storj.io/minio@v0.0.0-20230509071714-0cbc90f649b1/docs/sts/web-identity.md (about) 1 # AssumeRoleWithWebIdentity [](https://slack.min.io) 2 3 **Table of Contents** 4 5 - [Introduction](#introduction) 6 - [API Request Parameters](#api-request-parameters) 7 - [WebIdentityToken](#webidentitytoken) 8 - [Version](#version) 9 - [DurationSeconds](#durationseconds) 10 - [Policy](#policy) 11 - [Response Elements](#response-elements) 12 - [Errors](#errors) 13 - [Sample `POST` Request](#sample-post-request) 14 - [Sample Response](#sample-response) 15 - [Using WebIdentity API](#using-webidentity-api) 16 - [Authorization Flow](#authorization-flow) 17 - [Using MinIO Browser](#using-minio-browser) 18 - [Explore Further](#explore-further) 19 20 ## Introduction 21 22 Calling AssumeRoleWithWebIdentity does not require the use of MinIO default credentials. Therefore, you can distribute an application (for example, on mobile devices) that requests temporary security credentials without including MinIO default credentials in the application. Instead, the identity of the caller is validated by using a JWT access token from the web identity provider. The temporary security credentials returned by this API consists of an access key, a secret key, and a security token. Applications can use these temporary security credentials to sign calls to MinIO API operations. 23 24 By default, the temporary security credentials created by AssumeRoleWithWebIdentity last for one hour. However, use the optional DurationSeconds parameter to specify the duration of the credentials. This value varies from 900 seconds (15 minutes) up to the maximum session duration of 7 days. 25 26 ## API Request Parameters 27 ### WebIdentityToken 28 The OAuth 2.0 access token that is provided by the web identity provider. Application must get this token by authenticating the user who is using your application with a web identity provider before the application makes an AssumeRoleWithWebIdentity call. 29 30 | Params | Value | 31 | :-- | :-- | 32 | *Type* | *String* | 33 | *Length Constraints* | *Minimum length of 4. Maximum length of 2048.* | 34 | *Required* | *Yes* | 35 36 ### Version 37 Indicates STS API version information, the only supported value is '2011-06-15'. This value is borrowed from AWS STS API documentation for compatibility reasons. 38 39 | Params | Value | 40 | :-- | :-- | 41 | *Type* | *String* | 42 | *Required* | *Yes* | 43 44 ### DurationSeconds 45 The duration, in seconds. The value can range from 900 seconds (15 minutes) up to 7 days. If value is higher than this setting, then operation fails. By default, the value is set to 3600 seconds. If no *DurationSeconds* is specified expiry seconds is obtained from *WebIdentityToken*. 46 47 | Params | Value | 48 | :-- | :-- | 49 | *Type* | *Integer* | 50 | *Valid Range* | *Minimum value of 900. Maximum value of 604800.* | 51 | *Required* | *No* | 52 53 ### Policy 54 An IAM policy in JSON format that you want to use as an inline session policy. This parameter is optional. Passing policies to this operation returns new temporary credentials. The resulting session's permissions are the intersection of the canned policy name and the policy set here. You cannot use this policy to grant more permissions than those allowed by the canned policy name being assumed. 