Single sign-on with the AWS SDK for .NET

At a high level, SDKs interact with IAM Identity Center in a manner similar to the following pattern:

This section shows you how to create a .NET application that generates a temporary SSO token, if necessary, and then uses that token. For a full tutorial of this process, see Tutorial for SSO using only .NET applications.

Generate and use an SSO token programmatically

In addition to using the AWS CLI, you can also generate an SSO token programmatically.

To do this, your application creates an AWSCredentials object for the SSO profile, which loads temporary credentials if any are available. Then, your application must cast the AWSCredentials object to an SSOAWSCredentials object and set some Options properties, including a callback method that is used to prompt the user for sign-in information, if necessary.

This method is shown in the following code snippet.

static AWSCredentials LoadSsoCredentials()
{
    var chain = new CredentialProfileStoreChain();
    if (!chain.TryGetAWSCredentials("my-sso-profile", out var credentials))
        throw new Exception("Failed to find the my-sso-profile profile");

    var ssoCredentials = credentials as SSOAWSCredentials;

    ssoCredentials.Options.ClientName = "Example-SSO-App";
    ssoCredentials.Options.SsoVerificationCallback = args =>
    {
        // Launch a browser window that prompts the SSO user to complete an SSO sign-in.
        // This method is only invoked if the session doesn't already have a valid SSO token.
        // NOTE: Process.Start might not support launching a browser on macOS or Linux. If not,
        //       use an appropriate mechanism on those systems instead.
        Process.Start(new ProcessStartInfo
        {
            FileName = args.VerificationUriComplete,
            UseShellExecute = true
        });
    };

    return ssoCredentials;
}

If an appropriate SSO token isn't available, the default browser window is launched and the appropriate sign-in page is opened. For example, if you’re using IAM Identity Center as the Identity source, the user sees a sign-in page similar to the following:

Tutorial for SSO using only .NET applications

This section shows you how to generate a temporary SSO token by using the AWS CLI, and how to use that token in an application. For a full tutorial of this process, see Tutorial for SSO using the AWS CLI and .NET applications.

Generate an SSO token by using the AWS CLI

In addition to generating a temporary SSO token programmatically, you use the AWS CLI to generate the token. The following information shows you how.

After the user creates an SSO-enabled profile as shown in a previous section, they run the aws sso login command from the AWS CLI. They must be sure to include the --profile parameter with the name of the SSO-enabled profile. This is shown in the following example:

aws sso login --profile my-sso-profile

If the user wants to generate a new temporary token after the current one expires, they can run the same command again.

Use the generated SSO token in a .NET application

The following information shows you how to use a temporary token that has already been generated.

Your application creates an AWSCredentials object for the SSO profile, which loads the temporary credentials generated earlier by the AWS CLI. This is similar to the methods shown in Accessing credentials and profiles in an application and has the following form:

static AWSCredentials LoadSsoCredentials()
{
    var chain = new CredentialProfileStoreChain();
    if (!chain.TryGetAWSCredentials("my-sso-profile", out var credentials))
        throw new Exception("Failed to find the my-sso-profile profile");

    return credentials;
}

The AWSCredentials object is then passed to the constructor for a service client. For example:

var S3Client_SSO = new AmazonS3Client(LoadSsoCredentials());

Tutorial for SSO using the AWS CLI and .NET applications