private async System.Threading.Tasks.Task<CredentialsRefreshState> GetCredentialsForRoleAsync(string roleArn)
        {
            CredentialsRefreshState credentialsState;
            // Retrieve Open Id Token
            // (Reuses existing IdentityId or creates a new one)
            var identity = await GetIdentityIdAsync(RefreshIdentityOptions.Refresh).ConfigureAwait(false);
            var getTokenRequest = new GetOpenIdTokenRequest { IdentityId = identity };
            // If logins are set, pass them to the GetOpenId call
            if (Logins.Count > 0)
                getTokenRequest.Logins = Logins;

            bool retry = false;
            GetOpenIdTokenResponse getTokenResult = null;
            try
            {
                getTokenResult = await cib.GetOpenIdTokenAsync(getTokenRequest).ConfigureAwait(false);
            }
            catch (AmazonCognitoIdentityException e)
            {
                if (ShouldRetry(e))
                    retry = true;
                else
                    throw;
            }

            if (retry)
            {
                return await GetCredentialsForRoleAsync(roleArn);
            }

            string token = getTokenResult.Token;

            // IdentityId may have changed, save the new value
            UpdateIdentity(getTokenResult.IdentityId);

            // Assume role with Open Id Token
            var assumeRequest = new AssumeRoleWithWebIdentityRequest
            {
                WebIdentityToken = token,
                RoleArn = roleArn,
                RoleSessionName = "NetProviderSession",
                DurationSeconds = DefaultDurationSeconds
            };
            var credentials = (await sts.AssumeRoleWithWebIdentityAsync(assumeRequest).ConfigureAwait(false)).Credentials;

            // Return new refresh state (credentials and expiration)
            credentialsState = new CredentialsRefreshState(credentials.GetCredentials(), credentials.Expiration);
            return credentialsState;
        }

        private async System.Threading.Tasks.Task<CredentialsRefreshState> GetCredentialsForRoleAsync(string roleArn)
        {
            CredentialsRefreshState credentialsState;
            // Retrieve Open Id Token
            // (Reuses existing IdentityId or creates a new one)
            var identityId = await GetIdentityIdAsync().ConfigureAwait(false);
            var getTokenRequest = new GetOpenIdTokenRequest { IdentityId = identityId };
            // If logins are set, pass them to the GetOpenId call
            if (Logins.Count > 0)
                getTokenRequest.Logins = Logins;
            var getTokenResult = await cib.GetOpenIdTokenAsync(getTokenRequest).ConfigureAwait(false);
            string token = getTokenResult.Token;

            // IdentityId may have changed, save the new value
            UpdateIdentity(getTokenResult.IdentityId, true);

            // Assume role with Open Id Token
            var assumeRequest = new AssumeRoleWithWebIdentityRequest
            {
                WebIdentityToken = token,
                RoleArn = roleArn,
                RoleSessionName = "NetProviderSession",
                DurationSeconds = DefaultDurationSeconds
            };
            var credentials = (await sts.AssumeRoleWithWebIdentityAsync(assumeRequest).ConfigureAwait(false)).Credentials;

            // Return new refresh state (credentials and expiration)
            credentialsState = new CredentialsRefreshState(credentials.GetCredentials(), credentials.Expiration);
            return credentialsState;
        }

        protected override CredentialsRefreshState GenerateNewCredentials()
        {
            var sessionCredentials = _stsClient.GetSessionToken(new GetSessionTokenRequest()).GetSessionTokenResult.Credentials;

            var state = new CredentialsRefreshState
            {
                Credentials = new ImmutableCredentials(sessionCredentials.AccessKeyId, sessionCredentials.SecretAccessKey, sessionCredentials.SessionToken, false),
                Expiration = sessionCredentials.Expiration
            };

            return state;
        }

        private CredentialsRefreshState Authenticate(ICredentials userCredential, TimeSpan credentialDuration)
        {
            CredentialsRefreshState state;
            SAMLAssertion assertion;

