Handle Oauth2 errors for SSO OIDC service (boto#3642)

Author: SamRemis

.changes/next-release/enhancement-ssooidc-71565.json

@@ -0,0 +1,5 @@
+{
+  "type": "enhancement",
+  "category": "``sso-oidc``",
+  "description": "Fixed missing error messages in SSO OIDC error responses by mapping OAuth2 error_description field to the standard Message field.  Issue was raised in `#2216 <https://github.com/boto/botocore/issues/2216>`__."
+}

botocore/handlers.py

@@ -1318,6 +1318,21 @@ def _should_handle_200_error(operation_model, response_dict):
     return True
 
 
+def _map_oauth2_errors(response_dict, **kwargs):
+    # SSO OIDC follows the OAuth2 standard, which returns error messages in
+    # 'error_description' instead of the 'Message' field botocore expects.
+    try:
+        if response_dict.get('status_code') < 400:
+            return
+        body = json.loads(response_dict.get('body', b'{}'))
+        if message := body.get('error_description'):
+            if not body.get('Message', body.get("message")):
+                body['Message'] = message
+                response_dict['body'] = json.dumps(body).encode('utf-8')
+    except (ValueError, AttributeError, TypeError):
+        pass
+
+
 def _update_status_code(response, **kwargs):
     # Update the http_response status code when the parsed response has been
     # modified in a handler. This enables retries for cases like ``_handle_200_error``.
@@ -1503,6 +1518,7 @@ def get_bearer_auth_supported_services():
     ),
     ('before-parse.s3.*', handle_expires_header),
     ('before-parse.s3.*', _handle_200_error, REGISTER_FIRST),
+    ('before-parse.sso-oidc.*', _map_oauth2_errors),
     ('before-parameter-build', generate_idempotent_uuid),
     ('before-parameter-build', _handle_request_validation_mode_member),
     ('before-parameter-build.s3', validate_bucket_name),

tests/unit/test_handlers.py

@@ -2153,3 +2153,74 @@ def test_set_auth_scheme_preference_signer_with_bearer_token(
     assert signature_version == expected_signature_version, (
         f"Expected '{expected_signature_version}' but got '{signature_version}'"
     )
+
+
+def test_map_oauth2_errors_adds_message():
+    body = {'error': 'invalid_grant', 'error_description': 'Token is expired'}
+    response_dict = {
+        'status_code': 400,
+        'body': json.dumps(body).encode('utf-8'),
+        'headers': {},
+    }
+    handlers._map_oauth2_errors(response_dict)
+    parsed = json.loads(response_dict['body'])
+    assert parsed['Message'] == 'Token is expired'
+    assert parsed['error'] == body['error']
+    assert parsed['error_description'] == body['error_description']
+
+
+@pytest.mark.parametrize(
+    "status_code, body",
+    [
+        # Success response
+        (200, {'access_token': 'foo'}),
+        # No error_description
+        (400, {'error': 'invalid_grant'}),
+        # Empty error description
+        (400, {'error': 'invalid_grant', 'error_description': ''}),
+        # Error response already contains Message or message
+        (
+            400,
+            {
+                'error': 'invalid_grant',
+                'error_description': 'foo',
+                'Message': 'something went wrong',
+            },
+        ),
+        (
+            400,
+            {
+                'error': 'invalid_grant',
+                'error_description': 'bar',
+                'message': 'something went wrong',
+            },
+        ),
+    ],
+)
+def test_map_oauth2_errors_preserves_body(status_code, body):
+    response_dict = {
+        'status_code': status_code,
+        'body': json.dumps(body).encode('utf-8'),
+        'headers': {},
+    }
+    original_body = response_dict['body']
+    handlers._map_oauth2_errors(response_dict)
+    assert response_dict['body'] == original_body
+
+
+@pytest.mark.parametrize(
+    "response_dict",
+    [
+        # Invalid JSON body
+        {'status_code': 400, 'body': b'not json', 'headers': {}},
+        # Empty body
+        {'status_code': 400, 'body': b'', 'headers': {}},
+        # No body
+        {'status_code': 400, 'headers': {}},
+        # Missing status_code
+        {'body': b'{}', 'headers': {}},
+    ],
+)
+def test_map_oauth2_errors_does_not_raise(response_dict):
+    # Should silently pass on malformed inputs
+    handlers._map_oauth2_errors(response_dict)