SSO

Client

class SSO.Client

A low-level client representing AWS Single Sign-On (SSO)

Amazon Web Services Single Sign On Portal is a web service that makes it easy for you to assign user access to Amazon Web Services SSO resources such as the AWS access portal. Users can get Amazon Web Services account applications and roles assigned to them and get federated into the application.

Note

Although Amazon Web Services Single Sign-On was renamed, the sso and identitystore API namespaces will continue to retain their original name for backward compatibility purposes. For more information, see Amazon Web Services SSO rename .

This API reference guide describes the Amazon Web Services SSO Portal operations that you can call programatically and includes detailed information on data types and errors.

Note

Amazon Web Services provides SDKs that consist of libraries and sample code for various programming languages and platforms, such as Java, Ruby, .Net, iOS, or Android. The SDKs provide a convenient way to create programmatic access to Amazon Web Services SSO and other Amazon Web Services services. For more information about the Amazon Web Services SDKs, including how to download and install them, see Tools for Amazon Web Services .

client = session.create_client('sso')

These are the available methods:

can_paginate(operation_name)

Check if an operation can be paginated.

Parameters
operation_name (string) -- The operation name. This is the same name as the method name on the client. For example, if the method name is create_foo, and you'd normally invoke the operation as client.create_foo(**kwargs), if the create_foo operation can be paginated, you can use the call client.get_paginator("create_foo").
Returns
True if the operation can be paginated, False otherwise.
close()

Closes underlying endpoint connections.

get_paginator(operation_name)

Create a paginator for an operation.

Parameters
operation_name (string) -- The operation name. This is the same name as the method name on the client. For example, if the method name is create_foo, and you'd normally invoke the operation as client.create_foo(**kwargs), if the create_foo operation can be paginated, you can use the call client.get_paginator("create_foo").
Raises OperationNotPageableError
Raised if the operation is not pageable. You can use the client.can_paginate method to check if an operation is pageable.
Return type
L{botocore.paginate.Paginator}
Returns
A paginator object.
get_role_credentials(**kwargs)

Returns the STS short-term credentials for a given role name that is assigned to the user.

See also: AWS API Documentation

Request Syntax

response = client.get_role_credentials(
    roleName='string',
    accountId='string',
    accessToken='string'
)
Parameters
  • roleName (string) --

    [REQUIRED]

    The friendly name of the role that is assigned to the user.

  • accountId (string) --

    [REQUIRED]

    The identifier for the Amazon Web Services account that is assigned to the user.

  • accessToken (string) --

    [REQUIRED]

    The token issued by the CreateToken API call. For more information, see CreateToken in the Amazon Web Services SSO OIDC API Reference Guide .

Return type

dict

Returns

Response Syntax

{
    'roleCredentials': {
        'accessKeyId': 'string',
        'secretAccessKey': 'string',
        'sessionToken': 'string',
        'expiration': 123
    }
}

Response Structure

Exceptions

get_waiter(waiter_name)

Returns an object that can wait for some condition.

Parameters
waiter_name (str) -- The name of the waiter to get. See the waiters section of the service docs for a list of available waiters.
Returns
The specified waiter object.
Return type
botocore.waiter.Waiter
list_account_roles(**kwargs)

Lists all roles that are assigned to the user for a given Amazon Web Services account.

See also: AWS API Documentation

Request Syntax

response = client.list_account_roles(
    nextToken='string',
    maxResults=123,
    accessToken='string',
    accountId='string'
)
Parameters
  • nextToken (string) -- The page token from the previous response output when you request subsequent pages.
  • maxResults (integer) -- The number of items that clients can request per page.
  • accessToken (string) --

    [REQUIRED]

    The token issued by the CreateToken API call. For more information, see CreateToken in the Amazon Web Services SSO OIDC API Reference Guide .

  • accountId (string) --

    [REQUIRED]

    The identifier for the Amazon Web Services account that is assigned to the user.

Return type

dict

Returns

Response Syntax

{
    'nextToken': 'string',
    'roleList': [
        {
            'roleName': 'string',
            'accountId': 'string'
        },
    ]
}

Response Structure

  • (dict) --

    • nextToken (string) --

      The page token client that is used to retrieve the list of accounts.

    • roleList (list) --

      A paginated response with the list of roles and the next token if more results are available.

      • (dict) --

        Provides information about the role that is assigned to the user.

        • roleName (string) --

          The friendly name of the role that is assigned to the user.

        • accountId (string) --

          The identifier of the Amazon Web Services account assigned to the user.

Exceptions

list_accounts(**kwargs)

Lists all Amazon Web Services accounts assigned to the user. These Amazon Web Services accounts are assigned by the administrator of the account. For more information, see Assign User Access in the Amazon Web Services SSO User Guide . This operation returns a paginated response.

