOrNull(formParams.getFirst("DurationSeconds"));
+ final String durationSeconds = formParams.getFirst("DurationSeconds");
final String version = formParams.getFirst("Version");
final String awsIamSessionPolicy = formParams.getFirst("Policy");
@@ -182,7 +182,7 @@ public Response post(Form form) throws OS3Exception {
}
private Response handleSTSRequest(Set<String> paramNamesToValidate, String
action, String roleArn,
- String roleSessionName, Integer durationSeconds, String version, String
awsIamSessionPolicy) throws OS3Exception {
+ String roleSessionName, String durationSeconds, String version, String
awsIamSessionPolicy) throws OS3Exception {
final String requestId = requestIdentifier.getRequestId();
// NOTE: invalid, missing or unsupported actions are not added to the
audit log
try {
@@ -219,13 +219,18 @@ private Response handleSTSRequest(Set<String>
paramNamesToValidate, String actio
}
private Response handleAssumeRole(Set<String> paramNamesToValidate, String
roleArn, String roleSessionName,
- Integer durationSeconds, String awsIamSessionPolicy, String version,
String requestId) throws OSTSException {
+ String durationSeconds, String awsIamSessionPolicy, String version,
String requestId) throws OSTSException {
final String action = "AssumeRole";
final Map<String, String> auditParams = getAuditParameters();
+ int duration = S3STSUtils.DEFAULT_DURATION_SECONDS;
+ String durationValidationError = null;
+ try {
+ duration = S3STSUtils.validateDuration(durationSeconds);
+ } catch (OMException e) {
+ durationValidationError = e.getMessage();
+ }
S3STSUtils.addAssumeRoleAuditParams(
- auditParams, roleArn, roleSessionName, awsIamSessionPolicy,
- durationSeconds == null ? S3STSUtils.DEFAULT_DURATION_SECONDS :
durationSeconds,
- requestId);
+ auditParams, roleArn, roleSessionName, awsIamSessionPolicy, duration,
requestId);
// Validate parameters
if (version == null || !version.equals(EXPECTED_VERSION)) {
@@ -247,11 +252,8 @@ private Response handleAssumeRole(Set<String>
paramNamesToValidate, String roleA
}
final Set<String> validationErrors = new HashSet<>();
- int duration = durationSeconds == null ?
S3STSUtils.DEFAULT_DURATION_SECONDS : durationSeconds;
- try {
- duration = S3STSUtils.validateDuration(durationSeconds);
- } catch (OMException e) {
- validationErrors.add(e.getMessage());
+ if (durationValidationError != null) {
+ validationErrors.add(durationValidationError);
}
try {
@@ -429,18 +431,6 @@ private static boolean
isAwsValidButNotImplementedAssumeRoleParameter(String par
|| Strings.CI.startsWith(paramName, TRANSITIVE_TAG_KEYS_MEMBER_PREFIX);
}
- private static Integer parseIntegerOrNull(String value) throws OSTSException
{
- if (StringUtils.isBlank(value)) {
- return null;
- }
- try {
- return Integer.parseInt(value);
- } catch (NumberFormatException e) {
- throw new OSTSException(STS_VALIDATION_ERROR)
- .withMessage("1 validation error detected: Invalid Value:
DurationSeconds must be a number");
- }
- }
-
private static final class AssumeRoleParamValidationResult {
private static final AssumeRoleParamValidationResult EMPTY = new
AssumeRoleParamValidationResult(
Collections.emptyList(), Collections.emptyList());
diff --git
a/hadoop-ozone/s3gateway/src/test/java/org/apache/hadoop/ozone/s3sts/TestS3STSEndpoint.java
b/hadoop-ozone/s3gateway/src/test/java/org/apache/hadoop/ozone/s3sts/TestS3STSEndpoint.java
index 379bd27eb98..6eea1c06594 100644
---
a/hadoop-ozone/s3gateway/src/test/java/org/apache/hadoop/ozone/s3sts/TestS3STSEndpoint.java
