Add Support for Multiple Auth Schemes and SigV4a #3999

AlexDaines · 2025-09-04T16:30:42Z

Description

Implements multi-auth scheme support. This enables clients to configure and prioritize the available authentication schemes (SigV4, SigV4a, Bearer, NoAuth) through multiple configuration sources.

Key changes made:

Added AuthScheme, AuthSchemePreference, and resolver infrastructure
Implemented configuration hierarchy: client > env vars > config file > global
Added SigV4a region set configuration support
Preserved backwards compatibility via extension methods pattern (no breaking interface changes)
Added comprehensive test coverage

Motivation and Context

Required for upcoming SigV4a adoption and services that need flexible auth scheme selection. Several teams have been waiting on this capability for cross-region signing and failover scenarios.

Testing

.NET Dryrun Build ID: 845e71d4-3ab2-4488-ad9d-9cf0365df798
PS Dryrun Build ID: d483576d-fb7d-436c-acb8-ef12dbfdbdce

Types of changes

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to change)

Checklist

My code follows the code style of this project
My change requires a change to the documentation
I have updated the documentation accordingly
I have read the README document
I have added tests to cover my changes
All new and existing tests passed

License

I confirm that this pull request can be released under the Apache 2 license

Copilot

Pull Request Overview

This PR implements comprehensive multi-authentication scheme support for the AWS .NET SDK, enabling flexible authentication scheme configuration and prioritization with SigV4a region set support. The implementation introduces new configuration options while maintaining backwards compatibility with existing SignatureMethod patterns.

Key changes include:

Added authentication scheme preference configuration with multiple sources (client, environment, config file, global)
Implemented SigV4a region set configuration support
Created comprehensive resolver infrastructure for authentication scheme prioritization

Reviewed Changes

Copilot reviewed 26 out of 26 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
sdk/test/UnitTests/Custom/Runtime/SigV4aRegionSetConfigurationTests.cs	Comprehensive test coverage for SigV4a region set configuration including validation, parsing, and source precedence
sdk/test/UnitTests/Custom/Runtime/AuthSchemeTests.cs	Unit tests for AuthScheme class covering predefined schemes, equality, and validation
sdk/test/UnitTests/Custom/Runtime/AuthSchemeResolverTests.cs	Tests for DefaultAuthSchemeResolver including preference application and configuration hierarchy
sdk/test/UnitTests/Custom/Runtime/AuthSchemePreferenceTests.cs	Test coverage for AuthSchemePreference parsing, validation, and case-sensitive matching
sdk/test/UnitTests/Custom/Runtime/AuthSchemeIntegrationTests.cs	Integration tests for auth scheme preference application in BaseAuthResolverHandler
sdk/test/UnitTests/Custom/Runtime/AuthSchemeIntegrationSimpleTests.cs	Basic integration tests for AuthSchemeOption constants and simple resolver functionality
sdk/test/UnitTests/Custom/Runtime/AuthSchemeConfigurationTests.cs	Tests for configuration resolution from environment variables and global settings
sdk/test/UnitTests/Custom/Runtime/AuthSchemeBackwardsCompatibilityTests.cs	Backwards compatibility tests ensuring legacy SignatureMethod behavior is preserved
sdk/test/NetStandard/UnitTests/ClientConfigTests.cs	Updated client config property list to include new authentication scheme properties
sdk/src/Core/Amazon.Util/Internal/RootConfig.cs	Added AuthSchemePreference and SigV4aRegionSetConfiguration to root configuration
sdk/src/Core/Amazon.Runtime/SigV4aRegionSetConfiguration.cs	Implementation of SigV4a region set configuration with multiple source support
sdk/src/Core/Amazon.Runtime/Pipeline/Handlers/BaseAuthResolverHandler.cs	Enhanced auth resolution with preference application and scheme conversion logic
sdk/src/Core/Amazon.Runtime/Internal/Util/SafeConfigurationResolver.cs	Utility for safe configuration resolution with consistent error handling
sdk/src/Core/Amazon.Runtime/Internal/Util/HashCodeHelper.cs	Helper utility for consistent hash code generation across SDK types
sdk/src/Core/Amazon.Runtime/Internal/Settings/SettingsConstants.cs	Added constants for new authentication scheme configuration keys
sdk/src/Core/Amazon.Runtime/IClientConfig.cs	Interface updates to accommodate new authentication scheme properties
sdk/src/Core/Amazon.Runtime/IAuthSchemeResolver.cs	Interface definition for authentication scheme resolution
sdk/src/Core/Amazon.Runtime/EnvironmentConfigurationProvider.cs	Provider for reading authentication scheme configuration from environment variables
sdk/src/Core/Amazon.Runtime/DefaultAuthSchemeResolver.cs	Default implementation of auth scheme resolution with preference-based prioritization
sdk/src/Core/Amazon.Runtime/ClientConfigExtensions.cs	Extension methods for backwards-compatible access to new authentication properties
sdk/src/Core/Amazon.Runtime/ClientConfig.cs	Updated ClientConfig with new authentication scheme properties and legacy compatibility tracking
sdk/src/Core/Amazon.Runtime/AuthSchemePreference.cs	Implementation of authentication scheme preference list with parsing and validation
sdk/src/Core/Amazon.Runtime/AuthSchemeConfigurationResolver.cs	Central resolver for authentication scheme configuration with precedence hierarchy
sdk/src/Core/Amazon.Runtime/AuthScheme.cs	Core AuthScheme class with predefined schemes and equality implementation
sdk/src/Core/AWSConfigs.cs	Global configuration properties for authentication scheme preferences and SigV4a region sets
generator/.DevConfigs/3aa6313d-9526-40ba-b09c-e046e0d4ef2f.json	Development configuration for minor version release with detailed changelog

