From 24ee2ef36003df41a1caf4ca278b2741e06545e8 Mon Sep 17 00:00:00 2001 From: Andrea Longo Date: Mon, 12 Feb 2024 08:08:25 -0700 Subject: [PATCH] More RoleARN->RoleArn (#1128) Replace additional occurrences of incorrect `RoleARN` with `RoleArn`. Staged http://192.241.195.202:9000/staging/DOCS-1102-2/linux/index.html Remaining item, fixes https://github.com/minio/docs/issues/1102 --- .../oidc-access-management.rst | 14 +++++++------- .../AssumeRoleWithWebIdentity.rst | 4 ++-- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/source/administration/identity-access-management/oidc-access-management.rst b/source/administration/identity-access-management/oidc-access-management.rst index e96c3688..8022415a 100644 --- a/source/administration/identity-access-management/oidc-access-management.rst +++ b/source/administration/identity-access-management/oidc-access-management.rst @@ -40,19 +40,19 @@ MinIO supports multiple OIDC provider configurations. However, you can configure only **one** JWT claim-based OIDC provider per deployment. All other providers must use RolePolicy. -RolePolicy and RoleARN +RolePolicy and RoleArn ~~~~~~~~~~~~~~~~~~~~~~ -With a RolePolicy, all clients which generate an STS credential using a given RoleARN receive the :ref:`policy or policies ` associated to the RolePolicy configuration for that RoleARN. +With a RolePolicy, all clients which generate an STS credential using a given RoleArn receive the :ref:`policy or policies ` associated to the RolePolicy configuration for that RoleArn. You can use :ref:`OpenID Policy Variables ` to create policies that programmatically manage what each individual user has access to. The login flow for an application using :abbr:`OIDC (OpenID Connect)` credentials with a RolePolicy claim flow is as follows: 1. Create an OIDC Configuration. -2. Record the RoleARN assigned to the configuration either at time of creation or at MinIO start. - Use this RoleARN with the :ref:`AssumeRoleWithWebIdentity ` STS API. -3. Create a RolePolicy to use with the RoleARN. +2. Record the RoleArn assigned to the configuration either at time of creation or at MinIO start. + Use this RoleArn with the :ref:`AssumeRoleWithWebIdentity ` STS API. +3. Create a RolePolicy to use with the RoleArn. Use either the :envvar:`MINIO_IDENTITY_OPENID_ROLE_POLICY` environment variable or the :mc-conf:`identity_openid role_policy ` configuration setting to define the list of policies to use for the provider 4. Users select the configured OIDC provider when logging in to MinIO. 5. Users complete authentication to the configured :abbr:`OIDC (OpenID Connect)` provider and redirect back to MinIO. @@ -61,7 +61,7 @@ The login flow for an application using :abbr:`OIDC (OpenID Connect)` credential Authentication using Implicit Flow is not supported. 6. MinIO verifies the ``RoleArn`` in the API call and checks for the :ref:`RolePolicy ` to use. - Any authentication request with the RoleARN receives the same policy access permissions. + Any authentication request with the RoleArn receives the same policy access permissions. 7. MinIO returns temporary credentials in the STS API response in the form of an access key, secret key, and session token. The credentials have permissions matching those policies specified in the RolePolicy. @@ -131,4 +131,4 @@ OIDC Policy Variables .. include:: /includes/common/common-minio-oidc.rst :start-after: start-minio-oidc-policy-variables - :end-before: end-minio-oidc-policy-variables \ No newline at end of file + :end-before: end-minio-oidc-policy-variables diff --git a/source/developers/security-token-service/AssumeRoleWithWebIdentity.rst b/source/developers/security-token-service/AssumeRoleWithWebIdentity.rst index 4c808768..f3b77efb 100644 --- a/source/developers/security-token-service/AssumeRoleWithWebIdentity.rst +++ b/source/developers/security-token-service/AssumeRoleWithWebIdentity.rst @@ -124,12 +124,12 @@ This endpoint supports the following query parameters: - *Optional* The role Amazon Resource Number (ARN) to use for all user authentication requests. - If used, there must be a matching OIDC RolePolicy defined for the RoleARN's provider by the ``role_policy`` configuration parameter or the ``MINIO_IDENTITY_OPENID_ROLE_POLICY`` environment variable. + If used, there must be a matching OIDC RolePolicy defined for the RoleArn's provider by the ``role_policy`` configuration parameter or the ``MINIO_IDENTITY_OPENID_ROLE_POLICY`` environment variable. When used, all valid authorization requests assume the same set of permissions provided by the RolePolicy. You can use :ref:`OpenID Policy Variables ` to create policies that programmatically manage what each individual user has access to. - If you do not supply a RoleARN, MinIO attempts to authorize through a JWT-based claim. + If you do not supply a RoleArn, MinIO attempts to authorize through a JWT-based claim. Response Elements -----------------