Does AWS Identity Management have the concept of on-behalf-of tokens when authenticating to APIs "on behalf of" a user? I thought that this was a key part of the OAuth2.0 protocol. I can't find any resources on this in any of AWS docs. If one uses AWS IAM with, say, lambdas, is this taken care of for you? (that is, safely authenticating from service to service with tokens)
AWS IAM on-behalf-of flow Oauth2.0
153 Views Asked by Daniel At
1
There are 1 best solutions below
Related Questions in AMAZON-WEB-SERVICES
- S3 integration testing
- How to get content of BLOCK types LAYOUT_TITLE, LAYOUT_SECTION_HEADER and LAYOUT_xx in Textract
- Error **net::ERR_CONNECTION_RESET** error while uploading files to AWS S3 using multipart upload and Pre-Signed URL
- Failed to connect to your instance after deploying mern app on aws ec2 instance when i try to access frontend
- AWS - Tab Schema Conversion don't show up after creating a Migration Project
- Unable to run Bash Script using AWS Custom Lambda Runtime
- Using Amazon managed Prometheus to get EC2 metrics data in Grafana
- AWS Dns record A not navigate to elb
- Connection timed out error with smtp.gmail.com
- AWS Cognito Multi-tenant Integration | Ok to use Client’s Idp?
- Elasticbeanstalk FastAPI application is intermittently not responding to https requests
- Call an External API from AWS Lambda
- Why my mail service api spring isnt working?
- export 'AWSIoTProvider' (imported as 'AWSIoTProvider') was not found in '@aws-amplify/pubsub'
- How to take first x seconds of Audio from a wav file read from AWS S3 as binary stream using Python?
Related Questions in AWS-LAMBDA
- Query parameter works fine with fastapi application when tested locally but not working when the FastAPI application is deployed on AWS lambda
- Lambda endpoint for the Google OAuth callback does not recieve the access_token
- Golang lambda upload image into s3 static website
- Unable to run Bash Script using AWS Custom Lambda Runtime
- Call an External API from AWS Lambda
- AWS Lambda Trigger For Same S3 File Name In Quick Succession
- Trouble Extracting Request Body in Flask-Lambda Application Deployed on AWS Lambda via AWS SAM
- S3 pre-signed url not working on whatsapp cloud Api
- 'Load failed' error when trying to create a function in AWS lambda
- Using Python CDK to bundle dotnet 8 code to AWS Lambda function
- AWS WebSocket API return forbidden (403) error when sending message
- Pass integer value in json serializable Python Object
- AWS Lambda successfully called with 'Function URL', but not with 'API Gateway'
- How do I create a *clean* AWS lambda function in python?
- Laravel Vapor Queue Dynamic DB Connection Issue for Different Requests
Related Questions in OAUTH-2.0
- discord.py - Oauth2 - join user to guild
- Implementing Incremental consent when using both application and delegated permissions
- Verifying Google Identity OAuth2 token with Ruby
- spring security error Caused by: org.attoparser.ParseException: Exception evaluating SpringEL expression: s
- Encountering HttpError 403 and 500 When Using Google Sheets API with Service Account
- get refresh token in axios interceptor
- spring error exception with oauth2 and securityconfig
- What oauth 2.0 endpoint is used to validate a bearer token
- Not enough permissions to access API request https://api.linkedin.com/v2/me
- How to specify the client ID and redirect URI in Swagger OAuth2.0 configuration for Swagger UI?
- OAuth2 PHP change invalid_token response
- Call Databricks API from an ASP.NET Core web application
- Secure to share Access Token over public API using CORs?
- How to use Oauth in order to log‑in on .googleapis.com on almost any arbitrary endpoints domains from the web browser?
- OAuth access token attribute based reverse proxying of http ressources
Related Questions in OAUTH
- Lambda endpoint for the Google OAuth callback does not recieve the access_token
- Miro oauth api throws error 401 Invalid authorization code
- Error from Identity Provider - OIDC Scope Error
- get refresh token in axios interceptor
- How would single sign-on work for my multi-tenant application?
