Swarmauri Auth IDP AWS

AWS IAM Identity Center OAuth 2.0 / 2.1 logins packaged for Swarmauri deployments.

Features

• PKCE-enabled authorization URL generation with signed state payloads.
• Token exchange helpers that return normalized payloads for downstream services.
• Optional identity resolver that hydrates user details via AWS Identity Store.
• ComponentBase-compatible models that register under swarmauri.auth_idp entry points.
• Retry-aware HTTP client tuned for AWS IAM Identity Center endpoints.

Installation

pip

pip install swarmauri_auth_idp_aws

uv (project)

uv add swarmauri_auth_idp_aws

uv (environment)

uv pip install swarmauri_auth_idp_aws

Usage

import asyncio
from swarmauri_auth_idp_aws import AwsOAuth21Login
from pydantic import SecretStr

login = AwsOAuth21Login(
    authorization_endpoint="https://example.awsapps.com/start/oauth2/authorize",
    token_endpoint="https://example.awsapps.com/start/oauth2/token",
    client_id="client-id",
    client_secret=SecretStr("client-secret"),
    redirect_uri="https://app.example.com/callback",
    state_secret=b"aws-workforce-state-key",
)

async def flow() -> None:
    auth = await login.auth_url()
    # Redirect the user to auth["url"], then capture the returned code/state.
    print(auth["url"])

asyncio.run(flow())

Workflow Summary

1. Call auth_url() and redirect the browser to the returned URL.
2. Persist the state and compare it when handling the callback.
3. Exchange the authorization code via exchange_and_identity() to obtain tokens.
4. Optionally use AwsIdentityResolver to enrich identity details for the session.

Entry Points

• swarmauri.auth_idp:AwsOAuth20Login
• swarmauri.auth_idp:AwsOAuth21Login

Contributing

To contribute to swarmauri-sdk, review the guidelines for contributing which cover development workflow, testing, and coding standards.