+++
b/hadoop-ozone/s3gateway/src/test/java/org/apache/hadoop/ozone/s3sts/TestS3STSEndpoint.java
@@ -78,6 +78,8 @@ public class TestS3STSEndpoint {
private static final String STS_NS =
"https://sts.amazonaws.com/doc/2011-06-15/";;
private static final String AWS_FAULT_NS =
"http://webservices.amazon.com/AWSFault/2005-15-09";;
private static final String REQUEST_ID = "test-request-id";
+ private static final String DURATION_VALIDATION_ERROR_MESSAGE =
+ "Invalid Value: DurationSeconds must be a number between 900 and 43200
seconds";
@BeforeEach
public void setup() throws Exception {
@@ -133,7 +135,7 @@ public void
testStsAssumeRoleRejectsUnsupportedParameterForGetMethod() throws Ex
setAssumeRoleQueryParameters("PolicyArns.member.1",
"arn:aws:iam::123456789012:policy/test-policy");
final OSTSException ex = assertThrows(
- OSTSException.class, () -> endpoint.get("AssumeRole", ROLE_ARN,
ROLE_SESSION_NAME, 3600, "2011-06-15", null));
+ OSTSException.class, () -> endpoint.get("AssumeRole", ROLE_ARN,
ROLE_SESSION_NAME, "3600", "2011-06-15", null));
assertEquals(501, ex.getHttpCode());
verify(auditLogger).logWriteFailure(any(AuditMessage.class));
@@ -173,7 +175,7 @@ public void
testStsAssumeRoleAllowsSupportedParametersForGetMethod() {
"DurationSeconds", "3600",
"Version", "2011-06-15");
- final Response response = endpoint.get("AssumeRole", ROLE_ARN,
ROLE_SESSION_NAME, 3600, "2011-06-15", null);
+ final Response response = endpoint.get("AssumeRole", ROLE_ARN,
ROLE_SESSION_NAME, "3600", "2011-06-15", null);
assertEquals(200, response.getStatus());
verify(auditLogger).logWriteSuccess(any(AuditMessage.class));
@@ -195,7 +197,7 @@ public void
testStsAssumeRoleAllowsSignatureParametersForGetMethod() {
"X-Amz-SignedHeaders", "host",
"X-Amz-Signature",
"0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef");
- final Response response = endpoint.get("AssumeRole", ROLE_ARN,
ROLE_SESSION_NAME, 3600, "2011-06-15", null);
+ final Response response = endpoint.get("AssumeRole", ROLE_ARN,
ROLE_SESSION_NAME, "3600", "2011-06-15", null);
assertEquals(200, response.getStatus());
verify(auditLogger).logWriteSuccess(any(AuditMessage.class));
@@ -207,7 +209,7 @@ public void
testStsAssumeRoleRejectsUnknownParameterForGetMethod() throws Except
setAssumeRoleQueryParameters("TotallyUnknownParam", "x");
final OSTSException ex = assertThrows(
- OSTSException.class, () -> endpoint.get("AssumeRole", ROLE_ARN,
ROLE_SESSION_NAME, 3600, "2011-06-15", null));
+ OSTSException.class, () -> endpoint.get("AssumeRole", ROLE_ARN,
ROLE_SESSION_NAME, "3600", "2011-06-15", null));
assertEquals(400, ex.getHttpCode());
verify(auditLogger).logWriteFailure(any(AuditMessage.class));
@@ -242,7 +244,7 @@ public void
testStsAssumeRoleRejectsBlankParameterNameForGetMethod() throws Exce
setAssumeRoleQueryParameters("", "x");
final OSTSException ex = assertThrows(
- OSTSException.class, () -> endpoint.get("AssumeRole", ROLE_ARN,
ROLE_SESSION_NAME, 3600, "2011-06-15", null));
+ OSTSException.class, () -> endpoint.get("AssumeRole", ROLE_ARN,
ROLE_SESSION_NAME, "3600", "2011-06-15", null));
assertEquals(400, ex.getHttpCode());
verify(auditLogger).logWriteFailure(any(AuditMessage.class));
@@ -308,7 +310,7 @@ public void
testStsAssumeRoleRejectsUnsupportedSigningParametersForPostMethod()
@Test
public void testStsAssumeRoleValidForGetMethod() throws Exception {
- final Response response = endpoint.get("AssumeRole", ROLE_ARN,
ROLE_SESSION_NAME, 3600, "2011-06-15", null);
