20_federated_access/
20_federated_access.rs

1//! Federated Access
2//!
3//! This example demonstrates:
4//! - External identity federation
5//! - Federation token generation
6//! - Temporary credentials for external users
7//!
8//! Scenario: Granting temporary access to external partner.
9//!
10//! Run with: `cargo run --example 20_federated_access`
11
12use std::sync::Arc;
13use tokio::sync::RwLock;
14use wami::arn::{TenantPath, WamiArn};
15use wami::context::WamiContext;
16use wami::service::{FederationService, UserService};
17use wami::store::memory::InMemoryWamiStore;
18use wami::wami::identity::user::requests::CreateUserRequest;
19use wami::wami::sts::federation::requests::GetFederationTokenRequest;
20
21#[tokio::main]
22async fn main() -> Result<(), Box<dyn std::error::Error>> {
23    println!("=== Federated Access ===\n");
24
25    let store = Arc::new(RwLock::new(InMemoryWamiStore::default()));
26
27    // Create context
28    let context = WamiContext::builder()
29        .instance_id("123456789012")
30        .tenant_path(TenantPath::single(0))
31        .caller_arn(
32            WamiArn::builder()
33                .service(wami::arn::Service::Iam)
34                .tenant_path(TenantPath::single(0))
35                .wami_instance("123456789012")
36                .resource("user", "admin")
37                .build()?,
38        )
39        .is_root(false)
40        .build()?;
41
42    // Create admin user who will generate federation tokens
43    let user_service = UserService::new(store.clone());
44    let admin = user_service
45        .create_user(
46            &context,
47            CreateUserRequest {
48                user_name: "admin".to_string(),
49                path: Some("/".to_string()),
50                permissions_boundary: None,
51                tags: None,
52            },
53        )
54        .await?;
55
56    let fed_service = FederationService::new(store.clone());
57
58    println!("Step 1: Generating federation token for external user...\n");
59
60    let fed_req = GetFederationTokenRequest {
61        name: "partner-user".to_string(),
62        duration_seconds: Some(3600),
63        policy: Some(r#"{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:GetObject","Resource":"*"}]}"#.to_string()),
64    };
65
66    let response = fed_service
67        .get_federation_token(&context, fed_req, &admin.arn)
68        .await?;
69
70    println!("✓ Generated federation token:");
71    println!("  Federated User ARN: {}", response.federated_user.arn);
72    println!("  Access Key: {}", response.credentials.access_key_id);
73    println!("  Expiration: {}", response.credentials.expiration);
74
75    println!("\n✅ Example completed successfully!");
76    println!("Key takeaways:");
77    println!("- Federation enables external user access");
78    println!("- Temporary credentials with limited permissions");
79    println!("- Useful for partner integrations");
80
81    Ok(())
82}
20_federated_access/20_federated_access.rs

20_federated_access/
20_federated_access.rs
