github.com/minio/minio@v0.0.0-20240328213742-3f72439b8a27/docs/sts/custom-token-identity.go (about)

     1  //go:build ignore
     2  // +build ignore
     3  
     4  // Copyright (c) 2015-2022 MinIO, Inc.
     5  //
     6  // This file is part of MinIO Object Storage stack
     7  //
     8  // This program is free software: you can redistribute it and/or modify
     9  // it under the terms of the GNU Affero General Public License as published by
    10  // the Free Software Foundation, either version 3 of the License, or
    11  // (at your option) any later version.
    12  //
    13  // This program is distributed in the hope that it will be useful
    14  // but WITHOUT ANY WARRANTY; without even the implied warranty of
    15  // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
    16  // GNU Affero General Public License for more details.
    17  //
    18  // You should have received a copy of the GNU Affero General Public License
    19  // along with this program.  If not, see <http://www.gnu.org/licenses/>.
    20  
    21  package main
    22  
    23  import (
    24  	"context"
    25  	"flag"
    26  	"fmt"
    27  	"log"
    28  	"net/url"
    29  	"time"
    30  
    31  	"github.com/minio/minio-go/v7"
    32  	cr "github.com/minio/minio-go/v7/pkg/credentials"
    33  )
    34  
    35  var (
    36  	// LDAP integrated Minio endpoint
    37  	stsEndpoint string
    38  
    39  	// token to use with AssumeRoleWithCustomToken
    40  	token string
    41  
    42  	// Role ARN to use
    43  	roleArn string
    44  
    45  	// Display credentials flag
    46  	displayCreds bool
    47  
    48  	// Credential expiry duration
    49  	expiryDuration time.Duration
    50  
    51  	// Bucket to list
    52  	bucketToList string
    53  )
    54  
    55  func init() {
    56  	flag.StringVar(&stsEndpoint, "sts-ep", "http://localhost:9000", "STS endpoint")
    57  	flag.StringVar(&token, "t", "", "Token to use with AssumeRoleWithCustomToken STS API (required)")
    58  	flag.StringVar(&roleArn, "r", "", "RoleARN to use with the request (required)")
    59  	flag.BoolVar(&displayCreds, "d", false, "Only show generated credentials")
    60  	flag.DurationVar(&expiryDuration, "e", 0, "Request a duration of validity for the generated credential")
    61  	flag.StringVar(&bucketToList, "b", "mybucket", "Bucket to list (defaults to mybucket)")
    62  }
    63  
    64  func main() {
    65  	flag.Parse()
    66  	if token == "" || roleArn == "" {
    67  		flag.PrintDefaults()
    68  		return
    69  	}
    70  
    71  	// The credentials package in minio-go provides an interface to call the
    72  	// AssumeRoleWithCustomToken STS API.
    73  
    74  	var opts []cr.CustomTokenOpt
    75  	if expiryDuration != 0 {
    76  		opts = append(opts, cr.CustomTokenValidityOpt(expiryDuration))
    77  	}
    78  
    79  	// Initialize
    80  	li, err := cr.NewCustomTokenCredentials(stsEndpoint, token, roleArn, opts...)
    81  	if err != nil {
    82  		log.Fatalf("Error initializing CustomToken Identity: %v", err)
    83  	}
    84  
    85  	v, err := li.Get()
    86  	if err != nil {
    87  		log.Fatalf("Error retrieving STS credentials: %v", err)
    88  	}
    89  
    90  	if displayCreds {
    91  		fmt.Println("Only displaying credentials:")
    92  		fmt.Println("AccessKeyID:", v.AccessKeyID)
    93  		fmt.Println("SecretAccessKey:", v.SecretAccessKey)
    94  		fmt.Println("SessionToken:", v.SessionToken)
    95  		return
    96  	}
    97  
    98  	// Use generated credentials to authenticate with MinIO server
    99  	stsEndpointURL, err := url.Parse(stsEndpoint)
   100  	if err != nil {
   101  		log.Fatalf("Error parsing sts endpoint: %v", err)
   102  	}
   103  	copts := &minio.Options{
   104  		Creds:  li,
   105  		Secure: stsEndpointURL.Scheme == "https",
   106  	}
   107  	minioClient, err := minio.New(stsEndpointURL.Host, copts)
   108  	if err != nil {
   109  		log.Fatalf("Error initializing client: ", err)
   110  	}
   111  
   112  	// Use minIO Client object normally like the regular client.
   113  	fmt.Printf("Calling list objects on bucket named `%s` with temp creds:\n===\n", bucketToList)
   114  	objCh := minioClient.ListObjects(context.Background(), bucketToList, minio.ListObjectsOptions{})
   115  	for obj := range objCh {
   116  		if obj.Err != nil {
   117  			log.Fatalf("Listing error: %v", obj.Err)
   118  		}
   119  		fmt.Printf("Key: %s\nSize: %d\nLast Modified: %s\n===\n", obj.Key, obj.Size, obj.LastModified)
   120  	}
   121  }