            var configuredRegion = AWSConfigs.AWSRegion;
            var region = string.IsNullOrEmpty(configuredRegion)
                                ? DefaultSTSClientRegion
                                : RegionEndpoint.GetBySystemName(configuredRegion);

            try
            {
                assertion = new SAMLAuthenticationController().GetSAMLAssertion(ProfileData.EndpointSettings.Endpoint.ToString(),
                                                                                userCredential,
                                                                                ProfileData.EndpointSettings.AuthenticationType);
            }
            catch (Exception e)
            {
                throw new AuthenticationFailedException("Authentication failure, unable to obtain SAML assertion.", e);
            }

            try
            {
                using (var stsClient = new AmazonSecurityTokenServiceClient(new AnonymousAWSCredentials(), region))
                {
                    var credentials = assertion.GetRoleCredentials(stsClient, ProfileData.RoleArn, credentialDuration);
                    state = new CredentialsRefreshState(credentials, DateTime.UtcNow + credentialDuration);
                }
            }
            catch (Exception e)
            {
                var wrappedException = new AmazonClientException("Credential generation failed following successful authentication.", e);

                var logger = Logger.GetLogger(typeof(StoredProfileSAMLCredentials));
                logger.Error(wrappedException, wrappedException.Message);

                throw wrappedException;
            }

            return state;
        }

        private CredentialsRefreshState GetEarlyRefreshState(CredentialsRefreshState state)
        {
            // New expiry time = Now + _refreshAttemptPeriod + PreemptExpiryTime
            var newExpiryTime = DateTime.Now + _refreshAttemptPeriod + PreemptExpiryTime;
            // Use this only if the time is earlier than the default expiration time
            if (newExpiryTime.ToUniversalTime() > state.Expiration.ToUniversalTime())
                newExpiryTime = state.Expiration;

            return new CredentialsRefreshState
            {
                Credentials = state.Credentials.Copy(),
                Expiration = newExpiryTime
            };
        }

        // Retrieves credentials for the specific role, by making a call to STS
        private CredentialsRefreshState GetCredentialsForRole(string roleArn)
        {
            CredentialsRefreshState credentialsState;
            // Retrieve Open Id Token
            // (Reuses existing IdentityId or creates a new one)
            var getTokenRequest = new GetOpenIdTokenRequest { IdentityId = GetIdentityId() };
            // If logins are set, pass them to the GetOpenId call
            if (Logins.Count > 0)
                getTokenRequest.Logins = Logins;
            var getTokenResult = GetOpenId(getTokenRequest);
            string token = getTokenResult.Token;

            // IdentityId may have changed, save the new value
            UpdateIdentity(getTokenResult.IdentityId, true);

            // Assume role with Open Id Token
            var assumeRequest = new AssumeRoleWithWebIdentityRequest
            {
                WebIdentityToken = token,
                RoleArn = roleArn,
                RoleSessionName = "NetProviderSession",
                DurationSeconds = DefaultDurationSeconds
            };
            var credentials = GetStsCredentials(assumeRequest);

            credentialsState = new CredentialsRefreshState(credentials.GetCredentials(), credentials.Expiration);
            return credentialsState;
        }

 /// <summary>
 /// Caches the credentials to player pref's
 /// </summary>
 internal void CacheCredentials(CredentialsRefreshState credentialsState)
 {
     //TODO: add support for caching
 }

        // Retrieves credentials for the roles defined on the identity pool
        private CredentialsRefreshState GetPoolCredentials()
        {
            CredentialsRefreshState credentialsState;
            var identity = this.GetIdentityId(RefreshIdentityOptions.Refresh);
            var getCredentialsRequest = new GetCredentialsForIdentityRequest { IdentityId = identity };

            if (Logins.Count > 0)
                getCredentialsRequest.Logins = Logins;