sdk/src/Core/Amazon.Runtime/AuthScheme.cs

Copilot

Pull Request Overview

Copilot reviewed 15 out of 15 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

generator/.DevConfigs/3aa6313d-9526-40ba-b09c-e046e0d4ef2f.json:10

The dev config correctly specifies a minor version bump for this new feature addition, which aligns with the non-breaking nature of the changes.

    "type": "minor",

sdk/src/Core/Amazon.Runtime/Pipeline/Handlers/BaseAuthResolverHandler.cs

sdk/src/Core/Amazon.Runtime/ClientConfig.cs

sdk/src/Core/Amazon.Runtime/ClientConfigExtensions.cs

Copilot

Pull Request Overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated 1 comment.

sdk/src/Core/Amazon.Runtime/Pipeline/Handlers/BaseAuthResolverHandler.cs

Copilot

Pull Request Overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated 3 comments.

Copilot · 2025-09-16T17:07:36Z

sdk/test/UnitTests/Custom/Runtime/AuthSchemeIntegrationTests.cs

+                new AuthSchemeOption { SchemeId = AuthSchemeOption.SigV4A }
+            };
+            Environment.SetEnvironmentVariable("AWS_AUTH_SCHEME_PREFERENCE", "sigv4a,sigv4");
+            Amazon.Runtime.Internal.FallbackInternalConfigurationFactory.Reset(); // Reset to pick up new env var


The call to FallbackInternalConfigurationFactory.Reset() is duplicated across multiple test methods. Consider extracting this to a helper method or including it in TestInitialize to reduce code duplication and improve maintainability.

Copilot · 2025-09-16T17:07:37Z

sdk/src/Core/Amazon.Runtime/Pipeline/Handlers/BaseAuthResolverHandler.cs

+            catch (ArgumentException ex)
+            {
+                Logger.Error(ex, "Failed to apply auth scheme preferences due to invalid argument, falling back to service-defined order");
+                return authOptions;
+            }
+            catch (InvalidOperationException ex)
+            {
+                Logger.Error(ex, "Failed to apply auth scheme preferences due to invalid operation, falling back to service-defined order");
+                return authOptions;
+            }


The exception handling blocks have identical behavior and nearly identical error messages. Consider consolidating into a single catch block for Exception with a generic error message, or use a helper method to reduce code duplication.

Suggested change

catch (ArgumentException ex)

{

Logger.Error(ex, "Failed to apply auth scheme preferences due to invalid argument, falling back to service-defined order");

return authOptions;

}

catch (InvalidOperationException ex)

{

Logger.Error(ex, "Failed to apply auth scheme preferences due to invalid operation, falling back to service-defined order");

return authOptions;

}

catch (Exception ex)

{

Logger.Error(ex, "Failed to apply auth scheme preferences, falling back to service-defined order");

return authOptions;

}

Copilot · 2025-09-16T17:07:37Z

sdk/src/Core/Amazon.Runtime/Credentials/Internal/AuthSchemeOption.cs

+            var parts = schemeId.Split('#');
+            return parts.Length > 1 ? parts[1] : schemeId;


The Split('#') operation allocates a new array on each call. For better performance, consider using string.IndexOf('#') and string.Substring() to extract the portion after '#' without array allocation, especially since this method may be called frequently during auth scheme resolution.

Suggested change

var parts = schemeId.Split('#');

return parts.Length > 1 ? parts[1] : schemeId;

int hashIndex = schemeId.IndexOf('#');

return hashIndex >= 0 && hashIndex < schemeId.Length - 1

? schemeId.Substring(hashIndex + 1)

: schemeId;

This seems like a good suggestion to accept.

dscpinheiro · 2025-09-16T22:21:08Z

sdk/src/Core/Amazon.Runtime/Internal/InternalConfiguration.cs

+        /// <summary>
+        /// Gets a simple string value from an environment variable.
+        /// </summary>
+        private string GetStringEnvironmentVariable(string name)


Does the SEP say anything about trimming the value? There's already a GetEnvironmentVariable<T> method that could be re-used (T for the new variable would be string).

dscpinheiro · 2025-09-16T22:22:39Z

generator/.DevConfigs/3aa6313d-9526-40ba-b09c-e046e0d4ef2f.json

+{
+  "core": {
+    "changeLogMessages": [
+      "Implement multi-auth SEP with authentication scheme preference and SigV4a region set configuration",


For the final changelog, we will want to refactor these (SEP doesn't mean anything to customers - and even internal terms like auth resolver are not relevant).

