Move auth scheme resolution to pipeline stage from interceptors by S-Saranya1 · Pull Request #6755 · aws/aws-sdk-java-v2

S-Saranya1 · 2026-02-26T16:55:49Z

Migrate identity resolution from interceptor to pipeline stage

Note: This PR targets a feature branch. Some tests are failing due to endpoint resolution happening before auth scheme resolution in the pipeline unlike before. This will be addressed in Part 2 (Endpoint Resolution Refactoring).

Motivation and Context

The SDK used ExecutionInterceptor for internal auth scheme resolution logic, but this interface was designed for customer extensibility. The AuthSchemeInterceptor.beforeExecution() resolved identity before customer interceptors ran modifyRequest(), causing credential overrides to be ignored. This refactoring moves
identity resolution to a new AuthSchemeResolutionStage in the request pipeline that runs after all interceptors complete, ensuring credentials injected by users are
respected.

Modifications

Added AuthSchemeResolutionStage / AsyncAuthSchemeResolutionStage (runs after interceptors complete)
Created IdentityProviderUpdater interface for credential override callback
Generate resolveAuthSchemeOptions() in client classes, pass options via ClientExecutionParams
Migrated business metrics (SIGV4A_SIGNING, BEARER_SERVICE_ENV_VARS) to AwsExecutionContextBuilder
Updated S3 presigner for endpoint-based auth provider

Testing

Existing tests - Verified existing auth tests in codegen-generated-classes-test are passing after refactoring .
IdentityResolutionOverrideTest - Verifies credential injection fix

New tests - Unit tests added for AwsIdentityProviderUpdater and AuthSchemeResolutionStage/ AsyncAuthSchemeResolutionStage

Screenshots (if appropriate)

Types of changes

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)

Checklist

I have read the CONTRIBUTING document
Local run of mvn install succeeds
My code follows the code style of this project
My change requires a change to the Javadoc documentation
I have updated the Javadoc documentation accordingly
I have added tests to cover my changes
All new and existing tests passed
I have added a changelog entry. Adding a new entry must be accomplished by running the scripts/new-change script and following the instructions. Commit the new file created by the script in .changes/next-release with your changes.
My change is to implement 1.11 parity feature and I have updated LaunchChangelog

License

I confirm that this pull request can be released under the Apache 2 license

Fred1155 · 2026-02-26T18:55:45Z

...en/src/main/java/software/amazon/awssdk/codegen/emitters/tasks/AuthSchemeGeneratorTasks.java

        tasks.add(generateModelBasedProvider());
        tasks.add(generatePreferenceProvider());
-        tasks.add(generateAuthSchemeInterceptor());
+        // AuthSchemeInterceptor removed - auth scheme resolution now happens in client operation methods


Are these comments needed? Are they for customers or us and will be removed when merging to master?

Yeah, will remove them before merging to master.

+1 can we remove them now? (I blame kiro because it really likes adding unnecessary comments, should probably update our guideline)

Fred1155 · 2026-02-26T18:58:49Z

codegen/src/main/java/software/amazon/awssdk/codegen/poet/client/AsyncClientClass.java

        }
    }
+
+    private MethodSpec resolveAuthSchemeOptionsMethod() {


This method is quite large. Could we try extracting the logic, such as the endpoint-based and non-endpoint-based logic into separate helper methods?

Fred1155 · 2026-02-26T19:59:01Z

codegen/src/main/java/software/amazon/awssdk/codegen/poet/client/SyncClientClass.java

                                    poetExtensions.getSyncWaiterInterface());
    }
+
+    private MethodSpec resolveAuthSchemeOptionsMethod() {


Do we consider to move this method to a utility class to avoid dupilication?

Yes, updated.

zoewangg · 2026-02-27T16:13:26Z

...en/src/main/java/software/amazon/awssdk/codegen/emitters/tasks/AuthSchemeGeneratorTasks.java

        tasks.add(generateModelBasedProvider());
        tasks.add(generatePreferenceProvider());
-        tasks.add(generateAuthSchemeInterceptor());
+        // AuthSchemeInterceptor removed - auth scheme resolution now happens in client operation methods


+1 can we remove them now? (I blame kiro because it really likes adding unnecessary comments, should probably update our guideline)

zoewangg · 2026-02-27T16:13:36Z

codegen/src/main/java/software/amazon/awssdk/codegen/poet/builder/BaseClientBuilderClass.java

        List<ClassName> builtInInterceptors = new ArrayList<>();

-        builtInInterceptors.add(authSchemeSpecUtils.authSchemeInterceptor());
+        // AuthSchemeInterceptor removed - auth scheme resolution now happens in client operation methods


zoewangg · 2026-02-27T16:14:42Z

codegen/src/main/java/software/amazon/awssdk/codegen/poet/client/specs/JsonProtocolSpec.java

               .add(".withErrorResponseHandler(errorResponseHandler)\n")
               .add(".withRequestConfiguration(clientConfiguration)")
               .add(".withMetricCollector(apiCallMetricCollector)\n")
+               .add(".withAuthSchemeOptions(resolveAuthSchemeOptions($L, $S, clientConfiguration))\n",


Don't we need to update codegen fixtures test files, but I don't see the files in this PR

I remember we discussed about passing a callback of how to resolve auth scheme options instead because they could also be modified by execution interceptor

Yeah, right. There are a lot of codegen fixture files that we'll need to update again after the endpoints refactoring. I thought maybe we could update them directly before merging to
master. Sure, better to keep these changes. I'll add them.

