Skip to content

Commit 877796e

Browse files
kimpepperkimpepper
authoredFeb 28, 2025··
Adds AWS signing to the client factories (#314)
Signed-off-by: Kim Pepper <kim@pepper.id.au>
·
2.4.3
1 parent 99c19ee commit 877796e

8 files changed

+311
-61
lines changed
 

‎CHANGELOG.md

+1
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ Inspired from [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
55
## [Unreleased]
66

77
### Added
8+
- Added `auth_aws` option to GuzzleClientFactory and SymfonyClientFactory ([#314](https://github.com/opensearch-project/opensearch-php/pull/314))
89
### Changed
910
- Updated Client constructor to make EndpointFactory and optional parameter.
1011
### Deprecated

‎guides/auth.md

+33-53
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ OpenSearch allows you to use different methods for the authentication.
1313
## Basic Auth
1414

1515
```php
16-
$endpoint = "https://localhost:9200"
16+
$endpoint = "http://localhost:9200"
1717
$username = "admin"
1818
$password = "..."
1919
```
@@ -30,15 +30,21 @@ $client = (new \OpenSearch\ClientBuilder())
3030

3131
### Using a Psr Client
3232

33+
Using Symfony HTTP Client:
34+
3335
```php
34-
$symfonyPsr18Client = (new \Symfony\Component\HttpClient\Psr18Client())->withOptions([
36+
$client = (new SymfonyClientFactory())->create([
3537
'base_uri' => $endpoint,
3638
'auth_basic' => [$username, $password],
37-
'verify_peer' => false, // for testing only
38-
'headers' => [
39-
'Accept' => 'application/json',
40-
'Content-Type' => 'application/json',
41-
],
39+
]);
40+
```
41+
42+
Using Guzzle:
43+
44+
```php
45+
$client = (new GuzzleClientFactory())->create([
46+
'base_uri' => $endpoint,
47+
'auth' => [$username, $password],
4248
]);
4349
```
4450