+ final Response response = endpoint.get("AssumeRole", ROLE_ARN,
ROLE_SESSION_NAME, "3600", "2011-06-15", null);
assertEquals(200, response.getStatus());
verify(auditLogger).logWriteSuccess(any(AuditMessage.class));
@@ -383,7 +385,7 @@ public void testStsAssumeRoleValidForPostMethod() throws
Exception {
@Test
public void testStsNullAction() throws Exception {
- final Response response = endpoint.get(null, ROLE_ARN, ROLE_SESSION_NAME,
3600, "2011-06-15", null);
+ final Response response = endpoint.get(null, ROLE_ARN, ROLE_SESSION_NAME,
"3600", "2011-06-15", null);
assertEquals(400, response.getStatus());
verifyNoInteractions(auditLogger);
@@ -414,7 +416,7 @@ public void testStsNullFormForPostMethod() throws Exception
{
@Test
public void testStsUnsupportedActionWithVersionSupplied() throws Exception {
final OSTSException ex = assertThrows(OSTSException.class, () ->
- endpoint.get("UnsupportedAction", ROLE_ARN, ROLE_SESSION_NAME, 3600,
"2011-06-15", null));
+ endpoint.get("UnsupportedAction", ROLE_ARN, ROLE_SESSION_NAME, "3600",
"2011-06-15", null));
assertEquals(400, ex.getHttpCode());
verifyNoInteractions(auditLogger);
@@ -427,7 +429,7 @@ public void testStsUnsupportedActionWithVersionSupplied()
throws Exception {
@Test
public void testStsUnsupportedActionWithVersionNotSupplied() throws
Exception {
final OSTSException ex = assertThrows(OSTSException.class, () ->
- endpoint.get("UnsupportedAction", ROLE_ARN, ROLE_SESSION_NAME, 3600,
null, null));
+ endpoint.get("UnsupportedAction", ROLE_ARN, ROLE_SESSION_NAME, "3600",
null, null));
assertEquals(400, ex.getHttpCode());
verifyNoInteractions(auditLogger);
@@ -440,7 +442,7 @@ public void
testStsUnsupportedActionWithVersionNotSupplied() throws Exception {
@Test
public void testStsAssumeRoleWithInvalidVersion() throws Exception {
final OSTSException ex = assertThrows(OSTSException.class, () ->
- endpoint.get("AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, 3600,
"2000-01-01", null));
+ endpoint.get("AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, "3600",
"2000-01-01", null));
assertEquals(400, ex.getHttpCode());
verify(auditLogger).logWriteFailure(any(AuditMessage.class));
@@ -454,7 +456,7 @@ public void testStsAssumeRoleWithInvalidVersion() throws
Exception {
@Test
public void testStsInvalidDuration() throws Exception {
final OSTSException ex = assertThrows(OSTSException.class, () ->
- endpoint.get("AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, -1,
"2011-06-15", null));
+ endpoint.get("AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, "-1",
"2011-06-15", null));
assertEquals(400, ex.getHttpCode());
verify(auditLogger).logWriteFailure(any(AuditMessage.class));
@@ -464,6 +466,102 @@ public void testStsInvalidDuration() throws Exception {
assertStsErrorXml(ex.toXml(), STS_NS, "Sender", "ValidationError",
"Invalid Value: DurationSeconds");
}
+ @Test
+ public void testStsDurationOverflowForGetMethod() throws Exception {
+ final OSTSException ex = assertThrows(
+ OSTSException.class, () -> endpoint.get(
+ "AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, "4320010000",
"2011-06-15", null));
+
+ assertEquals(400, ex.getHttpCode());
+ verify(auditLogger).logWriteFailure(any(AuditMessage.class));
+ verify(auditLogger, never()).logWriteSuccess(any(AuditMessage.class));
+ verify(objectStore, never()).assumeRole(anyString(), anyString(),
anyInt(), any(), anyString());
+
+ ex.setRequestId(REQUEST_ID);
+ assertStsErrorXml(ex.toXml(), STS_NS, "Sender", "ValidationError",
DURATION_VALIDATION_ERROR_MESSAGE);