I remember we discussed about passing a callback of how to resolve auth scheme options instead because they could also be modified by execution interceptor

Oh yeah right, I remember now, I'll update it.

zoewangg · 2026-02-27T16:16:03Z

...s-core/src/main/java/software/amazon/awssdk/awscore/internal/AwsExecutionContextBuilder.java

+    /**
+     * Records business metrics for auth scheme selection (SigV4a, bearer token).
+     */
+    private static void recordAuthSchemeBusinessMetrics(List<AuthSchemeOption> authSchemeOptions,


Question: should we record the metrics in AuthSchemeResolutionStage?

AuthSchemeResolutionStage happens after ApplyUserAgentStage, so metrics wont get recorded then.

zoewangg · 2026-02-27T16:17:34Z

...ava/software/amazon/awssdk/core/internal/http/pipeline/stages/AuthSchemeResolutionStage.java

+ * Pipeline stage that resolves the auth scheme and identity for signing.
+ */
+@SdkInternalApi
+public final class AuthSchemeResolutionStage implements RequestToRequestPipeline {


Can we add a unit test for this class?

My bad, missed committing the file, added the tests now.

zoewangg · 2026-02-27T16:19:54Z

...s3/src/main/java/software/amazon/awssdk/services/s3/internal/signing/DefaultS3Presigner.java

@@ -240,7 +244,7 @@ private List<ExecutionInterceptor> initializeInterceptors() {
        List<ExecutionInterceptor> s3Interceptors =
            interceptorFactory.getInterceptors("software/amazon/awssdk/services/s3/execution.interceptors");
        List<ExecutionInterceptor> additionalInterceptors = new ArrayList<>();
-        additionalInterceptors.add(new S3AuthSchemeInterceptor());
+        // S3AuthSchemeInterceptor removed - auth scheme resolution now done inline


davidh44 · 2026-02-27T19:35:42Z

codegen/src/main/java/software/amazon/awssdk/codegen/poet/client/SyncClientClass.java

                                    poetExtensions.getSyncWaiterInterface());
    }
+
+    private MethodSpec resolveAuthSchemeOptionsMethod() {


davidh44 · 2026-02-27T19:42:04Z

core/sdk-core/src/main/java/software/amazon/awssdk/core/SelectedAuthScheme.java

+///
+///  A container for the identity resolver, signer and auth option that we selected for use with this service call attempt.
+/// ## The Hierarchy
+/// ```
+/// IDENTITY_PROVIDERS (IdentityProviders)
+///     └── contains multiple IdentityProvider<T> instances
+///             e.g., IdentityProvider<AwsCredentialsIdentity> for AWS credentials
+///             e.g., IdentityProvider<TokenIdentity> for bearer tokens
+///
+/// AUTH_SCHEMES (Map<String, AuthScheme<?>>)
+///     └── each AuthScheme knows:
+///             - which IdentityProvider type it needs
+///             - which HttpSigner to use
+///
+/// SELECTED_AUTH_SCHEME (SelectedAuthScheme<T>)
+///     └── the chosen auth scheme, containing:
+///             - identity: CompletableFuture<T>  ← the resolved identity!
+///             - signer: HttpSigner<T>
+///             - authSchemeOption: AuthSchemeOption
+/// ```


should we use a single/* */ instead of /// on each line?

Markdown is much better! 😛 https://openjdk.org/jeps/467

davidh44 · 2026-02-27T19:47:51Z

...s3/src/main/java/software/amazon/awssdk/services/s3/internal/signing/DefaultS3Presigner.java

+    /**
+     * Apply credential overrides from request configuration.
+     */
+    private IdentityProviders applyCredentialOverrides(SdkRequest request, IdentityProviders base) {


This method is identical to AwsIdentityProviderUpdater.update(), should we remove and just call AwsIdentityProviderUpdater.INSTANCE.update()?

davidh44 · 2026-02-27T20:45:19Z

Is AwsExecutionContextBuilder.resolveIdentityProviders() redundant now that we resolve in AwsIdentityProviderUpdater.update() later? Should we just return clientConfig.option(SdkClientOption.IDENTITY_PROVIDERS)

Move auth scheme identity resolution to pipeline stage from interceptors

f0c4795

S-Saranya1 requested a review from a team as a code owner February 26, 2026 16:55

Fred1155 reviewed Feb 26, 2026

View reviewed changes

Additional changes

ceaff05

zoewangg reviewed Feb 27, 2026

View reviewed changes

Add tests

b9600ea

davidh44 reviewed Feb 27, 2026

View reviewed changes

Conversation

S-Saranya1 commented Feb 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Motivation and Context

Modifications

Testing

Screenshots (if appropriate)

Types of changes

Checklist

License

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

zoewangg Feb 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

davidh44 commented Feb 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

S-Saranya1 commented Feb 26, 2026 •

edited

Loading

zoewangg Feb 27, 2026 •

edited

Loading