@@ -72,53 +78,27 @@ $client = (new \OpenSearch\ClientBuilder())
7278

7379
### Using a Psr Client
7480

81+
We can use the `AwsSigningHttpClientFactory` to create an HTTP Client to sign the requests using the AWS SDK for PHP.
82+
83+
Require a PSR-18 client (e.g. Symfony) and the AWS SDK for PHP:
84+
85+
```bash
86+
composer require symfony/http-client aws/aws-sdk-php
87+
```
88+
89+
Create an OpenSearch Client using the Symfony HTTP Client and the AWS SDK for PHP:
90+
7591
```php
76-
$symfonyPsr18Client = (new \Symfony\Component\HttpClient\Psr18Client())->withOptions([
92+
$client = (new SymfonyClientFactory())->create([
7793
'base_uri' => $endpoint,
78-
'headers' => [
79-
'Accept' => 'application/json',
80-
'Content-Type' => 'application/json',
94+
'auth_aws' => [
95+
'region' => $region,
96+
'service' => 'es',
97+
'credentials' => [
98+
'access_key' => $aws_access_key_id,
99+
'secret_key' => $aws_secret_access_key,
100+
'session_token' => $aws_session_token,
101+
],
81102
],
82103
]);
83-
84-
$serializer = new \OpenSearch\Serializers\SmartSerializer();
85-
$endpointFactory = new \OpenSearch\EndpointFactory();
86-
87-
$signer = new Aws\Signature\SignatureV4(
88-
$service,
89-
$region
90-
);
91-
92-
$credentials = new Aws\Credentials\Credentials(
93-
$aws_access_key_id,
94-
$aws_secret_access_key,
95-
$aws_session_token
96-
);
97-
98-
$signingClient = new \OpenSearch\Aws\SigningClientDecorator(
99-
$symfonyPsr18Client,
100-
$credentials,
101-
$signer,
102-
[
103-
'Host' => parse_url(getenv("ENDPOINT"))['host']
104-
]
105-
);
106-
107-
$requestFactory = new \OpenSearch\RequestFactory(
108-
$symfonyPsr18Client,
109-
$symfonyPsr18Client,
110-
$symfonyPsr18Client,
111-
$serializer,
112-
);
113-
114-
$transport = (new \OpenSearch\TransportFactory())
115-
->setHttpClient($signingClient)
116-
->setRequestFactory($requestFactory)
117-
->create();
118-
119-
$client = new \OpenSearch\Client(
120-
$transport,
121-
$endpointFactory,
122-
[]
123-
);
124-
```
104+
```

‎src/OpenSearch/Aws/SigningClientFactory.php

+115
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,115 @@
1+
<?php
2+
3+
declare(strict_types=1);
4+
5+
namespace OpenSearch\Aws;
6+
7+
use Aws\Credentials\CredentialProvider;
8+
use Aws\Credentials\Credentials;
9+
use Aws\Exception\CredentialsException;
10+
use Aws\Signature\SignatureInterface;
11+
use Aws\Signature\SignatureV4;
12+
use Psr\Http\Client\ClientInterface;
13+
use Psr\Log\LoggerInterface;
14+
15+
/**
16+
* A factory for creating an HTTP Client that signs requests using AWS credentials.
17+
*/
18+
class SigningClientFactory
19+
{
20+
/**
21+
* The allowed AWS services.
22+
*/
23+
public const ALLOWED_SERVICES = ['es', 'aoss'];
24+
25+
public function __construct(
26+
protected ?SignatureInterface $signer = null,
27+
protected ?CredentialProvider $provider = null,
28+
protected ?LoggerInterface $logger = null,
29+
) {
30+
}
31+
32+
/**
33+
* Creates a new signing client.
34+
*
35+
* @param ClientInterface $innerClient
36+
* The decorated inner HTTP client.
37+
* @param array<string,string> $options
38+
* The AWS auth options.
39+
*/
40+
public function create(ClientInterface $innerClient, array $options): ClientInterface
41+
{
42+
if (!isset($options['host'])) {
43+
throw new \InvalidArgumentException('The host option is required.');
44+
}
45+
46+
// Get the credentials.
47+
$provider = $this->getCredentialProvider($options);
48+
$promise = $provider();
49+
try {
50+
$credentials = $promise->wait();
51+
} catch (CredentialsException $e) {
52+
$this->logger?->error('Failed to get AWS credentials: @message', ['@message' => $e->getMessage()]);
53+
$credentials = new Credentials('', '');
54+
}
55+
56+
// Get the signer.
57+
$signer = $this->getSigner($options);
58+
59+
return new SigningClientDecorator($innerClient, $credentials, $signer, ['host' => $options['host']]);
60+
}
61+
62+
/**
63+
* Gets the credential provider.
64+
*
65+
* @param array<string,mixed> $options
66+
* The options array.
67+
*/
68+
protected function getCredentialProvider(array $options): CredentialProvider|\Closure|null|callable
69+
{
70+
// Check for a provided credential provider.
71+
if ($this->provider) {
72+
return $this->provider;
73+
}
74+
75+
// Check for provided access key and secret.
76+
if (isset($options['credentials'])) {
77+
return CredentialProvider::fromCredentials(
78+
new Credentials(
79+
$options['credentials']['access_key'] ?? '',
80+
$options['credentials']['secret_key'] ?? '',
81+
$options['credentials']['session_token'] ?? null,
82+
)
83+
);
84+
}
85+
86+
// Fallback to the default provider.
87+
return CredentialProvider::defaultProvider();
88+
}
89+
90+
/**
91+
* Gets the request signer.
92+
*
93+
* @param array<string,string> $options
94+
* The options.
95+
*/
96+
protected function getSigner(array $options): SignatureInterface
