Help us shape the future of Go! Take the 2026 Go Developer Survey

identitystore

package
v1.9.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 27, 2026 License: MIT Imports: 22 Imported by: 0

README

Identity Store

Parity grade: A · SDK aws-sdk-go-v2/service/identitystore@v1.49.0 · last audited 2026-10-10 (24813b443)

Coverage

Metric Value
PARITY entries audited 19 (19 ok)
Feature families 4 (4 ok)
Known gaps 2
Deferred items 1
Resource leaks clean
Known gaps
  • ListUsers/ListGroups Filters accept a wider set of AttributePath values (name.givenname, emails.value, ...) than the Filter doc string's UserName/DisplayName examples; the doc is example phrasing, not an enumeration, and both filters are deprecated. An unrecognized path matches nothing. Narrowing would break TestListUsersFilters/list_users_filter_by_email, so it stays a documented superset (unverifiable).
  • ExternalId (Issuer+Id) uniqueness is not enforced: nothing in the SDK or docs says AWS rejects duplicates (unlike Email/UserName, which GetUserId's UniqueAttribute makes unique). Unverifiable.
Deferred
  • Extensions field (User.Extensions, ListUsers Extensions request param) -- newer SDK addition (aws:identitystore:enterprise), not modeled in gopherstack's User/CreateUserRequest at all. Low-traffic feature; audit if a future SDK bump surfaces client usage.

More

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var (
	// ErrUserNotFound is returned when a user is not found.
	ErrUserNotFound = errors.New("ResourceNotFoundException")
	// ErrGroupNotFound is returned when a group is not found.
	ErrGroupNotFound = errors.New("ResourceNotFoundException")
	// ErrMembershipNotFound is returned when a membership is not found.
	ErrMembershipNotFound = errors.New("ResourceNotFoundException")
	// ErrConflict is returned when a resource already exists.
	ErrConflict = errors.New("ConflictException")
	// ErrValidation is returned when request validation fails.
	ErrValidation = errors.New("ValidationException")
)

Sentinel errors.

Functions

This section is empty.

Types

type Address 

type Address struct {
	Formatted     string `json:"Formatted,omitempty"`
	StreetAddress string `json:"StreetAddress,omitempty"`
	Locality      string `json:"Locality,omitempty"`
	Region        string `json:"Region,omitempty"`
	PostalCode    string `json:"PostalCode,omitempty"`
	Country       string `json:"Country,omitempty"`
	Type          string `json:"Type,omitempty"`
	Primary       bool   `json:"Primary,omitempty"`
}

Address holds address information for a user.

type CreateGroupRequest 

type CreateGroupRequest struct {
	DisplayName string `json:"DisplayName"`
	Description string `json:"Description"`
}

CreateGroupRequest holds the parameters for creating a group.

The real CreateGroupRequest smithy shape has no ExternalIds member -- ExternalIds is populated only by external-identity-provider provisioning and is exposed as an attribute Group carries, but it is not settable at creation time by any real API caller. A previous revision of this struct (and the wire-facing createGroupRequest in handler_groups.go) accepted and applied an ExternalIds field at CreateGroup time; that was a gopherstack-invented capability with no real-AWS counterpart and has been removed. ExternalIds is instead settable the same way DisplayName and Description are: via UpdateGroup's AttributeOperations (see applyGroupAttributes below), mirroring how User.ExternalIDs is only reachable through UpdateUser, never CreateUser.

type CreateUserRequest 

type CreateUserRequest struct {
	UserName      string        `json:"UserName"`
	DisplayName   string        `json:"DisplayName"`
	NickName      string        `json:"NickName"`
	Title         string        `json:"Title"`
	ProfileURL    string        `json:"ProfileUrl"`
	Locale        string        `json:"Locale"`
	PreferredLang string        `json:"PreferredLanguage"`
	Timezone      string        `json:"Timezone"`
	UserType      string        `json:"UserType"`
	Birthdate     string        `json:"Birthdate"`
	Website       string        `json:"Website"`
	Name          *Name         `json:"Name"`
	Emails        []Email       `json:"Emails"`
	Addresses     []Address     `json:"Addresses"`
	PhoneNumbers  []PhoneNumber `json:"PhoneNumbers"`
	Photos        []Photo       `json:"Photos"`
	Roles         []Role        `json:"Roles"`
	ExternalIDs   []ExternalID  `json:"ExternalIds"`
}

CreateUserRequest holds the parameters for creating a user.