            //incase its BYOI provider override the logins dictionary with the new instance and set the values for cognito-identity provider
            if (_identityState != null && !string.IsNullOrEmpty(_identityState.LoginToken))
            {
                getCredentialsRequest.Logins = new Dictionary<string, string>();
                getCredentialsRequest.Logins["cognito-identity.amazonaws.com"] = _identityState.LoginToken;
            }

            bool retry = false;
            GetCredentialsForIdentityResponse response = null;
            try
            {
                response = GetCredentialsForIdentity(getCredentialsRequest);
            }
            catch (AmazonCognitoIdentityException e)
            {
                if (ShouldRetry(e))
                    retry = true;
                else
                    throw;
            }

            if (retry)
            {
                return GetPoolCredentials();
            }

            // IdentityId may have changed, save the new value
            UpdateIdentity(response.IdentityId);

            var credentials = response.Credentials;
            credentialsState = new CredentialsRefreshState(credentials.GetCredentials(), credentials.Expiration);
            return credentialsState;
        }

        // Retrieves credentials for the roles defined on the identity pool
        private async System.Threading.Tasks.Task<CredentialsRefreshState> GetPoolCredentialsAsync()
        {
            CredentialsRefreshState credentialsState;
            var identity = await GetIdentityIdAsync(RefreshIdentityOptions.Refresh).ConfigureAwait(false);
            var getCredentialsRequest = new GetCredentialsForIdentityRequest { IdentityId = identity };
            if (Logins.Count > 0)
                getCredentialsRequest.Logins = Logins;
            if (_identityState != null && !string.IsNullOrEmpty(_identityState.LoginToken))
            {
                getCredentialsRequest.Logins = new Dictionary<string, string>();
                getCredentialsRequest.Logins.Add("cognito-identity.amazonaws.com", _identityState.LoginToken);
            }

            bool retry = false;
            GetCredentialsForIdentityResponse response = null;
            try
            {
                response = (await cib.GetCredentialsForIdentityAsync(getCredentialsRequest).ConfigureAwait(false));
                // IdentityId may have changed, save the new value
                UpdateIdentity(response.IdentityId);
            }
            catch (AmazonCognitoIdentityException e)
            {
                if (ShouldRetry(e))
                    retry = true;
                else
                    throw;
            }

            if (retry)
            {
                return await GetPoolCredentialsAsync();
            }


            var credentials = response.Credentials;
            credentialsState = new CredentialsRefreshState(credentials.GetCredentials(), credentials.Expiration);
            return credentialsState;
        }

        private void UpdateToGeneratedCredentials(CredentialsRefreshState state)
        {
            // Check if the new credentials are already expired
            if (ShouldUpdate)
            {
                throw new AmazonClientException("The retrieved credentials have already expired");
            }

            // Offset the Expiration by PreemptExpiryTime
            state.Expiration -= PreemptExpiryTime;

            if (ShouldUpdate)
            {
                // This could happen if the default value of PreemptExpiryTime is
                // overriden and set too high such that ShouldUpdate returns true.
                _logger.InfoFormat(
                    "The preempt expiry time is set too high: Current time = {0}, Credentials expiry time = {1}, Preempt expiry time = {2}.",
                    DateTime.Now,
                    _currentState.Expiration,
                    PreemptExpiryTime);
            }
        }

        // Retrieves credentials for the roles defined on the identity pool
        private async System.Threading.Tasks.Task<CredentialsRefreshState> GetPoolCredentialsAsync()
        {
            CredentialsRefreshState credentialsState;
            var identityId = await GetIdentityIdAsync().ConfigureAwait(false);
            var getCredentialsRequest = new GetCredentialsForIdentityRequest { IdentityId = identityId };
            if (Logins.Count > 0)
                getCredentialsRequest.Logins = Logins;
            var response = (await cib.GetCredentialsForIdentityAsync(getCredentialsRequest).ConfigureAwait(false));

            // IdentityId may have changed, save the new value
            UpdateIdentity(response.IdentityId, true);

            var credentials = response.Credentials;
            credentialsState = new CredentialsRefreshState(credentials.GetCredentials(), credentials.Expiration);
            return credentialsState;
        }