55 56 | Params | Value | 57 | :-- | :-- | 58 | *Type* | *String* | 59 | *Valid Range* | *Minimum length of 1. Maximum length of 2048.* | 60 | *Required* | *No* | 61 62 ### Response Elements 63 XML response for this API is similar to [AWS STS AssumeRoleWithWebIdentity](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html#API_AssumeRoleWithWebIdentity_ResponseElements) 64 65 ### Errors 66 XML error response for this API is similar to [AWS STS AssumeRoleWithWebIdentity](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html#API_AssumeRoleWithWebIdentity_Errors) 67 68 ## Sample `POST` Request 69 ``` 70 http://minio.cluster:9000?Action=AssumeRoleWithWebIdentity&DurationSeconds=3600&WebIdentityToken=eyJ4NXQiOiJOVEF4Wm1NeE5ETXlaRGczTVRVMVpHTTBNekV6T0RKaFpXSTRORE5sWkRVMU9HRmtOakZpTVEiLCJraWQiOiJOVEF4Wm1NeE5ETXlaRGczTVRVMVpHTTBNekV6T0RKaFpXSTRORE5sWkRVMU9HRmtOakZpTVEiLCJhbGciOiJSUzI1NiJ9.eyJhdWQiOiJQb0VnWFA2dVZPNDVJc0VOUm5nRFhqNUF1NVlhIiwiYXpwIjoiUG9FZ1hQNnVWTzQ1SXNFTlJuZ0RYajVBdTVZYSIsImlzcyI6Imh0dHBzOlwvXC9sb2NhbGhvc3Q6OTQ0M1wvb2F1dGgyXC90b2tlbiIsImV4cCI6MTU0MTgwOTU4MiwiaWF0IjoxNTQxODA1OTgyLCJqdGkiOiI2Y2YyMGIwZS1lNGZmLTQzZmQtYTdiYS1kYTc3YTE3YzM2MzYifQ.Jm29jPliRvrK6Os34nSK3rhzIYLFjE__zdVGNng3uGKXGKzP3We_i6NPnhA0szJXMOKglXzUF1UgSz8MctbaxFS8XDusQPVe4LkB_45hwBm6TmBxzui911nt-1RbBLN_jZIlvl2lPrbTUH5hSn9kEkph6seWanTNQpz9tNEoVa6R_OX3kpJqxe8tLQUWw453A1JTwFNhdHa6-f1K8_Q_eEZ_4gOYINQ9t_fhTibdbkXZkJQFLop-Jwoybi9s4nwQU_dATocgcufq5eCeNItQeleT-23lGxIz0X7CiJrJynYLdd-ER0F77SumqEb5iCxhxuf4H7dovwd1kAmyKzLxpw&Version=2011-06-15 71 ``` 72 73 ## Sample Response 74 ``` 75 <?xml version="1.0" encoding="UTF-8"?> 76 <AssumeRoleWithWebIdentityResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/"> 77 <AssumeRoleWithWebIdentityResult> 78 <AssumedRoleUser> 79 <Arn/> 80 <AssumeRoleId/> 81 </AssumedRoleUser> 82 <Credentials> 83 <AccessKeyId>Y4RJU1RNFGK48LGO9I2S</AccessKeyId> 84 <SecretAccessKey>sYLRKS1Z7hSjluf6gEbb9066hnx315wHTiACPAjg</SecretAccessKey> 85 <Expiration>2019-08-08T20:26:12Z</Expiration> 86 <SessionToken>eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJhY2Nlc3NLZXkiOiJZNFJKVTFSTkZHSzQ4TEdPOUkyUyIsImF1ZCI6IlBvRWdYUDZ1Vk80NUlzRU5SbmdEWGo1QXU1WWEiLCJhenAiOiJQb0VnWFA2dVZPNDVJc0VOUm5nRFhqNUF1NVlhIiwiZXhwIjoxNTQxODExMDcxLCJpYXQiOjE1NDE4MDc0NzEsImlzcyI6Imh0dHBzOi8vbG9jYWxob3N0Ojk0NDMvb2F1dGgyL3Rva2VuIiwianRpIjoiYTBiMjc2MjktZWUxYS00M2JmLTg3MzktZjMzNzRhNGNkYmMwIn0.ewHqKVFTaP-j_kgZrcOEKroNUjk10GEp8bqQjxBbYVovV0nHO985VnRESFbcT6XMDDKHZiWqN2vi_ETX_u3Q-w</SessionToken> 87 </Credentials> 88 </AssumeRoleWithWebIdentityResult> 89 <ResponseMetadata/> 90 </AssumeRoleWithWebIdentityResponse> 91 ``` 92 93 ## Using WebIdentity API 94 ``` 95 export MINIO_ROOT_USER=minio 96 export MINIO_ROOT_PASSWORD=minio123 97 export MINIO_IDENTITY_OPENID_CONFIG_URL=https://accounts.google.com/.well-known/openid-configuration 98 export MINIO_IDENTITY_OPENID_CLIENT_ID="843351d4-1080-11ea-aa20-271ecba3924a" 99 # Optional: Allow to specify the requested OpenID scopes (OpenID only requires the `openid` scope) 100 #export