ExternalIDs is NOT wire-reachable: the real CreateUserRequest smithy shape has no ExternalIds member (see the doc comment on the wire-facing createUserRequest in handler_users.go for the full member list this was verified against, and for the gopherstack-invented-field bug this field used to enable before this pass). It is kept here only as a Go-level convenience for tests that seed backend state directly (e.g. persistence_test.go's seedFullState), mirroring how User.ExternalIDs is otherwise reachable only through UpdateUser's AttributeOperations.

type Email 

type Email struct {
	Value   string `json:"Value,omitempty"`
	Type    string `json:"Type,omitempty"`
	Primary bool   `json:"Primary,omitempty"`
}

Email holds email address information for a user.

type ExternalID 

type ExternalID struct {
	Issuer string `json:"Issuer"`
	ID     string `json:"Id"`
}

ExternalID holds an external identity for a user (e.g. from SAML/SCIM providers).

type Group 

type Group struct {
	GroupID         string `json:"GroupId"`
	IdentityStoreID string `json:"IdentityStoreId"`
	DisplayName     string `json:"DisplayName,omitempty"`
	Description     string `json:"Description,omitempty"`
	CreatedBy       string `json:"CreatedBy,omitempty"`
	UpdatedBy       string `json:"UpdatedBy,omitempty"`

	CreatedAt   epochTime    `json:"CreatedAt"`
	UpdatedAt   epochTime    `json:"UpdatedAt"`
	ExternalIDs []ExternalID `json:"ExternalIds,omitempty"`
	// contains filtered or unexported fields
}

Group represents an identity store group. Field order below is fieldalignment-optimal; see the note on User.

type GroupMembership 

type GroupMembership struct {
	CreatedAt       epochTime `json:"CreatedAt"`
	UpdatedAt       epochTime `json:"UpdatedAt"`
	MembershipID    string    `json:"MembershipId"`
	IdentityStoreID string    `json:"IdentityStoreId"`
	GroupID         string    `json:"GroupId"`
	CreatedBy       string    `json:"CreatedBy,omitempty"`
	UpdatedBy       string    `json:"UpdatedBy,omitempty"`
	MemberID        MemberID  `json:"MemberId"`
	// contains filtered or unexported fields
}

GroupMembership represents a group membership record.

type GroupMembershipExistence 

type GroupMembershipExistence struct {
	GroupID          string   `json:"GroupId"`
	MemberID         MemberID `json:"MemberId"`
	MembershipExists bool     `json:"MembershipExists"`
}

GroupMembershipExistence is the result item for IsMemberInGroups.

type Handler 

type Handler struct {
	Backend *InMemoryBackend
}

Handler is the Echo HTTP handler for the Identity Store REST API.

func NewHandler 

func NewHandler(backend *InMemoryBackend) *Handler

NewHandler creates a new Identity Store handler.

func (*Handler) ChaosOperations 

func (h *Handler) ChaosOperations() []string

ChaosOperations returns all operations that can be fault-injected.

func (*Handler) ChaosRegions 

func (h *Handler) ChaosRegions() []string

ChaosRegions returns all regions this Identity Store instance handles.

func (*Handler) ChaosServiceName 

func (h *Handler) ChaosServiceName() string

ChaosServiceName returns the lowercase AWS service name for fault rule matching.

func (*Handler) ExtractOperation 

func (h *Handler) ExtractOperation(c *echo.Context) string

ExtractOperation extracts the Identity Store operation name from the X-Amz-Target header.

func (*Handler) ExtractResource 

func (h *Handler) ExtractResource(c *echo.Context) string

ExtractResource extracts the IdentityStoreId from the request body.

func (*Handler) GetSupportedOperations 

func (h *Handler) GetSupportedOperations() []string

GetSupportedOperations returns the list of supported Identity Store operations.

func (*Handler) Handler 

func (h *Handler) Handler() echo.HandlerFunc

Handler returns the Echo handler function for Identity Store requests. The Identity Store SDK uses the JSON 1.1 protocol: POST / with X-Amz-Target header.

func (*Handler) MatchPriority 

func (h *Handler) MatchPriority() int

MatchPriority returns the routing priority. Uses PriorityHeaderExact since matching is by X-Amz-Target header.

func (*Handler) Name 

func (h *Handler) Name() string

Name returns the service name.

func (*Handler) Restore 

func (h *Handler) Restore(ctx context.Context, data []byte) error

Restore implements persistence.Persistable by delegating to the backend.

func (*Handler) RouteMatcher 

func (h *Handler) RouteMatcher() service.Matcher

RouteMatcher returns a function that matches Identity Store JSON protocol requests. The SDK uses X-Amz-Target: AWSIdentityStore.{Operation} with POST to /.

func (*Handler) Snapshot 

func (h *Handler) Snapshot(ctx context.Context) []byte

Snapshot implements persistence.Persistable by delegating to the backend.

type InMemoryBackend 

type InMemoryBackend struct {
	// contains filtered or unexported fields
}

InMemoryBackend is the in-memory store for the Identity Store service.

