mirror of
https://github.com/pgsty/minio.git
synced 2026-08-09 15:53:28 +03:00
Feng Ruohang
fd2ca1c6d2
README, README_ZH, SECURITY, COMPLIANCE, CONTRIBUTING, NOTICE, code_of_conduct, the vulnerability and PR-etiquette documents, the GitHub issue and pull request templates, and the docs/ tree all present Silo as the product. The Grafana dashboards under docs/metrics/prometheus/grafana/ have their panel titles and descriptions rebranded while every minio_* query, label and expression is left alone, so existing alerts and recording rules keep matching. The distinction the review demanded is applied per hit rather than by search-and-replace: - Product and command text becomes Silo and silo: install and run instructions, systemd examples, compose services, download links, badges. - Protocol and interface text keeps MinIO: MINIO_* variables, minio_* metrics, x-minio-* headers, /minio/* routes, .minio.sys, arn:minio, and API field and error names. - Attribution keeps MinIO and gains the fork's own: the AGPL obligations, original copyright, CREDITS and NOTICE stay, with the modification notice added alongside rather than replacing them. - Historical and third-party references are left as facts, not rewritten for brand tidiness. README and README_ZH each carry an explicit non-affiliation notice, document the side-by-side package migration including the /etc/systemd/system/silo.service.d/10-legacy-user.conf drop-in for keeping a legacy UID/GID, and state that recursive chown is never performed. The trademark attribution uses the policy's approved "based on MinIO technology" wording, not the shortened form the policy rejects. github.com/pgsty/minio links are left in place and labelled transitional. The repository has not been renamed, and rewriting them now would produce documented URLs that 404 until the cutover; they change in the cutover commit together with the goreleaser release target, the OCI source label and the raw-content branch. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
54 lines
2.9 KiB
Markdown
54 lines
2.9 KiB
Markdown
# AssumeRoleWithCustomToken
|
|
|
|
## Introduction
|
|
|
|
To integrate with custom authentication methods using the [Identity Management Plugin](../iam/identity-management-plugin.md)), Silo provides an STS API extension called `AssumeRoleWithCustomToken`.
|
|
|
|
After configuring the plugin, use the generated Role ARN with `AssumeRoleWithCustomToken` to get temporary credentials to access object storage.
|
|
|
|
## API Request
|
|
|
|
To make an STS API request with this method, send a POST request to the Silo endpoint with following query parameters:
|
|
|
|
| Parameter | Type | Required | |
|
|
|-----------------|---------|----------|----------------------------------------------------------------------|
|
|
| Action | String | Yes | Value must be `AssumeRoleWithCustomToken` |
|
|
| Version | String | Yes | Value must be `2011-06-15` |
|
|
| Token | String | Yes | Token to be authenticated by identity plugin |
|
|
| RoleArn | String | Yes | Must match the Role ARN generated for the identity plugin |
|
|
| DurationSeconds | Integer | No | Duration of validity of generated credentials. Must be at least 900. |
|
|
|
|
The validity duration of the generated STS credentials is the minimum of the `DurationSeconds` parameter (if passed) and the validity duration returned by the Identity Management Plugin.
|
|
|
|
## API Response
|
|
|
|
XML response for this API is similar to [AWS STS AssumeRoleWithWebIdentity](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html#API_AssumeRoleWithWebIdentity_ResponseElements)
|
|
|
|
## Example request and response
|
|
|
|
Sample request with `curl`:
|
|
|
|
```sh
|
|
curl -XPOST 'http://localhost:9001/?Action=AssumeRoleWithCustomToken&Version=2011-06-15&Token=aaa&RoleArn=arn:minio:iam:::role/idmp-vGxBdLkOc8mQPU1-UQbBh-yWWVQ'
|
|
```
|
|
|
|
Prettified Response:
|
|
|
|
```xml
|
|
<?xml version="1.0" encoding="UTF-8"?>
|
|
<AssumeRoleWithCustomTokenResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
|
|
<AssumeRoleWithCustomTokenResult>
|
|
<Credentials>
|
|
<AccessKeyId>24Y5H9VHE14H47GEOKCX</AccessKeyId>
|
|
<SecretAccessKey>H+aBfQ9B1AeWWb++84hvp4tlFBo9aP+hUTdLFIeg</SecretAccessKey>
|
|
<Expiration>2022-05-25T19:56:34Z</Expiration>
|
|
<SessionToken>eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJhY2Nlc3NLZXkiOiIyNFk1SDlWSEUxNEg0N0dFT0tDWCIsImV4cCI6MTY1MzUwODU5NCwiZ3JvdXBzIjpbImRhdGEtc2NpZW5jZSJdLCJwYXJlbnQiOiJjdXN0b206QWxpY2UiLCJyb2xlQXJuIjoiYXJuOm1pbmlvOmlhbTo6OnJvbGUvaWRtcC14eHgiLCJzdWIiOiJjdXN0b206QWxpY2UifQ.1tO1LmlUNXiy-wl-ZbkJLWTpaPlhaGqHehsi21lNAmAGCImHHsPb-GA4lRq6GkvHAODN5ZYCf_S-OwpOOdxFwA</SessionToken>
|
|
</Credentials>
|
|
<AssumedUser>custom:Alice</AssumedUser>
|
|
</AssumeRoleWithCustomTokenResult>
|
|
<ResponseMetadata>
|
|
<RequestId>16F26E081E36DE63</RequestId>
|
|
</ResponseMetadata>
|
|
</AssumeRoleWithCustomTokenResponse>
|
|
```
|