diff --git a/source/administration/identity-access-management/oidc-access-management.rst b/source/administration/identity-access-management/oidc-access-management.rst index e96c3688..8022415a 100644 --- a/source/administration/identity-access-management/oidc-access-management.rst +++ b/source/administration/identity-access-management/oidc-access-management.rst @@ -40,19 +40,19 @@ MinIO supports multiple OIDC provider configurations. However, you can configure only **one** JWT claim-based OIDC provider per deployment. All other providers must use RolePolicy. -RolePolicy and RoleARN +RolePolicy and RoleArn ~~~~~~~~~~~~~~~~~~~~~~ -With a RolePolicy, all clients which generate an STS credential using a given RoleARN receive the :ref:`policy or policies ` associated to the RolePolicy configuration for that RoleARN. +With a RolePolicy, all clients which generate an STS credential using a given RoleArn receive the :ref:`policy or policies ` associated to the RolePolicy configuration for that RoleArn. You can use :ref:`OpenID Policy Variables ` to create policies that programmatically manage what each individual user has access to. The login flow for an application using :abbr:`OIDC (OpenID Connect)` credentials with a RolePolicy claim flow is as follows: 1. Create an OIDC Configuration. -2. Record the RoleARN assigned to the configuration either at time of creation or at MinIO start. - Use this RoleARN with the :ref:`AssumeRoleWithWebIdentity ` STS API. -3. Create a RolePolicy to use with the RoleARN. +2. Record the RoleArn assigned to the configuration either at time of creation or at MinIO start. + Use this RoleArn with the :ref:`AssumeRoleWithWebIdentity ` STS API. +3. Create a RolePolicy to use with the RoleArn. Use either the :envvar:`MINIO_IDENTITY_OPENID_ROLE_POLICY` environment variable or the :mc-conf:`identity_openid role_policy ` configuration setting to define the list of policies to use for the provider 4. Users select the configured OIDC provider when logging in to MinIO. 5. Users complete authentication to the configured :abbr:`OIDC (OpenID Connect)` provider and redirect back to MinIO. @@ -61,7 +61,7 @@ The login flow for an application using :abbr:`OIDC (OpenID Connect)` credential Authentication using Implicit Flow is not supported. 6. MinIO verifies the ``RoleArn`` in the API call and checks for the :ref:`RolePolicy ` to use. - Any authentication request with the RoleARN receives the same policy access permissions. + Any authentication request with the RoleArn receives the same policy access permissions. 7. MinIO returns temporary credentials in the STS API response in the form of an access key, secret key, and session token. The credentials have permissions matching those policies specified in the RolePolicy. @@ -131,4 +131,4 @@ OIDC Policy Variables .. include:: /includes/common/common-minio-oidc.rst :start-after: start-minio-oidc-policy-variables - :end-before: end-minio-oidc-policy-variables \ No newline at end of file + :end-before: end-minio-oidc-policy-variables diff --git a/source/developers/security-token-service/AssumeRoleWithWebIdentity.rst b/source/developers/security-token-service/AssumeRoleWithWebIdentity.rst index 4c808768..f3b77efb 100644 --- a/source/developers/security-token-service/AssumeRoleWithWebIdentity.rst +++ b/source/developers/security-token-service/AssumeRoleWithWebIdentity.rst @@ -124,12 +124,12 @@ This endpoint supports the following query parameters: - *Optional* The role Amazon Resource Number (ARN) to use for all user authentication requests. - If used, there must be a matching OIDC RolePolicy defined for the RoleARN's provider by the ``role_policy`` configuration parameter or the ``MINIO_IDENTITY_OPENID_ROLE_POLICY`` environment variable. + If used, there must be a matching OIDC RolePolicy defined for the RoleArn's provider by the ``role_policy`` configuration parameter or the ``MINIO_IDENTITY_OPENID_ROLE_POLICY`` environment variable. When used, all valid authorization requests assume the same set of permissions provided by the RolePolicy. You can use :ref:`OpenID Policy Variables ` to create policies that programmatically manage what each individual user has access to. - If you do not supply a RoleARN, MinIO attempts to authorize through a JWT-based claim. + If you do not supply a RoleArn, MinIO attempts to authorize through a JWT-based claim. Response Elements -----------------