See also: AWS API Documentation

Request Syntax

response = client.list_accounts(
    nextToken='string',
    maxResults=123,
    accessToken='string'
)
Parameters
  • nextToken (string) -- (Optional) When requesting subsequent pages, this is the page token from the previous response output.
  • maxResults (integer) -- This is the number of items clients can request per page.
  • accessToken (string) --

    [REQUIRED]

    The token issued by the CreateToken API call. For more information, see CreateToken in the Amazon Web Services SSO OIDC API Reference Guide .

Return type

dict

Returns

Response Syntax

{
    'nextToken': 'string',
    'accountList': [
        {
            'accountId': 'string',
            'accountName': 'string',
            'emailAddress': 'string'
        },
    ]
}

Response Structure

  • (dict) --

    • nextToken (string) --

      The page token client that is used to retrieve the list of accounts.

    • accountList (list) --

      A paginated response with the list of account information and the next token if more results are available.

      • (dict) --

        Provides information about your Amazon Web Services account.

        • accountId (string) --

          The identifier of the Amazon Web Services account that is assigned to the user.

        • accountName (string) --

          The display name of the Amazon Web Services account that is assigned to the user.

        • emailAddress (string) --

          The email address of the Amazon Web Services account that is assigned to the user.

Exceptions

logout(**kwargs)

Removes the locally stored SSO tokens from the client-side cache and sends an API call to the Amazon Web Services SSO service to invalidate the corresponding server-side Amazon Web Services SSO sign in session.

Note

If a user uses Amazon Web Services SSO to access the AWS CLI, the user’s Amazon Web Services SSO sign in session is used to obtain an IAM session, as specified in the corresponding Amazon Web Services SSO permission set. More specifically, Amazon Web Services SSO assumes an IAM role in the target account on behalf of the user, and the corresponding temporary Amazon Web Services credentials are returned to the client.

After user logout, any existing IAM role sessions that were created by using Amazon Web Services SSO permission sets continue based on the duration configured in the permission set. For more information, see User authentications in the Amazon Web Services SSO User Guide .

See also: AWS API Documentation

Request Syntax

response = client.logout(
    accessToken='string'
)
Parameters
accessToken (string) --

[REQUIRED]

The token issued by the CreateToken API call. For more information, see CreateToken in the Amazon Web Services SSO OIDC API Reference Guide .

Returns
None

Exceptions

Client Exceptions

Client exceptions are available on a client instance via the exceptions property. For more detailed instructions and examples on the exact usage of client exceptions, see the error handling user guide.

The available client exceptions are:

class SSO.Client.exceptions.InvalidRequestException

Indicates that a problem occurred with the input to the request. For example, a required parameter might be missing or out of range.

Example

try:
  ...
except client.exceptions.InvalidRequestException as e:
  print(e.response)
response

The parsed error response. All exceptions have a top level Error key that provides normalized access to common exception atrributes. All other keys are specific to this service or exception class.

Syntax

{
    'message': 'string',
    'Error': {
        'Code': 'string',
        'Message': 'string'
    }
}

Structure

  • (dict) --

    Indicates that a problem occurred with the input to the request. For example, a required parameter might be missing or out of range.

    • message (string) --
    • Error (dict) -- Normalized access to common exception attributes.
      • Code (string) -- An identifier specifying the exception type.
      • Message (string) -- A descriptive message explaining why the exception occured.
class SSO.Client.exceptions.ResourceNotFoundException

The specified resource doesn't exist.

Example

try:
  ...
except client.exceptions.ResourceNotFoundException as e:
  print(e.response)
response

The parsed error response. All exceptions have a top level Error key that provides normalized access to common exception atrributes. All other keys are specific to this service or exception class.

Syntax

{
    'message': 'string',
    'Error': {
        'Code': 'string',
        'Message': 'string'
    }
}

Structure

  • (dict) --

    The specified resource doesn't exist.

    • message (string) --
    • Error (dict) -- Normalized access to common exception attributes.
      • Code (string) -- An identifier specifying the exception type.
      • Message (string) -- A descriptive message explaining why the exception occured.
class SSO.Client.exceptions.TooManyRequestsException

Indicates that the request is being made too frequently and is more than what the server can handle.

Example

try:
  ...
except client.exceptions.TooManyRequestsException as e:
  print(e.response)
response

The parsed error response. All exceptions have a top level Error key that provides normalized access to common exception atrributes. All other keys are specific to this service or exception class.