We should focus on the actual impact - e.g. ability to set SigV4A explicitly.

dscpinheiro · 2025-09-16T22:22:58Z

sdk/src/Core/Amazon.Runtime/Credentials/Internal/AuthSchemeOption.cs

+            var parts = schemeId.Split('#');
+            return parts.Length > 1 ? parts[1] : schemeId;


This seems like a good suggestion to accept.

dscpinheiro · 2025-09-16T22:29:52Z

sdk/src/Core/Amazon.Runtime/ClientConfig.cs

+        /// This is used for backwards compatibility to determine when legacy SignatureMethod configuration
+        /// should take precedence over auth scheme preferences.
+        /// </summary>
+        public bool IsSignatureMethodExplicitlySet


I don't follow why this is needed... The naming is confusing but signature method is not going to be SigV4 / SigV4A, it's this enum instead:

aws-sdk-net/sdk/src/Core/Amazon.Runtime/Enumerations.cs

Lines 24 to 28 in 0980c7c

public enum SigningAlgorithm

{

HmacSHA1,

HmacSHA256

};

dscpinheiro · 2025-09-16T22:30:19Z

sdk/src/Core/Amazon.Util/Internal/RootConfig.cs

            CorrectForClockSkew = true;
            DisableLegacyPersistenceStore = AWSConfigs._disableLegacyPersistenceStore;
+
+            // Authentication configuration is resolved on-demand from environment and config files


Out-of-place comment?

dscpinheiro · 2025-09-16T22:38:30Z

sdk/src/Core/Amazon.Runtime/Pipeline/Handlers/BaseAuthResolverHandler.cs

+            // Check for legacy SignatureMethod configuration (backwards compatibility for S3)
+            if (clientConfig?.SignatureMethod != null && clientConfig.IsSignatureMethodExplicitlySet)
+            {
+                bool isS3Service = clientConfig.ServiceId?.Equals("S3", StringComparison.OrdinalIgnoreCase) == true ||


(I left the other comment first...) I see the SEP mentions S3 (and Control) but I don't think this logic is needed here (the SEP was referring how the service model - which the auth resolvers are generated from - would keep older properties with the same values for backwards compatibility).

dscpinheiro · 2025-09-16T22:45:32Z

sdk/src/Core/Amazon.Runtime/ClientConfig.cs

+        /// endpoints metadata, or fall back to the client's configured region.
+        /// </para>
+        /// </summary>
+        public string SigV4aSigningRegionSet { get; set; }


Unless I'm missing something obvious... Where is this used? I don't see it referenced in the auth resolver handler (and also for legacy reasons, we have SigV4A logic in the endpoint resolver too...)

Copilot

Pull Request Overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated 1 comment.

sdk/src/Core/Amazon.Runtime/Pipeline/Handlers/BaseAuthResolverHandler.cs

…lti-region signing

… reference exceptions in auth resolution logging. nit: adjust comments to customer audience

Copilot

Pull Request Overview

Copilot reviewed 16 out of 16 changed files in this pull request and generated 5 comments.

generator/.DevConfigs/3aa6313d-9526-40ba-b09c-e046e0d4ef2f.json

sdk/src/Core/Amazon.Runtime/ClientConfig.cs

sdk/src/Core/Amazon.Runtime/Pipeline/Handlers/BaseAuthResolverHandler.cs

…al testing for multi-region SigV4a

Copilot

Pull Request Overview

Copilot reviewed 18 out of 18 changed files in this pull request and generated 6 comments.

Copilot · 2025-10-02T19:20:28Z

extensions/src/AWSSDK.Extensions.CrtIntegration/CrtAWS4aSigner.cs

+            {
+                regionSet = AWS4Signer.DetermineSigningRegion(clientConfig, clientConfig.RegionEndpointServiceName, request.AlternateEndpoint, request);
+            }
            request.DeterminedSigningRegion = regionSet;


DeterminedSigningRegion is documented elsewhere as a single region, but here it may be set to a multi-region list (e.g., "us-west-2,us-east-1") or "" for SigV4a. This overloads its semantics and could break downstream logic expecting a single region string. Consider (1) keeping DeterminedSigningRegion set to a primary region (first entry when list, or null for "") and/or (2) introducing a dedicated property (already adding SigV4aSigningRegionSet) and leaving DeterminedSigningRegion for single-region semantics only, plus updating any necessary docs if multi-value is intended.

Suggested change

request.DeterminedSigningRegion = regionSet;

// Set DeterminedSigningRegion to a single region (first entry if list, null if "*")

if (regionSet == "*")

{

request.DeterminedSigningRegion = null;

request.SigV4aSigningRegionSet = regionSet;

}

else if (regionSet.Contains(","))

{

var regions = regionSet.Split(',');

request.DeterminedSigningRegion = regions[0].Trim();

request.SigV4aSigningRegionSet = regionSet;

}

else

{

request.DeterminedSigningRegion = regionSet;

request.SigV4aSigningRegionSet = null;

}

This is an interesting take, I don't think we have to add another property, but we should test some requests with multiple regions and update the documentation of DeterminedSigningRegion to mention that it can be multiple regions.