MINIO_IDENTITY_OPENID_SCOPES="openid,profile,email" 101 minio server /mnt/export 102 ``` 103 104 or using `mc` 105 ``` 106 mc admin config get myminio identity_openid 107 identity_openid config_url=https://accounts.google.com/.well-known/openid-configuration client_id=843351d4-1080-11ea-aa20-271ecba3924a 108 ``` 109 110 Testing with an example 111 > Visit [Google Developer Console](https://console.cloud.google.com) under Project, APIs, Credentials to get your OAuth2 client credentials. Add `http://localhost:8080/oauth2/callback` as a valid OAuth2 Redirect URL. 112 113 ``` 114 $ go run web-identity.go -cid 204367807228-ok7601k6gj1pgge7m09h7d79co8p35xx.apps.googleusercontent.com -csec XsT_PgPdT1nO9DD45rMLJw7G 115 2018/12/26 17:49:36 listening on http://localhost:8080/ 116 ``` 117 118 > NOTE: for a reasonable test outcome, make sure the assumed user has at least permission/policy to list all buckets. That policy would look like below: 119 ``` 120 { 121 "version": "2012-10-17", 122 "statement": [ 123 { 124 "effect": "Allow", 125 "action": [ 126 "s3:ListAllMyBuckets" 127 ], 128 "resource": [ 129 "arn:aws:s3:::*" 130 ] 131 } 132 ] 133 } 134 ``` 135 136 ## Authorization Flow 137 138 - Visit http://localhost:8080, login will direct the user to the Google OAuth2 Auth URL to obtain a permission grant. 139 - The redirection URI (callback handler) receives the OAuth2 callback, verifies the state parameter, and obtains a Token. 140 - Using the access token the callback handler further talks to Google OAuth2 Token URL to obtain an JWT id_token. 141 - Once obtained the JWT id_token is further sent to STS endpoint i.e MinIO to retrive temporary credentials. 142 - Temporary credentials are displayed on the browser upon successful retrieval. 143 144 ## Using MinIO Browser 145 To support WebIdentity login on MinIO Browser, set openid configuration and restart MinIO 146 147 ``` 148 mc admin config set myminio identity_openid config_url="<CONFIG_URL>" client_id="<client_identifier>" 149 ``` 150 151 ``` 152 mc admin service restart myminio 153 ``` 154 155 Sample URLs for Keycloak are 156 157 `config_url` - `http://localhost:8080/auth/realms/demo/.well-known/openid-configuration` 158 159 JWT token returned by the Identity Provider should include a custom claim for the policy, this is required to create a STS user in MinIO. The name of the custom claim could be either `policy` or `<NAMESPACE_PREFIX>policy`. If there is no namespace then `claim_prefix` can be ingored. For example if the custom claim name is `https://min.io/policy` then, `claim_prefix` should be set as `https://min.io/`. 160 161 - Open MinIO Browser and click `Log in with OpenID` 162 - Enter the `Client ID` obtained from Identity Provider and press ENTER, if not you can set a `client_id` on server to avoid this step. 163 - The user will be redirected to the Identity Provider login page 164 - Upon successful login on Identity Provider page the user will be automatically logged into MinIO Browser 165 166 ## Explore Further 167 - [MinIO Admin Complete Guide](https://docs.min.io/docs/minio-admin-complete-guide.html) 168 - [The MinIO documentation website](https://docs.min.io)