Syntax

{
    'message': 'string',
    'Error': {
        'Code': 'string',
        'Message': 'string'
    }
}

Structure

  • (dict) --

    Indicates that the request is being made too frequently and is more than what the server can handle.

    • message (string) --
    • Error (dict) -- Normalized access to common exception attributes.
      • Code (string) -- An identifier specifying the exception type.
      • Message (string) -- A descriptive message explaining why the exception occured.
class SSO.Client.exceptions.UnauthorizedException

Indicates that the request is not authorized. This can happen due to an invalid access token in the request.

Example

try:
  ...
except client.exceptions.UnauthorizedException as e:
  print(e.response)
response

The parsed error response. All exceptions have a top level Error key that provides normalized access to common exception atrributes. All other keys are specific to this service or exception class.

Syntax

{
    'message': 'string',
    'Error': {
        'Code': 'string',
        'Message': 'string'
    }
}

Structure

  • (dict) --

    Indicates that the request is not authorized. This can happen due to an invalid access token in the request.

    • message (string) --
    • Error (dict) -- Normalized access to common exception attributes.
      • Code (string) -- An identifier specifying the exception type.
      • Message (string) -- A descriptive message explaining why the exception occured.

Paginators

The available paginators are:

class SSO.Paginator.ListAccountRoles
paginator = client.get_paginator('list_account_roles')
paginate(**kwargs)

Creates an iterator that will paginate through responses from SSO.Client.list_account_roles().

See also: AWS API Documentation

Request Syntax

response_iterator = paginator.paginate(
    accessToken='string',
    accountId='string',
    PaginationConfig={
        'MaxItems': 123,
        'PageSize': 123,
        'StartingToken': 'string'
    }
)
Parameters
  • accessToken (string) --

    [REQUIRED]

    The token issued by the CreateToken API call. For more information, see CreateToken in the Amazon Web Services SSO OIDC API Reference Guide .

  • accountId (string) --

    [REQUIRED]

    The identifier for the Amazon Web Services account that is assigned to the user.

  • PaginationConfig (dict) --

    A dictionary that provides parameters to control pagination.

    • MaxItems (integer) --

      The total number of items to return. If the total number of items available is more than the value specified in max-items then a NextToken will be provided in the output that you can use to resume pagination.

    • PageSize (integer) --

      The size of each page.

    • StartingToken (string) --

      A token to specify where to start paginating. This is the NextToken from a previous response.

Return type

dict

Returns

Response Syntax

{
    'roleList': [
        {
            'roleName': 'string',
            'accountId': 'string'
        },
    ],
    'NextToken': 'string'
}

Response Structure

  • (dict) --

    • roleList (list) --

      A paginated response with the list of roles and the next token if more results are available.

      • (dict) --

        Provides information about the role that is assigned to the user.

        • roleName (string) --

          The friendly name of the role that is assigned to the user.

        • accountId (string) --

          The identifier of the Amazon Web Services account assigned to the user.

    • NextToken (string) --

      A token to resume pagination.

class SSO.Paginator.ListAccounts
paginator = client.get_paginator('list_accounts')
paginate(**kwargs)

Creates an iterator that will paginate through responses from SSO.Client.list_accounts().

See also: AWS API Documentation

Request Syntax

response_iterator = paginator.paginate(
    accessToken='string',
    PaginationConfig={
        'MaxItems': 123,
        'PageSize': 123,
        'StartingToken': 'string'
    }
)
Parameters
  • accessToken (string) --

    [REQUIRED]

    The token issued by the CreateToken API call. For more information, see CreateToken in the Amazon Web Services SSO OIDC API Reference Guide .

  • PaginationConfig (dict) --

    A dictionary that provides parameters to control pagination.

    • MaxItems (integer) --

      The total number of items to return. If the total number of items available is more than the value specified in max-items then a NextToken will be provided in the output that you can use to resume pagination.

    • PageSize (integer) --

      The size of each page.

    • StartingToken (string) --

      A token to specify where to start paginating. This is the NextToken from a previous response.

Return type

dict

Returns

Response Syntax

{
    'accountList': [
        {
            'accountId': 'string',
            'accountName': 'string',
            'emailAddress': 'string'
        },
    ],
    'NextToken': 'string'
}

Response Structure

  • (dict) --

    • accountList (list) --

      A paginated response with the list of account information and the next token if more results are available.

      • (dict) --

        Provides information about your Amazon Web Services account.

        • accountId (string) --

          The identifier of the Amazon Web Services account that is assigned to the user.

        • accountName (string) --

          The display name of the Amazon Web Services account that is assigned to the user.

        • emailAddress (string) --

          The email address of the Amazon Web Services account that is assigned to the user.

    • NextToken (string) --

      A token to resume pagination.