Copilot · 2025-10-02T19:20:28Z

sdk/src/Core/Amazon.Runtime/Pipeline/Handlers/BaseEndpointResolver.cs

+                    // Clear AuthenticationRegion to avoid confusion with SigV4 single-region
+                    requestContext.Request.AuthenticationRegion = null;


[nitpick] Clearing AuthenticationRegion removes potentially useful endpoint metadata that other pipeline components may still rely on for diagnostics or fallback behavior. Prefer retaining the original value and relying on the newly introduced SigV4aSigningRegionSet for multi-region contexts, or only clear it after verifying no other consumers read it. If disambiguation is required, consider updating documentation instead of nulling.

Suggested change

// Clear AuthenticationRegion to avoid confusion with SigV4 single-region

requestContext.Request.AuthenticationRegion = null;

// Retain AuthenticationRegion for diagnostics/fallback; SigV4aSigningRegionSet is used for multi-region contexts.

Copilot · 2025-10-02T19:20:28Z

sdk/src/Core/Amazon.Runtime/ClientConfig.cs

+        /// <summary>
+        /// Gets and sets the SigV4aSigningRegionSet property.
+        /// A comma-separated list of regions that a SigV4a signature will be valid for.
+        /// Use "*" to indicate all regions.
+        /// </summary>
+        public string SigV4aSigningRegionSet
+        {
+            get 
+            { 
+                if (!string.IsNullOrEmpty(this.sigV4aSigningRegionSet))
+                    return this.sigV4aSigningRegionSet;
+
+                // Fallback to environment variable or config file:
+                // 1. Environment variable: AWS_SIGV4A_SIGNING_REGION_SET
+                // 2. Config file: sigv4a_signing_region_set
+                return FallbackInternalConfigurationFactory.SigV4aSigningRegionSet;
+            }
+            set { this.sigV4aSigningRegionSet = value; }
+        }


There is no integration test exercising the environment-variable or profile fallback path for SigV4aSigningRegionSet feeding into actual signed requests (x-amz-region-set header and signature variation). Current tests set the request property directly; add a test that sets AWS_SIGV4A_SIGNING_REGION_SET (and one via profile) and asserts the signer produces expected header/signature.

Copilot · 2025-10-02T19:20:29Z

sdk/src/Core/Amazon.Runtime/IClientConfig.cs

+        /// <summary>
+        /// Gets the AuthSchemePreference property.
+        /// A comma-separated list of authentication scheme names to use in order of preference.
+        /// For example: "sigv4a,sigv4" to prefer SigV4a over SigV4.
+        /// </summary>
+        string AuthSchemePreference { get; }
+
+        /// <summary>
+        /// Gets the SigV4aSigningRegionSet property.
+        /// A comma-separated list of regions that a SigV4a signature will be valid for.
+        /// Use "*" to indicate all regions.
+        /// </summary>
+        string SigV4aSigningRegionSet { get; }


[nitpick] Consider explicitly documenting the corresponding environment variables (AWS_AUTH_SCHEME_PREFERENCE, AWS_SIGV4A_SIGNING_REGION_SET) and profile keys (auth_scheme_preference, sigv4a_signing_region_set) in these summaries to improve discoverability for users configuring these options outside code.

Copilot · 2025-10-02T19:20:29Z

sdk/src/Core/Amazon.Runtime/Pipeline/Handlers/BaseAuthResolverHandler.cs

+        private static string GetFullSchemeId(string schemeName)
+        {
+            // Handle common auth scheme names (case-sensitive as per specification)
+            if (schemeName == "sigv4")
+                return "aws.auth#sigv4";
+            if (schemeName == "sigv4a")
+                return "aws.auth#sigv4a";
+            if (schemeName == "httpBearerAuth" || schemeName == "bearer")
+                return "smithy.api#httpBearerAuth";
+            if (schemeName == "noAuth")
+                return "smithy.api#noAuth";
+
+            // If it already looks like a full ID (contains #), return as-is
+            if (schemeName.Contains("#"))
+                return schemeName;
+
+            // Otherwise, assume it's an AWS auth scheme
+            return $"aws.auth#{schemeName}";
+        }


[nitpick] Preference matching is case-sensitive—user input like "SigV4A" or "SIGV4" will be silently ignored. To reduce configuration friction, consider normalizing to lower-invariant before comparisons (and documenting case sensitivity if intentionally strict).

extensions/src/AWSSDK.Extensions.CrtIntegration/CrtAWS4aSigner.cs

sdk/src/Core/Amazon.Runtime/Internal/InternalConfiguration.cs

extensions/src/AWSSDK.Extensions.CrtIntegration/CrtAWS4aSigner.cs

muhammad-othman · 2025-10-02T19:42:41Z

extensions/src/AWSSDK.Extensions.CrtIntegration/CrtAWS4aSigner.cs

-            var regionSet = overrideSigningRegion ?? AWS4Signer.DetermineSigningRegion(clientConfig, clientConfig.RegionEndpointServiceName, request.AlternateEndpoint, request);
+
+            // Use explicit override, then SigV4aSigningRegionSet, then fall back to single region
+            var regionSet = overrideSigningRegion


nit: multiple ternary operator is is bit hard to read for me, I think simple if conditions is more readable.