        // Retrieves credentials for the roles defined on the identity pool
        private async System.Threading.Tasks.Task<CredentialsRefreshState> GetPoolCredentialsAsync()
        {
            CredentialsRefreshState credentialsState;
            var identity = await GetIdentityIdWithCachingAsync().ConfigureAwait(false);
            var getCredentialsRequest = new GetCredentialsForIdentityRequest { IdentityId = identity.IdentityId };
            if (Logins.Count > 0)
                getCredentialsRequest.Logins = Logins;

            bool retry = false;
            GetCredentialsForIdentityResponse response = null;
            try
            {
                response = (await cib.GetCredentialsForIdentityAsync(getCredentialsRequest).ConfigureAwait(false));
                // IdentityId may have changed, save the new value
                UpdateIdentity(response.IdentityId, true);
            }
            catch (AmazonCognitoIdentityException e)
            {
                if (ShouldRetry(e, identity))
                    retry = true;
                else
                    throw;
            }

            if (retry)
            {
                return await GetPoolCredentialsAsync();
            }


            var credentials = response.Credentials;
            credentialsState = new CredentialsRefreshState(credentials.GetCredentials(), credentials.Expiration);
            return credentialsState;
        }

        // Retrieves credentials for the roles defined on the identity pool
        private CredentialsRefreshState GetPoolCredentials()
        {
            CredentialsRefreshState credentialsState;
            var getCredentialsRequest = new GetCredentialsForIdentityRequest { IdentityId = GetIdentityId() };
            if (Logins.Count > 0)
                getCredentialsRequest.Logins = Logins;
            var response = GetCredentialsForIdentity(getCredentialsRequest);

            // IdentityId may have changed, save the new value
            UpdateIdentity(response.IdentityId, true);

            var credentials = response.Credentials;
            credentialsState = new CredentialsRefreshState(credentials.GetCredentials(), credentials.Expiration);
            return credentialsState;
        }

        // Retrieves credentials for the roles defined on the identity pool
        private CredentialsRefreshState GetPoolCredentials()
        {
            CredentialsRefreshState credentialsState;
            var identity = this.GetIdentityIdWithCaching();
            var getCredentialsRequest = new GetCredentialsForIdentityRequest { IdentityId = identity.IdentityId };
            if (Logins.Count > 0)
                getCredentialsRequest.Logins = Logins;

            bool retry = false;
            GetCredentialsForIdentityResponse response = null;
            try
            {
                response = GetCredentialsForIdentity(getCredentialsRequest);
            }
            catch (AmazonCognitoIdentityException e)
            {
                if (ShouldRetry(e, identity))
                    retry = true;
                else
                    throw;
            }

            if (retry)
            {
                return GetPoolCredentials();
            }

            // IdentityId may have changed, save the new value
            UpdateIdentity(response.IdentityId, true);

            var credentials = response.Credentials;
            credentialsState = new CredentialsRefreshState(credentials.GetCredentials(), credentials.Expiration);
            return credentialsState;
        }

        // Retrieves credentials for the specific role, by making a call to STS
        private CredentialsRefreshState GetCredentialsForRole(string roleArn)
        {
            CredentialsRefreshState credentialsState;
            // Retrieve Open Id Token
            // (Reuses existing IdentityId or creates a new one)
            var identity = this.GetIdentityIdWithCaching();
            var getTokenRequest = new GetOpenIdTokenRequest { IdentityId = identity.IdentityId };
            // If logins are set, pass them to the GetOpenId call
            if (Logins.Count > 0)
                getTokenRequest.Logins = Logins;

            bool retry = false;
            GetOpenIdTokenResponse getTokenResult = null;
            try 
            {
                getTokenResult = GetOpenId(getTokenRequest);
            }
            catch (AmazonCognitoIdentityException e)
            {
                if (ShouldRetry(e, identity))
                    retry = true;
                else
                    throw;
            }

            if (retry)
            {
                return GetCredentialsForRole(roleArn);
            }

            string token = getTokenResult.Token;

