Skip to content

feat: add AWS STS JWT federation provider via GetWebIdentityToken#172

Open
Turtdle wants to merge 1 commit into
developfrom
aws-sts-jwt
Open

feat: add AWS STS JWT federation provider via GetWebIdentityToken#172
Turtdle wants to merge 1 commit into
developfrom
aws-sts-jwt

Conversation

@Turtdle
Copy link
Copy Markdown
Collaborator

@Turtdle Turtdle commented May 11, 2026

No description provided.

Adds a new federation provider that uses AWS IAM outbound identity
federation to obtain a standard OIDC JWT from STS, enabling workloads
to authenticate to Britive without SigV4 signing complexity.
@Turtdle
Copy link
Copy Markdown
Collaborator Author

Turtdle commented May 11, 2026

tested with aws lambda:

import boto3
from britive.britive import Britive


def lambda_handler(event, context):
    sts_client = boto3.client('sts')

    response = sts_client.get_web_identity_token(
        Audience=['britive'],
        DurationSeconds=300,
        SigningAlgorithm='ES384',
    )

    token = f'OIDC::{response["WebIdentityToken"]}'

    b = Britive(tenant='<tenant>', token=token)
    me = b.my_access.whoami()

    return {
        'statusCode': 200,
        'body': json.dumps({
            'authenticated_as': me['username'],
            'user_id': me['userId'],
        }),
    }
    
    ### returns ###
    
    {
  "userId": "<id>",
  "username": "aws-sts-jwt-test",
  "type": "UI",
  "user": {
    "status": "active",
    "type": "ServiceIdentity",
    "name": "aws-sts-jwt-test",
    "lastLogin": "2026-05-11T20:35:46Z",
    "userId": "<id>",
    "attributes": [
      {
        "attributeValue": "<arn>",
        "attributeId": "<id>"
      }
    ],
    ...
  }
}

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant