OP#792 initial commit after fork
This commit is contained in:
104
docs/sts/.gitignore
vendored
Normal file
104
docs/sts/.gitignore
vendored
Normal file
@@ -0,0 +1,104 @@
|
||||
# Byte-compiled / optimized / DLL files
|
||||
__pycache__/
|
||||
*.py[cod]
|
||||
*$py.class
|
||||
|
||||
# C extensions
|
||||
*.so
|
||||
|
||||
# Distribution / packaging
|
||||
.Python
|
||||
build/
|
||||
develop-eggs/
|
||||
dist/
|
||||
downloads/
|
||||
eggs/
|
||||
.eggs/
|
||||
lib/
|
||||
lib64/
|
||||
parts/
|
||||
sdist/
|
||||
var/
|
||||
wheels/
|
||||
*.egg-info/
|
||||
.installed.cfg
|
||||
*.egg
|
||||
MANIFEST
|
||||
|
||||
# PyInstaller
|
||||
# Usually these files are written by a python script from a template
|
||||
# before PyInstaller builds the exe, so as to inject date/other infos into it.
|
||||
*.manifest
|
||||
*.spec
|
||||
|
||||
# Installer logs
|
||||
pip-log.txt
|
||||
pip-delete-this-directory.txt
|
||||
|
||||
# Unit test / coverage reports
|
||||
htmlcov/
|
||||
.tox/
|
||||
.coverage
|
||||
.coverage.*
|
||||
.cache
|
||||
nosetests.xml
|
||||
coverage.xml
|
||||
*.cover
|
||||
.hypothesis/
|
||||
.pytest_cache/
|
||||
|
||||
# Translations
|
||||
*.mo
|
||||
*.pot
|
||||
|
||||
# Django stuff:
|
||||
*.log
|
||||
local_settings.py
|
||||
db.sqlite3
|
||||
|
||||
# Flask stuff:
|
||||
instance/
|
||||
.webassets-cache
|
||||
|
||||
# Scrapy stuff:
|
||||
.scrapy
|
||||
|
||||
# Sphinx documentation
|
||||
docs/_build/
|
||||
|
||||
# PyBuilder
|
||||
target/
|
||||
|
||||
# Jupyter Notebook
|
||||
.ipynb_checkpoints
|
||||
|
||||
# pyenv
|
||||
.python-version
|
||||
|
||||
# celery beat schedule file
|
||||
celerybeat-schedule
|
||||
|
||||
# SageMath parsed files
|
||||
*.sage.py
|
||||
|
||||
# Environments
|
||||
.env
|
||||
.venv
|
||||
env/
|
||||
venv/
|
||||
ENV/
|
||||
env.bak/
|
||||
venv.bak/
|
||||
|
||||
# Spyder project settings
|
||||
.spyderproject
|
||||
.spyproject
|
||||
|
||||
# Rope project settings
|
||||
.ropeproject
|
||||
|
||||
# mkdocs documentation
|
||||
/site
|
||||
|
||||
# mypy
|
||||
.mypy_cache/
|
||||
110
docs/sts/README.md
Normal file
110
docs/sts/README.md
Normal file
@@ -0,0 +1,110 @@
|
||||
# MinIO STS Quickstart Guide [](https://slack.min.io)
|
||||
|
||||
The MinIO Security Token Service (STS) is an endpoint service that enables clients to request temporary credentials for MinIO resources. Temporary credentials work almost identically to default admin credentials, with some differences:
|
||||
|
||||
- Temporary credentials are short-term, as the name implies. They can be configured to last for anywhere from a few minutes to several hours. After the credentials expire, MinIO no longer recognizes them or allows any kind of access from API requests made with them.
|
||||
- Temporary credentials do not need to be stored with the application but are generated dynamically and provided to the application when requested. When (or even before) the temporary credentials expire, the application can request new credentials.
|
||||
|
||||
Following are advantages for using temporary credentials:
|
||||
|
||||
- Eliminates the need to embed long-term credentials with an application.
|
||||
- Eliminates the need to provide access to buckets and objects without having to define static credentials.
|
||||
- Temporary credentials have a limited lifetime, there is no need to rotate them or explicitly revoke them. Expired temporary credentials cannot be reused.