            // IdentityId may have changed, save the new value
            UpdateIdentity(getTokenResult.IdentityId, true);

            // Assume role with Open Id Token
            var assumeRequest = new AssumeRoleWithWebIdentityRequest
            {
                WebIdentityToken = token,
                RoleArn = roleArn,
                RoleSessionName = "NetProviderSession",
                DurationSeconds = DefaultDurationSeconds
            };
            var credentials = GetStsCredentials(assumeRequest);

            credentialsState = new CredentialsRefreshState(credentials.GetCredentials(), credentials.Expiration);
            return credentialsState;
        }

        private void UpdateToGeneratedCredentials(CredentialsRefreshState state)
        {
            // Check if the new credentials are already expired
            if (ShouldUpdate)
            {
                var errorMessage = string.Format(CultureInfo.InvariantCulture,
                    "The retrieved credentials have already expired: Now = {0}, Credentials expiration = {1}",
                    DateTime.Now, state.Expiration);
                throw new AmazonClientException(errorMessage);
            }

            // Offset the Expiration by PreemptExpiryTime
            state.Expiration -= PreemptExpiryTime;

            if (ShouldUpdate)
            {
                // This could happen if the default value of PreemptExpiryTime is
                // overriden and set too high such that ShouldUpdate returns true.
                var logger = Logger.GetLogger(typeof(RefreshingAWSCredentials));
                logger.InfoFormat(
                    "The preempt expiry time is set too high: Current time = {0}, Credentials expiry time = {1}, Preempt expiry time = {2}.",
                    DateTime.Now,
                    _currentState.Expiration,
                    PreemptExpiryTime);
            }
        }

        protected override CredentialsRefreshState GenerateNewCredentials()
        {
            CredentialsRefreshState newState = null;
            try
            {
                // Attempt to get early credentials. OK to fail at this point.
                newState = GetRefreshState();
            }
            catch (Exception e)
            {
                var logger = Logger.GetLogger(typeof(InstanceProfileAWSCredentials));
                logger.InfoFormat("Error getting credentials from Instance Profile service: {0}", e);
            }

            // If successful, save new credentials
            if (newState != null)
                _currentRefreshState = newState;

            // If still not successful (no credentials available at start), attempt once more to
            // get credentials, but now without swallowing exception
            if (_currentRefreshState == null)
                _currentRefreshState = GetRefreshState();

            // Return credentials that will expire in at most one hour
            CredentialsRefreshState state = GetEarlyRefreshState(_currentRefreshState);
            return state;
        }

        private CredentialsRefreshState GetRefreshState()
        {
            SecurityInfo info = GetServiceInfo();
            if (!string.IsNullOrEmpty(info.Message))
            {
                throw new AmazonServiceException(string.Format(CultureInfo.InvariantCulture, 
                    "Unable to retrieve credentials. Message = \"{0}\".",
                    info.Message));
            }
            SecurityCredentials credentials = GetRoleCredentials();

            CredentialsRefreshState refreshState = new CredentialsRefreshState
            {
                Credentials = new ImmutableCredentials(credentials.AccessKeyId, credentials.SecretAccessKey, credentials.Token),
                Expiration = credentials.Expiration
            };

            return refreshState;
        }

 /// <summary>
 /// Clears currently-stored credentials, forcing the next GetCredentials call to generate new credentials.
 /// </summary>
 public virtual void ClearCredentials()
 {
     _currentState = null;
 }

        public async override System.Threading.Tasks.Task<ImmutableCredentials> GetCredentialsAsync()
        {
            // If credentials are expired, update
            if (ShouldUpdate)
            {
                var state = await GenerateNewCredentialsAsync().ConfigureAwait(false);
                lock (this._refreshLock)
                {
                    _currentState = state;
                    UpdateToGeneratedCredentials(_currentState);
                }
            }

            return _currentState.Credentials.Copy();
        }