minio/docs

mirror of https://github.com/minio/docs.git synced 2025-09-10 20:12:12 +03:00

Files

Allan Roger Reid 2208441e31 Specify RFC3339 and not ISO-8601 data and time (#1419 )

MinIO uses RFC3339 data and time formatting and not ISO-8601. RFC3339
requires that there be a `T` as part of the data and time separation.
ISO-8601 allows a space.
The documentation also currently refers to using a date in the batch
framework; this should be a RFC3339 date and time.
e.g.
```
mc batch start play expire.yaml
mc: <ERROR> Unable to start job. We encountered an internal error, please try again.: cause(parsing time "2006-01-02 15:04:05.00Z" as "2006-01-02T15:04:05Z07:00": cannot parse " 15:04:05.00Z" as "T").

```

---------

Co-authored-by: Ravind Kumar <ravindk89@gmail.com>

2025-02-18 14:25:57 -05:00

3.6 KiB

Raw Blame History

`AssumeRoleWithCustomToken`

minio

Table of Contents

The MinIO Security Token Service (STS) AssumeRoleWithCustomToken API endpoint generates a token for use with the minio-external-identity-management-plugin.

Request Endpoint

The AssumeRoleWithCustomToken endpoint has the following form:

POST https://minio.example.net?Action=AssumeRoleWithCustomToken[&ARGS]

The following example uses all supported arguments. Replace the minio.example.net hostname with the appropriate URL for your MinIO cluster:

POST https://minio.example.net?Action=AssumeRoleWithCustomToken
&Token=TOKEN
&Version=2011-06-15
&DurationSeconds=86000
&RoleArn="external-auth-provider"

Request Query Parameters

This endpoint supports the following query parameters:

Parameter	Type	Description
`Token`	string	Required Specify the JSON Token to present to the external identity manager. MinIO expects the identity manager to parse the token and determine whether to authenticate client requests using that token.
`Version`	string	Required Specify `2011-06-15`.
`RoleArn`	string	Required Specify the ARN for the Identity Manager Plugin configuration to associate with this STS request. See `MINIO_IDENTITY_PLUGIN_ROLE_ID` or `identity_plugin role_id <identity_plugin.role_id>` for more information.
`DurationSeconds`	integer	Optional Specify the number of seconds after which the temporary credentials expire. Defaults to `3600`. The minimum value is `900` or 15 minutes. The maximum value is `604800` or 7 days.

Response Elements

MinIO returns an AssumeRoleWithCustomTokenResult object, where the AssumedRoleUser.Credentials object contains the temporary credentials generated by MinIO:

AccessKeyId - The access key applications use for authentication.
SecretKeyId - The secret key applications use for authentication.
Expiration - The RFC3339 <3339> date and time after which the credentials expire.
SessionToken - The session token applications use for authentication. Some SDKs may require this field when using temporary credentials.

The following example is similar to the response returned by the MinIO STS AssumeRoleWithCustomToken endpoint:

<?xml version="1.0" encoding="UTF-8"?>
<AssumeRoleWithCustomTokenResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
<AssumeRoleWithCustomTokenResult>
   <Credentials>
      <AccessKeyId>ACCESS_KEY</AccessKeyId>
      <SecretAccessKey>SECRET_KEY</SecretAccessKey>
      <Expiration>YYYY-MM-DDTHH:MM:SSZ</Expiration>
      <SessionToken>TOKEN</SessionToken>
   </Credentials>
   <AssumedUser>custom:Alice</AssumedUser>
</AssumeRoleWithCustomTokenResult>
<ResponseMetadata>
   <RequestId>UNIQUE_ID</RequestId>
</ResponseMetadata>
</AssumeRoleWithCustomTokenResponse>

Error Elements

The XML error response for this API endpoint is similar to the AWS AssumeRoleWithWebIdentity response <STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html#API_AssumeRoleWithWebIdentity_Errors>.

3.6 KiB Raw Blame History

AssumeRoleWithCustomToken