Users, groups, and memberships were previously nested by region (map[region]map[id]*T, with IdentityStoreID carried as a field for per-store filtering within a region). Phase 3.3 flattens each into a single *store.Table keyed by the composite "region#id" string (regionKey in this file), with secondary *store.Index lookups replacing the old per-region reverse-lookup maps -- see store_setup.go for every key function and index, and persistence.go for how the hidden `region` field each value type carries is round-tripped through Snapshot/Restore. Callers must hold b.mu.

func NewInMemoryBackend 

func NewInMemoryBackend(accountID, region string) *InMemoryBackend

NewInMemoryBackend creates a new InMemoryBackend with the given account and region.

func (*InMemoryBackend) CreateGroup 

func (b *InMemoryBackend) CreateGroup(ctx context.Context, storeID string, req *CreateGroupRequest) (*Group, error)

CreateGroup creates a new group in the identity store.

func (*InMemoryBackend) CreateGroupMembership 

func (b *InMemoryBackend) CreateGroupMembership(
	ctx context.Context, storeID, groupID string, memberID MemberID,
) (*GroupMembership, error)

CreateGroupMembership creates a membership between a user and a group.

func (*InMemoryBackend) CreateUser 

func (b *InMemoryBackend) CreateUser(ctx context.Context, storeID string, req *CreateUserRequest) (*User, error)

CreateUser creates a new user in the identity store.

func (*InMemoryBackend) DeleteGroup 

func (b *InMemoryBackend) DeleteGroup(ctx context.Context, storeID, groupID string) error

DeleteGroup removes a group from the identity store.

func (*InMemoryBackend) DeleteGroupMembership 

func (b *InMemoryBackend) DeleteGroupMembership(ctx context.Context, storeID, membershipID string) error

DeleteGroupMembership removes a membership.

func (*InMemoryBackend) DeleteUser 

func (b *InMemoryBackend) DeleteUser(ctx context.Context, storeID, userID string) error

DeleteUser removes a user from the identity store.

func (*InMemoryBackend) DescribeGroup 

func (b *InMemoryBackend) DescribeGroup(ctx context.Context, storeID, groupID string) (*Group, error)

DescribeGroup returns a group by ID.

func (*InMemoryBackend) DescribeGroupMembership 

func (b *InMemoryBackend) DescribeGroupMembership(
	ctx context.Context, storeID, membershipID string,
) (*GroupMembership, error)

DescribeGroupMembership returns a membership by ID.

func (*InMemoryBackend) DescribeUser 

func (b *InMemoryBackend) DescribeUser(ctx context.Context, storeID, userID string) (*User, error)

DescribeUser returns a user by ID.

func (*InMemoryBackend) GetGroupID 

func (b *InMemoryBackend) GetGroupID(ctx context.Context, storeID, attrPath, attrValue string) (string, error)

GetGroupID looks up a group ID by alternate identifier (DisplayName or ExternalId).

func (*InMemoryBackend) GetGroupMembershipID 

func (b *InMemoryBackend) GetGroupMembershipID(
	ctx context.Context, storeID, groupID string, memberID MemberID,
) (string, error)

GetGroupMembershipID looks up a membership ID by group and member.

func (*InMemoryBackend) GetUserID 

func (b *InMemoryBackend) GetUserID(ctx context.Context, storeID, attrPath, attrValue string) (string, error)

GetUserID looks up a user ID by alternate identifier (UserName, email, or ExternalId).

func (*InMemoryBackend) IsMemberInGroups 

func (b *InMemoryBackend) IsMemberInGroups(
	ctx context.Context,
	storeID string,
	memberID MemberID,
	groupIDs []string,
) []GroupMembershipExistence

IsMemberInGroups checks which of the given groups contain the specified member. Uses the O(1) byGroupMember index instead of scanning all memberships.

func (*InMemoryBackend) ListGroupMemberships 

func (b *InMemoryBackend) ListGroupMemberships(ctx context.Context, storeID, groupID string) []*GroupMembership

ListGroupMemberships lists all memberships for a group, sorted by MembershipID.

func (*InMemoryBackend) ListGroupMembershipsForMember 

func (b *InMemoryBackend) ListGroupMembershipsForMember(
	ctx context.Context, storeID string, memberID MemberID,
) []*GroupMembership

ListGroupMembershipsForMember lists all group memberships for a given member, sorted by MembershipID.

func (*InMemoryBackend) ListGroups 

func (b *InMemoryBackend) ListGroups(ctx context.Context, storeID string) []*Group

ListGroups lists all groups for the given identity store, sorted by GroupID.

func (*InMemoryBackend) ListUsers 

func (b *InMemoryBackend) ListUsers(ctx context.Context, storeID string) []*User

ListUsers lists all users for the given identity store, sorted by UserID.

