authenticate_file_server_user

DatasourcesApi.authenticate_file_server_user(server_id, username, source_ip, protocol=None, password=None, _request_timeout=None, _request_auth=None, _content_type=None, _headers=None, _host_index=0)

Authenticate an AWS Transfer file-server user

AWS Transfer Family identity-provider callback (SigV4, no role_id). Authenticates username with the Password header (Cognito) or, if Password is omitted, SSH keys from SSM. The user must have at least read on the file-server datasource. 200 returns a LOGICAL home directory for datasets they own or can edit on that server. Password auth is not idempotent.

Parameters:

  • server_id (str) – AWS Transfer ServerId stored on the file-server datasource (DatasourceConfig.ServerId). Unknown ids fail as GE-1034. (required)

  • username (str) – Amorphic user id. Invalid users fail as GE-1034 wrapping GE-1060. (required)

  • source_ip (str) – Client IP from Transfer. Read by the handler; missing key fails as GE-1034. (required)

  • protocol (str) – Transfer protocol (for example SFTP). The handler always reads this key; it was missing from the previous spec. Missing key fails as GE-1034.

  • password (str) – Cognito password for SRP auth. Omit or empty to use public keys. When IDP is enabled, a non-empty Password fails (public key only).

  • _request_timeout (int, tuple(int, int), optional) – timeout setting for this request. If one number provided, it will be total request timeout. It can also be a pair (tuple) of (connection, read) timeouts.

  • _request_auth (dict, optional) – set to override the auth_settings for an a single request; this effectively ignores the authentication in the spec for a single request.

  • _content_type (str, Optional) – force content-type for the request.

  • _headers (dict, optional) – set to override the headers for a single request; this effectively ignores the headers in the spec for a single request.

  • _host_index (int, optional) – set to override the host_index for a single request; this effectively ignores the host_index in the spec for a single request.

Return type:

FileServerUserConfigResponseModel

Returns:

Returns the result object.

Request and Response Examples

HTTP: GET /servers/{serverId}/users/{username}/config

Success (HTTP 200)

Transfer user config: IAM Role, LOGICAL HomeDirectoryDetails (JSON string of Entry/Target maps), HomeDirectoryType, and PublicKeys (empty list when password auth was used).

Request / response example

{
  "Role": "arn:aws:iam::123456789012:role/projectshortname-custom-a2f7d3b1-8e5c-4a6f-9d1e-2b3c4d5e6f7a-Role",
  "HomeDirectoryDetails": "[{\"Entry\":\"/finance-sales\",\"Target\":\"/lz-bucket/finance/sales\"}]",
  "HomeDirectoryType": "LOGICAL",
  "PublicKeys": []
}

Errors

Documented error codes: GE-1034, AUTH-1012, GE-1060.

HTTP 400

The datasources Lambda maps UnauthorizedUserException and InvalidInputException to HTTP 400. This path wraps those failures inside handle_sftp_server_auth as GE-1034, so clients typically see 500 instead.

Generic datasources 400 mapping

{
  "Message": "AUTH-1012 - User: user1 requires at least read access on the resource to perform this action."
}

HTTP 500

Auth and lookup failures are GenericFailureException {“Message”: “GE-1034 - User authentication failed with error: <inner>”}. Inner text includes unknown ServerId, invalid user (GE-1060), IDP+password, Cognito failure, missing datasource read access (AUTH-1012), and missing protocol/sourceIp. Uncaught errors before that try use {“Message”: “<exception>”} with no code prefix.

Transfer ServerId not found

{
  "Message": "GE-1034 - User authentication failed with error: GE-1034 - s-0123456789abcdef0"
}

username is not an Amorphic user

{
  "Message": "GE-1034 - User authentication failed with error: GE-1060 - User unknown is not valid user."
}

User lacks read on the datasource

{
  "Message": "GE-1034 - User authentication failed with error: AUTH-1012 - User: user1 requires at least read access on the resource to perform this action."
}