@aws-sdk/credential-providers: SSO Auth doesn't work if sso-session contains a space

[cwangsmv]

Checkboxes for prior research

• I've gone through Developer Guide and API reference
• I've checked AWS Forums and StackOverflow.
• I've searched for previous similar issues and didn't find any solution.

Describe the bug

When using AWS js sdk with white space in sso_session, it will fail and throws Cannot read properties of undefined (reading 'sso_region') exception.

Regression Issue

• Select this option if this issue appears to be a regression.

SDK version number

@aws-sdk/credential-providers

Which JavaScript Runtime is this issue in?

Node.js

Details of the browser/Node.js/ReactNative version

node v22.14.0

Reproduction Steps

AWS Config file:

[profile user-xxx]
sso_session = test sso
...
[sso-session 'test sso']
...

Using this SSO credential file in JS SDK will throws Cannot read properties of undefined (reading 'sso_region') exception

const credentials = fromSSO({
  profile: "user-xxx",
});
const stsClient = new STSClient({
  region: "ap-southeast-2",
  credentials,
});
const response = await stsClient.send(new GetCallerIdentityCommand({}));

But this config is working well with AWS CLI

Observed Behavior

It should be worked like AWS CLI

Expected Behavior

Using this SSO credential file in JS SDK will throws Cannot read properties of undefined (reading 'sso_region') exception

Possible Solution

No response

Additional Information/Context

No response

[aBurmeseDev]

Hi @cwangsmv - thanks for reaching out.

Checking with other SDKs and internal specifications, whitespace isn't technically allowed in SSO session names. Upon further checking, CLI also ensure that SSO Session name doesn't contain space. See their code: https://github.com/aws/aws-cli/blob/dc53215d2b2eae803907dbd19e22836ec2c26d38/awscli/customizations/configure/sso.py#L209-L228

According to the exception, sso_region should work since it's got underscore. Do you mind sharing what your full config file looks like and full logs to help us get more idea on the behavior?

[Eug92100]

Hey @cwangsmv ,
Thank you ! I was getting the following error in the app i'm building because of this :

TypeError: Cannot read properties of undefined (reading 'sso_region')

But I was able to connect through CLI but was breaking when I was running the app locally

I configured my sso profile through the CLI. No mention of whitespace

[cwangsmv]

Hi @cwangsmv - thanks for reaching out.

Checking with other SDKs and internal specifications, whitespace isn't technically allowed in SSO session names. Upon further checking, CLI also ensure that SSO Session name doesn't contain space. See their code: https://github.com/aws/aws-cli/blob/dc53215d2b2eae803907dbd19e22836ec2c26d38/awscli/customizations/configure/sso.py#L209-L228

According to the exception, sso_region should work since it's got underscore. Do you mind sharing what your full config file looks like and full logs to help us get more idea on the behavior?

@aBurmeseDev Here's the full command I am using and the reproduce code:

The AWS CLI version is: aws-cli/2.24.4 Python/3.12.6 Darwin/23.6.0 exe/x86_64
Using AWS CLI to configure sso (It will allow session name with whitespace)
aws configure sso

SSO session name (Recommended): Test SSO
SSO start URL [None]: https://<id>.awsapps.com/start/#
SSO region [None]: us-east-1
SSO registration scopes [sso:account:access]:
Attempting to automatically open the SSO authorization page in your default browser.

After successfully open the SSO authorization page in my browser. It will generate the following config file

[profile poweruser-1357890]
sso_session = Test SSO
sso_account_id = <sso_account_id>
sso_role_name = <sso_role_name>
[sso-session 'Test SSO']
sso_start_url = https://<id>.awsapps.com/start/#
sso_region = us-east-1
sso_registration_scopes = sso:account:access

This is the full code using AWS JS SDK to reproduce the issue:

import { GetCallerIdentityCommand, STSClient } from "@aws-sdk/client-sts";
import { fromSSO } from "@aws-sdk/credential-providers";

async function main() {
  try {
    console.log("Configuring AWS credentials using SSO...");

    // Configure credentials using SSO
    const credentials = fromSSO({
      profile: "poweruser-1357890",
    });

    const stsClient = new STSClient({
      region: "us-east-1",
      credentials,
    });

    const response = await stsClient.send(new GetCallerIdentityCommand({}));
    console.log(` Successfully configured AWS credentials using SSO. ${JSON.stringify(response)}`);
    return {
      success: true,
      result: response,
    };
  } catch (error) {
    console.error("Error:", error);
  }
}

// Run the main function
main().catch(console.error);

Execute the following code in Node will throw the exception

Error: TypeError: Cannot read properties of undefined (reading 'sso_region')
    at /Users/github/aws-reproduce/node_modules/@aws-sdk/credential-provider-sso/dist-cjs/index.js:202:36
    at async coalesceProvider (/Users/github/aws-reproduce/node_modules/@smithy/core/dist-cjs/index.js:394:18)
    at async /Users/github/aws-reproduce/node_modules/@smithy/core/dist-cjs/index.js:412:18
    at async /Users/github/aws-reproduce/node_modules/@smithy/core/dist-cjs/index.js:111:17
    at async /Users/github/aws-reproduce/node_modules/@aws-sdk/middleware-logger/dist-cjs/index.js:33:22
    at async main (file:///Users/github/aws-reproduce/index.js:18:22)

But I was able to connect to aws services using AWS CLI without any exceptions

[smilkuri]

@cwangsmv Even though the CLI supports this format, JS (and other SDKs) are following this specification https://docs.aws.amazon.com/sdkref/latest/guide/file-format.html

A section definition is a line that applies a name to a collection of settings. Section definition lines start and end with square brackets ([ ]). Inside the brackets, there is a section type identifier and a custom name for the section. You can use letters, numbers, hyphens (-), and underscores (_), but no spaces.

[cwangsmv]

@smilkuri Thanks for the feedback. So for SDKs, the section name contains white space is not valid.

[github-actions]

This issue is now closed. Comments on closed issues are hard for our team to see.
If you need more assistance, please open a new issue that references this one.

[github-actions]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs and link to relevant comments in this thread.