I actually just swapped it to be ternary because the branching looked quite messy 😅

muhammad-othman · 2025-10-02T19:44:45Z

extensions/src/AWSSDK.Extensions.CrtIntegration/CrtAWS4aSigner.cs

            {
-                // Older versions of the S3 package can be used with newer versions of Core, this guarantees no double encoding will be used.
-                // The new behavior uses endpoint resolution rules, which are not present prior to 3.7.100
+                // S3 requests require special URI encoding handling for compatibility


Multiple comments are updated in this file, is this intentional?

muhammad-othman · 2025-10-02T19:58:32Z

extensions/src/AWSSDK.Extensions.CrtIntegration/CrtAWS4aSigner.cs

+            {
+                regionSet = AWS4Signer.DetermineSigningRegion(clientConfig, clientConfig.RegionEndpointServiceName, request.AlternateEndpoint, request);
+            }
            request.DeterminedSigningRegion = regionSet;


This is an interesting take, I don't think we have to add another property, but we should test some requests with multiple regions and update the documentation of DeterminedSigningRegion to mention that it can be multiple regions.

muhammad-othman · 2025-10-02T20:06:50Z

extensions/test/CrtIntegrationTests/V4aSignerTests.cs

+        /// Creates a test request with mutable collections to verify header modifications
+        /// during signing.
+        /// </summary>
+        internal static IRequest CreateDefaultRequest(string resourcePath)


Is there a reason to create this method instead of using BuildHeaderRequestToSign?

We need the real DefaultRequest because CRT modifies the headers directly during signing. The mock version returns an immutable dictionary so the CRT can't add headers to it. The tests check that those headers actually got added to the request

The dictionary looks like a regular dictionary that the CRT can add to it.

I'm still not sure we actually need to change any tests in the extensions folder.

muhammad-othman · 2025-10-02T20:10:52Z

extensions/test/CrtIntegrationTests/V4aSignerTests.cs

+        ///
+        /// </summary>
+        [Fact]
+        public void TestMultiRegionSigV4a_DifferentialVerification()


I think we should use InlineData for the three test cases that are tested here, similar to SignRequestViaHeadersWithSigv4a

…ates

Copilot

Pull Request Overview

Copilot reviewed 20 out of 20 changed files in this pull request and generated 6 comments.

Copilot · 2025-10-02T23:45:43Z

generator/.DevConfigs/3aa6313d-9526-40ba-b09c-e046e0d4ef2f.json

+{
+  "core": {
+    "changeLogMessages": [
+      "Added ability to configure authentication scheme preferences (e.g., prioritize SigV4a over SigV4)",
+      "Added support for AWS_AUTH_SCHEME_PREFERENCE environment variable and auth_scheme_preference configuration file setting",
+      "Added support for AWS_SIGV4A_SIGNING_REGION_SET environment variable and sigv4a_signing_region_set profile key to configure SigV4a signing region set"
+    ],
+    "type": "minor",
+    "updateMinimum": true,
+    "backwardIncompatibilitiesToIgnore": [
+      "Amazon.Runtime.Internal.IRequest/MethodAbstractMethodAdded",
+      "Amazon.Runtime.IClientConfig/MethodAbstractMethodAdded",
+      "Amazon.Runtime.IRequestContext/MethodAbstractMethodAdded"
+    ]
+  }
+}


Public interface members were added (IClientConfig, IRequest, IRequestContext) which is a breaking change for any external implementers. Classifying this as a minor version while explicitly ignoring the incompatibilities does not align with the project's API compatibility guideline; either (a) avoid modifying existing public interfaces (e.g., use extension methods, wrapper abstractions, or default interface members with backward-compatible defaults if allowed), or (b) bump the version appropriately (major) instead of suppressing. Recommend reworking to preserve binary/source compatibility or reclassifying the dev config.

Copilot · 2025-10-02T23:45:44Z

sdk/src/Core/Amazon.Runtime/IClientConfig.cs

+        /// <summary>
+        /// Gets the AuthSchemePreference property.
+        /// A comma-separated list of authentication scheme names to use in order of preference.
+        /// For example: "sigv4a,sigv4" to prefer SigV4a over SigV4.
+        /// </summary>
+        string AuthSchemePreference { get; }
+
+        /// <summary>
+        /// Gets the SigV4aSigningRegionSet property.
+        /// A comma-separated list of regions that a SigV4a signature will be valid for.
+        /// Use "*" to indicate all regions.
+        /// </summary>
+        string SigV4aSigningRegionSet { get; }


Adding new members to a public interface is a breaking change for consumers implementing IClientConfig. To maintain backward compatibility per project guidelines, consider: (1) implementing these as extension methods over an internal accessor, (2) introducing a new derived interface while keeping the original stable, or (3) using default interface implementations (only if all supported target frameworks allow it) with safe defaults. Current approach requires a recompilation and will break third-party custom clients.