+ }
+
+ @Test
+ public void testStsDurationOverflowForPostMethod() throws Exception {
+ setAssumeRoleFormParameters(
+ "Action", "AssumeRole", "RoleArn", ROLE_ARN, "RoleSessionName",
ROLE_SESSION_NAME,
+ "DurationSeconds", "4320010000", "Version", "2011-06-15");
+
+ final OSTSException ex = assertThrows(OSTSException.class, () ->
endpoint.post(formParameters).close());
+
+ assertEquals(400, ex.getHttpCode());
+ verify(auditLogger).logWriteFailure(any(AuditMessage.class));
+ verify(auditLogger, never()).logWriteSuccess(any(AuditMessage.class));
+ verify(objectStore, never()).assumeRole(anyString(), anyString(),
anyInt(), any(), anyString());
+
+ ex.setRequestId(REQUEST_ID);
+ assertStsErrorXml(ex.toXml(), STS_NS, "Sender", "ValidationError",
DURATION_VALIDATION_ERROR_MESSAGE);
+ }
+
+ @Test
+ public void testStsNonNumericDurationForGetMethod() throws Exception {
+ final OSTSException ex = assertThrows(
+ OSTSException.class, () -> endpoint.get(
+ "AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, "abc", "2011-06-15",
null));
+
+ assertEquals(400, ex.getHttpCode());
+ verify(auditLogger).logWriteFailure(any(AuditMessage.class));
+ verify(auditLogger, never()).logWriteSuccess(any(AuditMessage.class));
+ verify(objectStore, never()).assumeRole(anyString(), anyString(),
anyInt(), any(), anyString());
+
+ ex.setRequestId(REQUEST_ID);
+ assertStsErrorXml(ex.toXml(), STS_NS, "Sender", "ValidationError",
DURATION_VALIDATION_ERROR_MESSAGE);
+ }
+
+ @Test
+ public void testStsNonNumericDurationForPostMethod() throws Exception {
+ setAssumeRoleFormParameters(
+ "Action", "AssumeRole", "RoleArn", ROLE_ARN, "RoleSessionName",
ROLE_SESSION_NAME, "DurationSeconds", "abc",
+ "Version", "2011-06-15");
+
+ final OSTSException ex = assertThrows(OSTSException.class, () ->
endpoint.post(formParameters).close());
+
+ assertEquals(400, ex.getHttpCode());
+ verify(auditLogger).logWriteFailure(any(AuditMessage.class));
+ verify(auditLogger, never()).logWriteSuccess(any(AuditMessage.class));
+ verify(objectStore, never()).assumeRole(anyString(), anyString(),
anyInt(), any(), anyString());
+
+ ex.setRequestId(REQUEST_ID);
+ assertStsErrorXml(ex.toXml(), STS_NS, "Sender", "ValidationError",
DURATION_VALIDATION_ERROR_MESSAGE);
+ }
+
+ @Test
+ public void testStsBlankDurationForGetMethod() throws Exception {
+ final OSTSException ex = assertThrows(
+ OSTSException.class, () -> endpoint.get(
+ "AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, " ", "2011-06-15",
null));
+
+ assertEquals(400, ex.getHttpCode());
+ verify(auditLogger).logWriteFailure(any(AuditMessage.class));
+ verify(auditLogger, never()).logWriteSuccess(any(AuditMessage.class));
+ verify(objectStore, never()).assumeRole(anyString(), anyString(),
anyInt(), any(), anyString());
+
+ ex.setRequestId(REQUEST_ID);
+ assertStsErrorXml(ex.toXml(), STS_NS, "Sender", "ValidationError",
DURATION_VALIDATION_ERROR_MESSAGE);
+ }
+
+ @Test
+ public void testStsBlankDurationForPostMethod() throws Exception {
+ setAssumeRoleFormParameters(
+ "Action", "AssumeRole", "RoleArn", ROLE_ARN, "RoleSessionName",
ROLE_SESSION_NAME, "DurationSeconds", " ",
+ "Version", "2011-06-15");
+
+ final OSTSException ex = assertThrows(OSTSException.class, () ->
endpoint.post(formParameters).close());
+
+ assertEquals(400, ex.getHttpCode());
+ verify(auditLogger).logWriteFailure(any(AuditMessage.class));
+ verify(auditLogger, never()).logWriteSuccess(any(AuditMessage.class));
+ verify(objectStore, never()).assumeRole(anyString(), anyString(),
