minio/docs
1
0
Fork 0
mirror of https://github.com/minio/docs.git synced 2025-07-31 18:04:52 +03:00
Code Activity

More RoleARN->RoleArn (#1128)

Browse Source 
Replace additional occurrences of incorrect `RoleARN` with `RoleArn`.

Staged
http://192.241.195.202:9000/staging/DOCS-1102-2/linux/index.html

Remaining item, fixes https://github.com/minio/docs/issues/1102
This commit is contained in:
Andrea Longo
2024-02-12 08:08:25 -07:00
committed by GitHub
parent 431675e429
commit 24ee2ef360
2 changed files with 9 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
source/administration/identity-access-management/oidc-access-management.rst
View File

@ -40,19 +40,19 @@ MinIO supports multiple OIDC provider configurations.
However, you can configure only **one** JWT claim-based OIDC provider per deployment.
All other providers must use RolePolicy.
RolePolicy and RoleARN
RolePolicy and RoleArn
~~~~~~~~~~~~~~~~~~~~~~
With a RolePolicy, all clients which generate an STS credential using a given RoleARN receive the :ref:`policy or policies <minio-policy>` associated to the RolePolicy configuration for that RoleARN.
With a RolePolicy, all clients which generate an STS credential using a given RoleArn receive the :ref:`policy or policies <minio-policy>` associated to the RolePolicy configuration for that RoleArn.
You can use :ref:`OpenID Policy Variables <minio-policy-variables-oidc>` to create policies that programmatically manage what each individual user has access to.
The login flow for an application using :abbr:`OIDC (OpenID Connect)` credentials with a RolePolicy claim flow is as follows:
1. Create an OIDC Configuration.
2. Record the RoleARN assigned to the configuration either at time of creation or at MinIO start.
Use this RoleARN with the :ref:`AssumeRoleWithWebIdentity <minio-sts-assumerolewithwebidentity>` STS API.
3. Create a RolePolicy to use with the RoleARN.
2. Record the RoleArn assigned to the configuration either at time of creation or at MinIO start.
Use this RoleArn with the :ref:`AssumeRoleWithWebIdentity <minio-sts-assumerolewithwebidentity>` STS API.
3. Create a RolePolicy to use with the RoleArn.
Use either the :envvar:`MINIO_IDENTITY_OPENID_ROLE_POLICY` environment variable or the :mc-conf:`identity_openid role_policy <identity_openid.role_policy>` configuration setting to define the list of policies to use for the provider
4. Users select the configured OIDC provider when logging in to MinIO.
5. Users complete authentication to the configured :abbr:`OIDC (OpenID Connect)` provider and redirect back to MinIO.
@ -61,7 +61,7 @@ The login flow for an application using :abbr:`OIDC (OpenID Connect)` credential
Authentication using Implicit Flow is not supported.
6. MinIO verifies the ``RoleArn`` in the API call and checks for the :ref:`RolePolicy <minio-external-identity-management-openid-access-control>` to use.
Any authentication request with the RoleARN receives the same policy access permissions.
Any authentication request with the RoleArn receives the same policy access permissions.
7. MinIO returns temporary credentials in the STS API response in the form of an access key, secret key, and session token.
The credentials have permissions matching those policies specified in the RolePolicy.

4
source/developers/security-token-service/AssumeRoleWithWebIdentity.rst
View File

@ -124,12 +124,12 @@ This endpoint supports the following query parameters:
- *Optional*
The role Amazon Resource Number (ARN) to use for all user authentication requests.
If used, there must be a matching OIDC RolePolicy defined for the RoleARN's provider by the ``role_policy`` configuration parameter or the ``MINIO_IDENTITY_OPENID_ROLE_POLICY`` environment variable.
If used, there must be a matching OIDC RolePolicy defined for the RoleArn's provider by the ``role_policy`` configuration parameter or the ``MINIO_IDENTITY_OPENID_ROLE_POLICY`` environment variable.
When used, all valid authorization requests assume the same set of permissions provided by the RolePolicy.
You can use :ref:`OpenID Policy Variables <minio-policy-variables-oidc>` to create policies that programmatically manage what each individual user has access to.
If you do not supply a RoleARN, MinIO attempts to authorize through a JWT-based claim.
If you do not supply a RoleArn, MinIO attempts to authorize through a JWT-based claim.
Response Elements
-----------------