func (*InMemoryBackend) Region 

func (b *InMemoryBackend) Region() string

Region returns the backend default region.

func (*InMemoryBackend) Reset 

func (b *InMemoryBackend) Reset()

Reset clears all user, group, and membership state.

func (*InMemoryBackend) Restore 

func (b *InMemoryBackend) Restore(ctx context.Context, data []byte) error

Restore loads backend state from a JSON snapshot. It implements persistence.Persistable.

func (*InMemoryBackend) Snapshot 

func (b *InMemoryBackend) Snapshot(ctx context.Context) []byte

Snapshot serialises the backend state to JSON. It implements persistence.Persistable.

func (*InMemoryBackend) UpdateGroup 

func (b *InMemoryBackend) UpdateGroup(ctx context.Context, storeID, groupID string, ops []attributeOperation) error

UpdateGroup applies attribute operations to a group.

func (*InMemoryBackend) UpdateUser 

func (b *InMemoryBackend) UpdateUser(ctx context.Context, storeID, userID string, ops []attributeOperation) error

UpdateUser applies attribute operations to a user.

type ListFilter 

type ListFilter struct {
	AttributePath  string `json:"AttributePath"`
	AttributeValue string `json:"AttributeValue"`
}

ListFilter is a single attribute-equality filter for list operations.

type MemberID 

type MemberID struct {
	UserID string `json:"UserId,omitempty"`
}

MemberID holds a membership member reference.

type Name 

type Name struct {
	Formatted       string `json:"Formatted,omitempty"`
	FamilyName      string `json:"FamilyName,omitempty"`
	GivenName       string `json:"GivenName,omitempty"`
	MiddleName      string `json:"MiddleName,omitempty"`
	HonorificPrefix string `json:"HonorificPrefix,omitempty"`
	HonorificSuffix string `json:"HonorificSuffix,omitempty"`
}

Name holds a user's name components.

type PhoneNumber 

type PhoneNumber struct {
	Value   string `json:"Value,omitempty"`
	Type    string `json:"Type,omitempty"`
	Primary bool   `json:"Primary,omitempty"`
}

PhoneNumber holds phone number information for a user.

type Photo 

type Photo struct {
	Value   string `json:"Value"`
	Display string `json:"Display,omitempty"`
	Type    string `json:"Type,omitempty"`
	Primary bool   `json:"Primary,omitempty"`
}

Photo holds photo information for a user. Users can have up to 3 photos.

type Provider 

type Provider struct{}

Provider implements service.Provider for the Identity Store service.

func (*Provider) Init 

func (p *Provider) Init(ctx *service.AppContext) (service.Registerable, error)

Init initializes the Identity Store service backend and handler.

func (*Provider) Name 

func (p *Provider) Name() string

Name returns the provider name.

type Role 

type Role struct {
	Value   string `json:"Value"`
	Type    string `json:"Type,omitempty"`
	Primary bool   `json:"Primary,omitempty"`
}

Role holds role information for a user.

type User 

type User struct {
	Name            *Name  `json:"Name,omitempty"`
	UserType        string `json:"UserType,omitempty"`
	Website         string `json:"Website,omitempty"`
	DisplayName     string `json:"DisplayName,omitempty"`
	NickName        string `json:"NickName,omitempty"`
	Title           string `json:"Title,omitempty"`
	ProfileURL      string `json:"ProfileUrl,omitempty"`
	Locale          string `json:"Locale,omitempty"`
	PreferredLang   string `json:"PreferredLanguage,omitempty"`
	Timezone        string `json:"Timezone,omitempty"`
	UserID          string `json:"UserId"`
	UserName        string `json:"UserName,omitempty"`
	UserStatus      string `json:"UserStatus,omitempty"`
	Birthdate       string `json:"Birthdate,omitempty"`
	IdentityStoreID string `json:"IdentityStoreId"`
	CreatedBy       string `json:"CreatedBy,omitempty"`
	UpdatedBy       string `json:"UpdatedBy,omitempty"`

	CreatedAt    epochTime     `json:"CreatedAt"`
	UpdatedAt    epochTime     `json:"UpdatedAt"`
	Addresses    []Address     `json:"Addresses,omitempty"`
	PhoneNumbers []PhoneNumber `json:"PhoneNumbers,omitempty"`
	Photos       []Photo       `json:"Photos,omitempty"`
	Roles        []Role        `json:"Roles,omitempty"`
	ExternalIDs  []ExternalID  `json:"ExternalIds,omitempty"`
	Emails       []Email       `json:"Emails,omitempty"`
	// contains filtered or unexported fields
}

User represents an identity store user. Field order below is fieldalignment-optimal (computed on an isolated scratch copy per this repo's fieldalignment-fix protocol, then hand- applied here) rather than the semantic grouping a human would pick; do not reorder without re-running fieldalignment.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.