Copilot · 2025-10-02T23:45:44Z

sdk/src/Core/Amazon.Runtime/Internal/IRequest.cs

+        /// The signing region set to use for SigV4a requests.
+        /// Contains a comma-separated list of regions for multi-region signing.
+        /// Set from Config.SigV4aSigningRegionSet or endpoints metadata.
+        /// </summary>
+        string SigV4aSigningRegionSet { get; set; }
+
+        /// <summary>
+        /// The region or region set used for signing the service request.
+        /// For standard SigV4 signing, this contains a single region (e.g., "us-west-2").
+        /// For SigV4a multi-region signing, this can be a comma-separated list of regions (e.g., "us-west-2,us-east-1")


Adding SigV4aSigningRegionSet to IRequest is a breaking interface change. Recommend introducing this via a wrapper (e.g., an associated metadata container), an opt-in capability interface, or an extension method pattern instead of modifying an existing widely-implemented interface to preserve compatibility.

Copilot · 2025-10-02T23:45:44Z

sdk/src/Core/Amazon.Runtime/Pipeline/Contexts.cs

+
+        /// <summary>
+        /// The region set for SigV4a signing.
+        /// </summary>
+        string SigV4aSigningRegionSet { get; set; }


Adding SigV4aSigningRegionSet to IRequestContext modifies a public interface and is a breaking change. Consider an alternative (e.g., a context extension dictionary key, an auxiliary interface, or extension methods) to maintain backward compatibility.

Copilot · 2025-10-02T23:45:45Z

sdk/src/Core/Amazon.Runtime/Pipeline/Handlers/BaseAuthResolverHandler.cs

+        private static List<IAuthSchemeOption> ApplyAuthSchemePreference(List<IAuthSchemeOption> authOptions, IClientConfig clientConfig)
+        {
+            var preferenceList = clientConfig.AuthSchemePreference;
+            if (string.IsNullOrEmpty(preferenceList))
+            {
+                return authOptions;
+            }
+
+            // Parse the preference list (comma-separated, trimming spaces and tabs between names)
+            var preferences = preferenceList
+                .Split(new[] { ',' }, StringSplitOptions.RemoveEmptyEntries)
+                .Select(s => s.Trim(' ', '\t'))  // Trim spaces and tabs between auth scheme names
+                .Where(s => !string.IsNullOrEmpty(s))
+                .ToList();
+


[nitpick] Auth scheme preference parsing and reordering executes on every request; repeated string Split/Trim and list reconstruction could be avoided by caching a parsed preference list per client instance (e.g., compute once on first access or when AuthSchemePreference changes). Additionally, this private static is tested via reflection (AuthSchemePreferenceTests), which is brittle—consider making it internal and using InternalsVisibleTo for the test assembly or integrating logic into a protected virtual method so tests exercise behavior indirectly.

Suggested change

private static List<IAuthSchemeOption> ApplyAuthSchemePreference(List<IAuthSchemeOption> authOptions, IClientConfig clientConfig)

{

var preferenceList = clientConfig.AuthSchemePreference;

if (string.IsNullOrEmpty(preferenceList))

{

return authOptions;

}

// Parse the preference list (comma-separated, trimming spaces and tabs between names)

var preferences = preferenceList

.Split(new[] { ',' }, StringSplitOptions.RemoveEmptyEntries)

.Select(s => s.Trim(' ', '\t')) // Trim spaces and tabs between auth scheme names

.Where(s => !string.IsNullOrEmpty(s))

.ToList();

// Cache for parsed preference list per client config instance

private static readonly object _preferenceCacheLock = new object();

// Use a dictionary to cache parsed preferences per client config instance

private static readonly Dictionary<IClientConfig, Tuple<string, List<string>>> _preferenceCache = new Dictionary<IClientConfig, Tuple<string, List<string>>>();

/// <summary>

/// Applies the configured auth scheme preference to reorder the auth options.

/// </summary>

internal static List<IAuthSchemeOption> ApplyAuthSchemePreference(List<IAuthSchemeOption> authOptions, IClientConfig clientConfig)

{

var preferenceList = clientConfig.AuthSchemePreference;

List<string> preferences;

lock (_preferenceCacheLock)

{

if (_preferenceCache.TryGetValue(clientConfig, out var cached) && cached.Item1 == preferenceList)

{

preferences = cached.Item2;

}

else

{

if (string.IsNullOrEmpty(preferenceList))

{

preferences = new List<string>();

}

else

{

preferences = preferenceList

.Split(new[] { ',' }, StringSplitOptions.RemoveEmptyEntries)

.Select(s => s.Trim(' ', '\t'))

.Where(s => !string.IsNullOrEmpty(s))

.ToList();

}

_preferenceCache[clientConfig] = Tuple.Create(preferenceList, preferences);

}

}

Copilot · 2025-10-02T23:45:45Z

sdk/src/Core/Amazon.Runtime/Pipeline/Handlers/BaseAuthResolverHandler.cs

+                }
+            }
+
+            // CRITICAL: Ensure NoAuth/Anonymous is always last in the list.


[nitpick] Auth scheme preference parsing and reordering executes on every request; repeated string Split/Trim and list reconstruction could be avoided by caching a parsed preference list per client instance (e.g., compute once on first access or when AuthSchemePreference changes). Additionally, this private static is tested via reflection (AuthSchemePreferenceTests), which is brittle—consider making it internal and using InternalsVisibleTo for the test assembly or integrating logic into a protected virtual method so tests exercise behavior indirectly.