anyInt(), any(), anyString());
+
+ ex.setRequestId(REQUEST_ID);
+ assertStsErrorXml(ex.toXml(), STS_NS, "Sender", "ValidationError",
DURATION_VALIDATION_ERROR_MESSAGE);
+ }
+
@Test
public void testStsNullDurationUsesDefault3600() throws Exception {
final Response response = endpoint.get(
@@ -482,7 +580,7 @@ public void testStsPolicyTooLarge() throws Exception {
final String tooLargePolicy =
RandomStringUtils.insecure().nextAlphanumeric(2049);
final OSTSException ex = assertThrows(OSTSException.class, () ->
- endpoint.get("AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, 3600,
"2011-06-15", tooLargePolicy));
+ endpoint.get("AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, "3600",
"2011-06-15", tooLargePolicy));
assertEquals(400, ex.getHttpCode());
verify(auditLogger).logWriteFailure(any(AuditMessage.class));
@@ -498,7 +596,7 @@ public void testStsPolicyTooLarge() throws Exception {
public void testStsInvalidRoleArn() throws Exception {
final String invalidRoleArn =
"arn:awsNotValid::123456789012:role/test-role";
final OSTSException ex = assertThrows(OSTSException.class, () ->
- endpoint.get("AssumeRole", invalidRoleArn, ROLE_SESSION_NAME, 3600,
"2011-06-15", null));
+ endpoint.get("AssumeRole", invalidRoleArn, ROLE_SESSION_NAME, "3600",
"2011-06-15", null));
assertEquals(400, ex.getHttpCode());
verify(auditLogger).logWriteFailure(any(AuditMessage.class));
@@ -512,7 +610,7 @@ public void testStsInvalidRoleArn() throws Exception {
@Test
public void testStsMissingRoleArn() throws Exception {
final OSTSException ex = assertThrows(OSTSException.class, () ->
- endpoint.get("AssumeRole", null, ROLE_SESSION_NAME, 3600,
"2011-06-15", null));
+ endpoint.get("AssumeRole", null, ROLE_SESSION_NAME, "3600",
"2011-06-15", null));
assertEquals(400, ex.getHttpCode());
verify(auditLogger).logWriteFailure(any(AuditMessage.class));
@@ -526,7 +624,7 @@ public void testStsMissingRoleArn() throws Exception {
public void testStsInvalidRoleArnMissingRoleName() throws Exception {
final String invalidRoleArn = "arn:aws:iam::123456789012:role/";
final OSTSException ex = assertThrows(OSTSException.class, () ->
- endpoint.get("AssumeRole", invalidRoleArn, ROLE_SESSION_NAME, 3600,
"2011-06-15", null));
+ endpoint.get("AssumeRole", invalidRoleArn, ROLE_SESSION_NAME, "3600",
"2011-06-15", null));
assertEquals(400, ex.getHttpCode());
assertEquals("ValidationError", ex.getCode());
@@ -541,7 +639,7 @@ public void testStsInvalidRoleArnMissingRoleName() throws
Exception {
public void testStsInvalidRoleArnMissingAccountId() throws Exception {
final String invalidRoleArn = "arn:aws:iam:::role/test-role";
final OSTSException ex = assertThrows(OSTSException.class, () ->
- endpoint.get("AssumeRole", invalidRoleArn, ROLE_SESSION_NAME, 3600,
"2011-06-15", null));
+ endpoint.get("AssumeRole", invalidRoleArn, ROLE_SESSION_NAME, "3600",
"2011-06-15", null));
assertEquals(400, ex.getHttpCode());
assertEquals("ValidationError", ex.getCode());
@@ -556,7 +654,7 @@ public void testStsInvalidRoleArnMissingAccountId() throws
Exception {
@Test
public void testStsWhenActionNotImplemented() throws Exception {
final OSTSException ex = assertThrows(OSTSException.class, () ->
- endpoint.get("GetSessionToken", ROLE_ARN, ROLE_SESSION_NAME, 3600,
"2011-06-15", null));
+ endpoint.get("GetSessionToken", ROLE_ARN, ROLE_SESSION_NAME, "3600",
"2011-06-15", null));
assertEquals(501, ex.getHttpCode());
verifyNoInteractions(auditLogger);
@@ -588,7 +686,8 @@ public void testStsGetCallerIdentitySuccessForGetMethod()