97+
{
98+
if ($this->signer) {
99+
return $this->signer;
100+
}
101+
102+
if (!isset($options['region'])) {
103+
throw new \InvalidArgumentException('The region option is required.');
104+
}
105+
106+
$service = $options['service'] ?? 'es';
107+
108+
if (!in_array($service, self::ALLOWED_SERVICES, true)) {
109+
throw new \InvalidArgumentException('The service option must be either "es" or "aoss".');
110+
}
111+
112+
return new SignatureV4($service, $options['region'], $options);
113+
}
114+
115+
}

‎src/OpenSearch/GuzzleClientFactory.php

+29
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44

55
namespace OpenSearch;
66

7+
use OpenSearch\Aws\SigningClientFactory;
78
use OpenSearch\HttpClient\GuzzleHttpClientFactory;
89
use Psr\Log\LoggerInterface;
910
use GuzzleHttp\Psr7\HttpFactory;
@@ -17,6 +18,7 @@ class GuzzleClientFactory implements ClientFactoryInterface
1718
public function __construct(
1819
protected int $maxRetries = 0,
1920
protected ?LoggerInterface $logger = null,
21+
protected ?SigningClientFactory $awsSigningHttpClientFactory = null,
2022
) {
2123
}
2224

@@ -26,7 +28,22 @@ public function __construct(
2628
*/
2729
public function create(array $options): Client
2830
{
31+
// Clean up the options array for the Guzzle HTTP Client.
32+
if (isset($options['auth_aws'])) {
33+
$awsAuth = $options['auth_aws'];
34+
unset($options['auth_aws']);
35+
}
36+
2937
$httpClient = (new GuzzleHttpClientFactory($this->maxRetries, $this->logger))->create($options);
38+
39+
if (isset($awsAuth)) {
40+
if (!isset($awsAuth['host'])) {
41+
// Get the host from the base URI.
42+
$awsAuth['host'] = parse_url($options['base_uri'], PHP_URL_HOST);
43+
}
44+
$httpClient = $this->getSigningClientFactory()->create($httpClient, $awsAuth);
45+
}
46+
3047
$httpFactory = new HttpFactory();
3148

3249
$serializer = new SmartSerializer();
@@ -45,4 +62,16 @@ public function create(array $options): Client
4562

4663
return new Client($transport, new EndpointFactory($serializer), []);
4764
}
65+
66+
/**
67+
* Gets the AWS signing client factory.
68+
*/
69+
protected function getSigningClientFactory(): SigningClientFactory
70+
{
71+
if ($this->awsSigningHttpClientFactory === null) {
72+
$this->awsSigningHttpClientFactory = new SigningClientFactory();
73+
}
74+
return $this->awsSigningHttpClientFactory;
75+
}
76+
4877
}

‎src/OpenSearch/SymfonyClientFactory.php

+32-7
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22

33
namespace OpenSearch;
44

5+
use OpenSearch\Aws\SigningClientFactory;
56
use OpenSearch\HttpClient\SymfonyHttpClientFactory;
67
use OpenSearch\Serializers\SmartSerializer;
78
use Psr\Log\LoggerInterface;
@@ -14,6 +15,7 @@ class SymfonyClientFactory implements ClientFactoryInterface
1415
public function __construct(
1516
protected int $maxRetries = 0,
1617
protected ?LoggerInterface $logger = null,
18+
protected ?SigningClientFactory $awsSigningHttpClientFactory = null,
1719
) {
1820
}
1921

@@ -25,8 +27,13 @@ public function __construct(
2527
*/
2628
public function create(array $options): Client
2729
{
28-
$httpClient = (new SymfonyHttpClientFactory($this->maxRetries, $this->logger))->create($options);
30+
// Clean up the options array for the Symfony HTTP Client.
31+
if (isset($options['auth_aws'])) {
32+
$awsAuth = $options['auth_aws'];
33+
unset($options['auth_aws']);
34+
}
2935

36+
$httpClient = (new SymfonyHttpClientFactory($this->maxRetries, $this->logger))->create($options);
3037
$serializer = new SmartSerializer();
3138

3239
$requestFactory = new RequestFactory(
@@ -36,12 +43,30 @@ public function create(array $options): Client
3643
$serializer,
3744
);
3845

39-
$transport = (new TransportFactory())
40-
->setHttpClient($httpClient)
41-
->setRequestFactory($requestFactory)
42-
->create();
46+
$transportFactory = (new TransportFactory())
47+
->setRequestFactory($requestFactory);
48+
49+
if (isset($awsAuth)) {
50+
if (!isset($awsAuth['host'])) {
51+
$awsAuth['host'] = parse_url($options['base_uri'], PHP_URL_HOST);
52+
}
53+
$signingClient = $this->getSigningClientFactory()->create($httpClient, $awsAuth);
54+
$transportFactory->setHttpClient($signingClient);
55+
} else {
56+
$transportFactory->setHttpClient($httpClient);
57+
}
58+
59+
return new Client($transportFactory->create(), new EndpointFactory($serializer));
60+
}
4361

44-
$endpointFactory = new EndpointFactory();
45-
return new Client($transport, $endpointFactory, []);
62+
/**
63+
* Gets the AWS signing client factory.
64+
*/
65+
protected function getSigningClientFactory(): SigningClientFactory
66+
{
67+
if ($this->awsSigningHttpClientFactory === null) {
68+
$this->awsSigningHttpClientFactory = new SigningClientFactory();
69+
}
70+
return $this->awsSigningHttpClientFactory;
4671
}
4772
}

0 commit comments

Comments
 (0)
Please sign in to comment.