…figTests KNOWN_PROPERTIES

…ed for CRT compatibility

dscpinheiro · 2025-10-03T16:57:08Z

extensions/test/CrtIntegrationTests/V4aSignerTests.cs

+        /// Creates a test request with mutable collections to verify header modifications
+        /// during signing.
+        /// </summary>
+        internal static IRequest CreateDefaultRequest(string resourcePath)


I'm still not sure we actually need to change any tests in the extensions folder.

dscpinheiro · 2025-10-03T16:57:57Z

sdk/src/Core/Amazon.Runtime/Internal/DefaultRequest.cs

+        /// Contains a comma-separated list of regions for multi-region signing.
+        /// Set from Config.SigV4aSigningRegionSet or endpoints metadata.
+        /// </summary>
+        public string SigV4aSigningRegionSet { get; set; }


I don't think this is needed. We should be able to leverage the existing logic for SigV4A without adding new properties here.

dscpinheiro · 2025-10-03T16:58:29Z

sdk/src/Core/Amazon.Runtime/Pipeline/Handlers/BaseAuthResolverHandler.cs

                {
                    // Current auth scheme option is not enabled / supported, continue iterating.
-                    Logger.DebugFormat($"{authOptions[i].SchemeId} scheme is not supported for {executionContext.RequestContext.RequestName}");
+                    Logger?.DebugFormat($"{authOptions[i].SchemeId} scheme is not supported for {executionContext.RequestContext.RequestName}");


Why this change? Logger won't be null.

dscpinheiro · 2025-10-03T16:59:30Z

sdk/src/Core/Amazon.Runtime/Pipeline/Handlers/BaseAuthResolverHandler.cs

+                }
+            }
+
+            // CRITICAL: Ensure NoAuth/Anonymous is always last in the list.


I thought we discussed this, but if we didn't: This is not necessary.

dscpinheiro · 2025-10-03T17:00:38Z

sdk/src/Core/Amazon.Runtime/Pipeline/Handlers/BaseAuthResolverHandler.cs

+                return schemeName;
+
+            // Otherwise, assume it's an AWS auth scheme
+            return $"aws.auth#{schemeName}";


We should not be assuming anything here. I think the logic could be a lot simpler by comparing the scheme name from preferences with the supported value from the model.

dscpinheiro · 2025-10-03T17:01:01Z

sdk/src/Core/Amazon.Runtime/Pipeline/Handlers/BaseEndpointResolver.cs

            }
+
+            // Set SigV4a region set if configured (either from endpoint metadata or explicit config)
+            if (requestContext.Request.SignatureVersion == SignatureVersion.SigV4a)


Similar to my other comment: This should use the existing signing region set logic.

dscpinheiro · 2025-10-03T17:01:20Z

sdk/src/Core/Amazon.Runtime/Pipeline/Contexts.cs

+        /// <summary>
+        /// The region set for SigV4a signing.
+        /// </summary>
+        public string SigV4aSigningRegionSet { get; set; }


Can probably be removed too.

dscpinheiro · 2025-10-03T17:02:12Z

sdk/src/Core/Amazon.Runtime/ClientConfig.cs

+                    return this.authSchemePreference;
+
+                // Fallback to environment variable or config file:
+                // 1. Environment variable: AWS_AUTH_SCHEME_PREFERENCE


These comments are redundant. I don't expect the variable name to ever change but these comments don't add any value.

dscpinheiro · 2025-10-03T17:03:08Z

sdk/test/NetStandard/UnitTests/ClientConfigTests.cs

            "ResponseChecksumValidation",
            "IdentityResolverConfiguration",
-            "DefaultAWSCredentials"
+            "DefaultAWSCredentials",


I should've noticed this before: When this test fails, it mentions other places that should change too (e.g. AWSSDK.Extensions.NETCore.Setup - see the comment on line 97)

dscpinheiro · 2025-10-03T17:03:57Z

sdk/test/UnitTests/Custom/Runtime/AlternativeAuthResolutionTests.cs

+
+        /// <summary>
+        /// Test implementation of BaseAuthResolverHandler that provides test auth options.
+        /// This simulates how endpoints 2.0 auth schemes override service defaults.


I'm being annoying again, but EP2.0 does not matter here. All of these tests seem more redundant than anything.

AlexDaines requested a review from Copilot September 4, 2025 16:30

Copilot AI reviewed Sep 4, 2025

View reviewed changes

dscpinheiro changed the base branch from main to development September 4, 2025 16:34

dscpinheiro requested review from dscpinheiro and muhammad-othman September 4, 2025 16:36

dscpinheiro reviewed Sep 4, 2025

View reviewed changes

sdk/src/Core/Amazon.Runtime/AuthScheme.cs Outdated Show resolved Hide resolved

AlexDaines requested a review from Copilot September 12, 2025 19:19

Copilot AI reviewed Sep 12, 2025

View reviewed changes

sdk/src/Core/Amazon.Runtime/Pipeline/Handlers/BaseAuthResolverHandler.cs Outdated Show resolved Hide resolved

sdk/src/Core/Amazon.Runtime/ClientConfig.cs Outdated Show resolved Hide resolved

AlexDaines requested a review from dscpinheiro September 12, 2025 19:27

dscpinheiro reviewed Sep 12, 2025

View reviewed changes

sdk/src/Core/Amazon.Runtime/ClientConfigExtensions.cs Outdated Show resolved Hide resolved