throws Exception {
@Test
public void testStsGetCallerIdentityIgnoresExtraParameters() throws
Exception {
- final Response response = endpoint.get("GetCallerIdentity", ROLE_ARN,
ROLE_SESSION_NAME, 3600, "2011-06-15", null);
+ final Response response = endpoint.get(
+ "GetCallerIdentity", ROLE_ARN, ROLE_SESSION_NAME, "3600",
"2011-06-15", null);
assertEquals(200, response.getStatus());
verify(objectStore).getCallerIdentity();
@@ -642,7 +741,7 @@ public void testStsGetCallerIdentityRejectsInvalidVersion()
throws Exception {
@Test
public void testStsMissingRoleSessionName() throws Exception {
final OSTSException ex = assertThrows(OSTSException.class, () ->
- endpoint.get("AssumeRole", ROLE_ARN, null, 3600, "2011-06-15", null));
+ endpoint.get("AssumeRole", ROLE_ARN, null, "3600", "2011-06-15",
null));
assertEquals(400, ex.getHttpCode());
verify(auditLogger).logWriteFailure(any(AuditMessage.class));
@@ -656,7 +755,7 @@ public void testStsMissingRoleSessionName() throws
Exception {
public void testStsInvalidRoleSessionNameWithInvalidCharacter() throws
Exception {
final String invalidSession = "test/session";
final OSTSException ex = assertThrows(OSTSException.class, () ->
- endpoint.get("AssumeRole", ROLE_ARN, invalidSession, 3600,
"2011-06-15", null));
+ endpoint.get("AssumeRole", ROLE_ARN, invalidSession, "3600",
"2011-06-15", null));
assertEquals(400, ex.getHttpCode());
verify(auditLogger).logWriteFailure(any(AuditMessage.class));
@@ -673,7 +772,7 @@ public void
testStsInvalidRoleSessionNameWithInvalidCharacter() throws Exception
public void testStsInvalidRoleSessionNameTooShort() throws Exception {
final String invalidSession = "a";
final OSTSException ex = assertThrows(OSTSException.class, () ->
- endpoint.get("AssumeRole", ROLE_ARN, invalidSession, 3600,
"2011-06-15", null));
+ endpoint.get("AssumeRole", ROLE_ARN, invalidSession, "3600",
"2011-06-15", null));
assertEquals(400, ex.getHttpCode());
verify(auditLogger).logWriteFailure(any(AuditMessage.class));
@@ -690,7 +789,7 @@ public void testStsInvalidRoleArnResourceType() throws
Exception {
// Resource type must be role, not user
final String invalidRoleArn = "arn:aws:iam::123456789012:user/test-user";
final OSTSException ex = assertThrows(OSTSException.class, () ->
- endpoint.get("AssumeRole", invalidRoleArn, ROLE_SESSION_NAME, 3600,
"2011-06-15", null));
+ endpoint.get("AssumeRole", invalidRoleArn, ROLE_SESSION_NAME, "3600",
"2011-06-15", null));
assertEquals(400, ex.getHttpCode());
verify(auditLogger).logWriteFailure(any(AuditMessage.class));
@@ -706,7 +805,7 @@ public void testStsInternalFailureWhenBackendThrows()
throws Exception {
.thenThrow(new RuntimeException("some unexpected error"));
final OSTSException ex = assertThrows(OSTSException.class, () ->
- endpoint.get("AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, 3600,
"2011-06-15", null));
+ endpoint.get("AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, "3600",
"2011-06-15", null));
assertEquals(500, ex.getHttpCode());
verify(auditLogger).logWriteFailure(any(AuditMessage.class));
@@ -722,7 +821,7 @@ public void testStsAccessDenied() throws Exception {
.thenThrow(new OMException("Permission denied",
OMException.ResultCodes.ACCESS_DENIED));
final OSTSException ex = assertThrows(OSTSException.class, () ->
- endpoint.get("AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, 3600,
"2011-06-15", null));
+ endpoint.get("AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, "3600",