- How to get OAuth2 Access token from Postman
- How to use Oauth in order to log‑in on .googleapis.com on almost any arbitrary endpoints domains from the web browser?
- How to fix common 500 internal server error when use POST method on NEXTJS
- How to use a different account for OAuth with dbt-core and profiles.yml?
- ASP.NET Core Google external login issue
- Implementing IDP Initiated Flow Using OIDC
- Migration of UseOAuthAuthorizationServer from .Net Framework to .Net8
- Django Allauth Bad Request Error, Error Retrieving Access Token: Invalid Grant
- angular oauth 2 oidc doesn't work with github idp
- Handling oauth in flutter app without browser
Related Questions in ON-BEHALF-OF
- Outlook authentication with new MSAL library authorization code flow, On behalf of
- Unable to use multiple audiences in OBO flow calling MS Graph
- Azure Active Directory Error - Application is not authorized to make application on-behalf-of calls
- On-behalf-of flow failing with downstream API's using Microsoft.Identity.Web
- AWS IAM on-behalf-of flow Oauth2.0
- Why am i getting an invalid access token from On-behalf-of-flow
- how to handle the scenario web api 1 calling web api 2 while azure b2c doesn't support "on behalf of"
- (.NET Core & AzureAd) How to keep user-context in long running process for calling downstream API
- Azure AD on-behalf-of for service principal
- Microsoft.Identity.Client AcquireTokenOnBehalfOf doesn't get token from cache
- Azure DEVOPS make pull request using on-behalf-of flow
- Efficiently working with On-Behalf Of access tokens in an ASP.NET Core application
Trending Questions
- UIImageView Frame Doesn't Reflect Constraints
- Is it possible to use adb commands to click on a view by finding its ID?
- How to create a new web character symbol recognizable by html/javascript?
- Why isn't my CSS3 animation smooth in Google Chrome (but very smooth on other browsers)?
- Heap Gives Page Fault
- Connect ffmpeg to Visual Studio 2008
- Both Object- and ValueAnimator jumps when Duration is set above API LvL 24
- How to avoid default initialization of objects in std::vector?
- second argument of the command line arguments in a format other than char** argv or char* argv[]
- How to improve efficiency of algorithm which generates next lexicographic permutation?
- Navigating to the another actvity app getting crash in android
- How to read the particular message format in android and store in sqlite database?
- Resetting inventory status after order is cancelled
- Efficiently compute powers of X in SSE/AVX
- Insert into an external database using ajax and php : POST 500 (Internal Server Error)
Popular Questions
- How do I undo the most recent local commits in Git?
- How can I remove a specific item from an array in JavaScript?
- How do I delete a Git branch locally and remotely?
- Find all files containing a specific text (string) on Linux?
- How do I revert a Git repository to a previous commit?
- How do I create an HTML button that acts like a link?
- How do I check out a remote Git branch?
- How do I force "git pull" to overwrite local files?
- How do I list all files of a directory?
- How to check whether a string contains a substring in JavaScript?
- How do I redirect to another webpage?
- How can I iterate over rows in a Pandas DataFrame?
- How do I convert a String to an int in Java?
- Does Python have a string 'contains' substring method?
- How do I check if a string contains a specific word?
Microsoft's on behalf of flow is based on user assertions, which are defined in RFC7523. This is an extension to the core OAuth 2 0 specification. AWS Cognito does not currently support this standard.
A more common technique is to simply forward JWT access tokens between APIs. Each API then checks for the expected issuer and audience, and also its required scopes.
With lambdas this is not taken care of, since AWS serverless tech only validates access tokens in the AWS API gateway. As an alternative option it is possible to follow a zero trust model within each lambda, using a JWT library, eg in a middleware class. My code example shows one way to do this.