AlexDaines requested a review from Copilot September 16, 2025 16:35

Copilot AI reviewed Sep 16, 2025

View reviewed changes

sdk/src/Core/Amazon.Runtime/Pipeline/Handlers/BaseAuthResolverHandler.cs Outdated Show resolved Hide resolved

AlexDaines force-pushed the adaines/auth-scheme branch from 5275bbd to 6291c96 Compare September 16, 2025 17:05

AlexDaines requested a review from Copilot September 16, 2025 17:06

Copilot AI reviewed Sep 16, 2025

View reviewed changes

AlexDaines requested a review from dscpinheiro September 16, 2025 18:59

dscpinheiro requested changes Sep 16, 2025

View reviewed changes

AlexDaines force-pushed the adaines/auth-scheme branch from 6291c96 to 694cfae Compare September 17, 2025 04:06

AlexDaines requested a review from Copilot September 17, 2025 04:06

Copilot AI reviewed Sep 17, 2025

View reviewed changes

sdk/src/Core/Amazon.Runtime/Pipeline/Handlers/BaseAuthResolverHandler.cs Outdated Show resolved Hide resolved

AlexDaines force-pushed the adaines/auth-scheme branch from 694cfae to 77ae30f Compare September 17, 2025 04:16

AlexDaines requested a review from dscpinheiro September 17, 2025 16:05

Add support for configurable authentication scheme preferences and mu…

5a8d2fb

…lti-region signing

AlexDaines force-pushed the adaines/auth-scheme branch from 77ae30f to 5a8d2fb Compare September 29, 2025 22:47

fix: auth scheme preference tests compilation inconsistency fix: null…

c591ddd

… reference exceptions in auth resolution logging. nit: adjust comments to customer audience

muhammad-othman requested a review from Copilot October 1, 2025 19:44

Copilot AI reviewed Oct 1, 2025

View reviewed changes

feat: use SigV4aSigningRegionSet for multi-region signing, differenti…

1201ab6

…al testing for multi-region SigV4a

muhammad-othman requested a review from Copilot October 2, 2025 19:17

Copilot AI reviewed Oct 2, 2025

View reviewed changes

muhammad-othman reviewed Oct 2, 2025

View reviewed changes

fix: PR feedback - CRT header handling, test parametrization, doc upd…

20730ab

…ates

AlexDaines requested review from Copilot and muhammad-othman October 2, 2025 23:43

Copilot AI reviewed Oct 2, 2025

View reviewed changes

AlexDaines added 3 commits October 3, 2025 02:00

fix: add AuthSchemePreference and SigV4aSigningRegionSet to ClientCon…

c33aa26

…figTests KNOWN_PROPERTIES

fix: set AuthenticationRegion when SigV4aSigningRegionSet is configur…

fb989a0

…ed for CRT compatibility

Revert comment only changes to exensions package

1490cdb

dscpinheiro requested changes Oct 3, 2025

View reviewed changes

AlexDaines added 3 commits October 3, 2025 13:30

prune redundant tests, refactor to further leverage existing auth flow

c6c4013

fix orphaned #region flag

f1cf998

feat: single parse optimization for auth configuration

baa0916

AlexDaines requested a review from dscpinheiro October 3, 2025 20:14

AlexDaines added 2 commits October 3, 2025 16:26

fix: remove unneeded auth resolution test

4659c51

fix/wip: ensure endpoint resolver respects auth scheme preference

1327bbe

		var parts = schemeId.Split('#');
		return parts.Length > 1 ? parts[1] : schemeId;

-            request.DeterminedSigningRegion = regionSet;
+            // Set DeterminedSigningRegion to a single region (first entry if list, null if "*")
+            if (regionSet == "*")
+            {
+                request.DeterminedSigningRegion = null;
+                request.SigV4aSigningRegionSet = regionSet;
+            }
+            else if (regionSet.Contains(","))
+            {
+                var regions = regionSet.Split(',');
+                request.DeterminedSigningRegion = regions[0].Trim();
+                request.SigV4aSigningRegionSet = regionSet;
+            }
+            else
+            {
+                request.DeterminedSigningRegion = regionSet;
+                request.SigV4aSigningRegionSet = null;
+            }

		// Clear AuthenticationRegion to avoid confusion with SigV4 single-region
		requestContext.Request.AuthenticationRegion = null;

	// Clear AuthenticationRegion to avoid confusion with SigV4 single-region
	requestContext.Request.AuthenticationRegion = null;
	// Retain AuthenticationRegion for diagnostics/fallback; SigV4aSigningRegionSet is used for multi-region contexts.

Add Support for Multiple Auth Schemes and SigV4a #3999

Are you sure you want to change the base?

Add Support for Multiple Auth Schemes and SigV4a #3999

Uh oh!

Conversation

AlexDaines commented Sep 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Motivation and Context

Testing

Types of changes

Checklist

License

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Copilot AI Sep 16, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 16, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Sep 16, 2025

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Copilot AI Oct 2, 2025

AlexDaines commented Sep 4, 2025 •

edited

Loading