"2011-06-15", null));
assertEquals(403, ex.getHttpCode());
verify(auditLogger).logWriteFailure(any(AuditMessage.class));
@@ -739,7 +838,7 @@ public void
testStsUnsupportedOperationWhenBackendThrowsNotSupportedOperation()
.thenThrow(new OMException("Operation is not supported",
OMException.ResultCodes.NOT_SUPPORTED_OPERATION));
final OSTSException ex = assertThrows(OSTSException.class, () ->
- endpoint.get("AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, 3600,
"2011-06-15", null));
+ endpoint.get("AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, "3600",
"2011-06-15", null));
assertEquals(501, ex.getHttpCode());
verify(auditLogger).logWriteFailure(any(AuditMessage.class));
@@ -755,7 +854,7 @@ public void
testStsUnsupportedOperationWhenBackendThrowsFeatureNotEnabled() thro
.thenThrow(new OMException("Feature is not enabled",
OMException.ResultCodes.FEATURE_NOT_ENABLED));
final OSTSException ex = assertThrows(OSTSException.class, () ->
- endpoint.get("AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, 3600,
"2011-06-15", null));
+ endpoint.get("AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, "3600",
"2011-06-15", null));
assertEquals(501, ex.getHttpCode());
verify(auditLogger).logWriteFailure(any(AuditMessage.class));
@@ -771,7 +870,7 @@ public void
testStsValidationErrorWhenBackendThrowsInvalidRequest() throws Excep
.thenThrow(new OMException("Invalid request parameter",
OMException.ResultCodes.INVALID_REQUEST));
final OSTSException ex = assertThrows(OSTSException.class, () ->
- endpoint.get("AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, 3600,
"2011-06-15", null));
+ endpoint.get("AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, "3600",
"2011-06-15", null));
assertEquals(400, ex.getHttpCode());
verify(auditLogger).logWriteFailure(any(AuditMessage.class));
@@ -787,7 +886,7 @@ public void
testStsMalformedPolicyDocumentWhenBackendThrowsMalformedPolicyDocume
.thenThrow(new OMException("Malformed session policy",
OMException.ResultCodes.MALFORMED_POLICY_DOCUMENT));
final OSTSException ex = assertThrows(OSTSException.class, () ->
- endpoint.get("AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, 3600,
"2011-06-15", null));
+ endpoint.get("AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, "3600",
"2011-06-15", null));
assertEquals(400, ex.getHttpCode());
verify(auditLogger).logWriteFailure(any(AuditMessage.class));
@@ -804,7 +903,7 @@ public void testStsIOExceptionWrappedAsInternalFailure()
throws Exception {
.thenThrow(new IOException("An IO error occurred"));
final OSTSException ex = assertThrows(OSTSException.class, () ->
- endpoint.get("AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, 3600,
"2011-06-15", null));
+ endpoint.get("AssumeRole", ROLE_ARN, ROLE_SESSION_NAME, "3600",
"2011-06-15", null));
assertEquals(500, ex.getHttpCode());
verify(auditLogger).logWriteFailure(any(AuditMessage.class));
@@ -818,7 +917,7 @@ public void testStsIOExceptionWrappedAsInternalFailure()
throws Exception {
public void testStsMultipleValidationErrors() throws Exception {
final String invalidRoleSessionName = "test/session";
final String tooLargePolicy =
RandomStringUtils.insecure().nextAlphanumeric(2049);
- final int invalidDurationSeconds = -1;
+ final String invalidDurationSeconds = "-1";
final OSTSException ex = assertThrows(OSTSException.class, () ->
endpoint.get("AssumeRole", ROLE_ARN, invalidRoleSessionName,
invalidDurationSeconds, "2011-06-15",
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