|
||||
|
||||
## Identity Federation
|
||||
|
||||
| AuthN | Description |
|
||||
| :---------------------- | ------------------------------------------ |
|
||||
| [**WebIdentity**](https://github.com/minio/minio/blob/master/docs/sts/web-identity.md) | Let users request temporary credentials using any OpenID(OIDC) compatible web identity providers such as KeyCloak, Dex, Facebook, Google etc. |
|
||||
| [**AD/LDAP**](https://github.com/minio/minio/blob/master/docs/sts/ldap.md) | Let AD/LDAP users request temporary credentials using AD/LDAP username and password. |
|
||||
| [**AssumeRole**](https://github.com/minio/minio/blob/master/docs/sts/assume-role.md) | Let MinIO users request temporary credentials using user access and secret keys. |
|
||||
|
||||
### Understanding JWT Claims
|
||||
|
||||
> NOTE: JWT claims are only meant for WebIdentity and ClientGrants.
|
||||
> AssumeRole or LDAP users can skip the entire portion and directly visit one of the links below.
|
||||
>
|
||||
> - [**AssumeRole**](https://github.com/minio/minio/blob/master/docs/sts/assume-role.md)
|
||||
> - [**AD/LDAP**](https://github.com/minio/minio/blob/master/docs/sts/ldap.md)
|
||||
|
||||
The id_token received is a signed JSON Web Token (JWT). Use a JWT decoder to decode the id_token to access the payload of the token that includes following JWT claims, `policy` claim is mandatory and should be present as part of your JWT claim. Without this claim the generated credentials will not have access to any resources on the server, using these credentials application would receive 'Access Denied' errors.
|
||||
|
||||
| Claim Name | Type | Claim Value |
|
||||
|:----------:|:-------------------------------------------------:|:------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------:|
|
||||
| policy | _string_ or _[]string_ or _comma_separated_value_ | Canned policy name to be applied for STS credentials. (Mandatory) - This can be configured to any desired value such as `roles` or `groups` by setting the environment variable `MINIO_IDENTITY_OPENID_CLAIM_NAME` |
|
||||
|
||||
## Get started
|
||||
|
||||
In this document we will explain in detail on how to configure all the prerequisites.
|
||||
|
||||
> NOTE: If you are interested in AssumeRole API only, skip to [here](https://github.com/minio/minio/blob/master/docs/sts/assume-role.md)
|
||||
|
||||
### Prerequisites
|
||||
|
||||
- [Configuring keycloak](https://github.com/minio/minio/blob/master/docs/sts/keycloak.md) or [Configuring Casdoor](https://github.com/minio/minio/blob/master/docs/sts/casdoor.md)
|
||||
- [Configuring etcd](https://github.com/minio/minio/blob/master/docs/sts/etcd.md)
|
||||
|
||||
### Setup MinIO with Identity Provider
|
||||
|
||||
Make sure we have followed the previous step and configured each software independently, once done we can now proceed to use MinIO STS API and MinIO server to use these credentials to perform object API operations.
|
||||
|
||||
#### KeyCloak
|
||||
|
||||
```
|
||||
export MINIO_ROOT_USER=minio
|
||||
export MINIO_ROOT_PASSWORD=minio123
|
||||
export MINIO_IDENTITY_OPENID_CONFIG_URL=http://localhost:8080/auth/realms/demo/.well-known/openid-configuration
|
||||
export MINIO_IDENTITY_OPENID_CLIENT_ID="843351d4-1080-11ea-aa20-271ecba3924a"
|
||||
minio server /mnt/data
|
||||
```
|
||||
|
||||
#### Casdoor
|
||||
|
||||
```
|
||||
export MINIO_ROOT_USER=minio
|
||||
export MINIO_ROOT_PASSWORD=minio123
|
||||
export MINIO_IDENTITY_OPENID_CONFIG_URL=http://CASDOOR_ENDPOINT/.well-known/openid-configuration
|
||||
export MINIO_IDENTITY_OPENID_CLIENT_ID="843351d4-1080-11ea-aa20-271ecba3924a"
|
||||
minio server /mnt/data
|
||||
```
|
||||
|
||||
### Using WebIdentiy API
|
||||
|
||||
On another terminal run `web-identity.go` a sample client application which obtains JWT id_tokens from an identity provider, in our case its Keycloak. Uses the returned id_token response to get new temporary credentials from the MinIO server using the STS API call `AssumeRoleWithWebIdentity`.
|
||||
|
||||
```
|
||||
$ go run docs/sts/web-identity.go -cid account -csec 072e7f00-4289-469c-9ab2-bbe843c7f5a8 -config-ep "http://localhost:8080/auth/realms/demo/.well-known/openid-configuration" -port 8888
|
||||
2018/12/26 17:49:36 listening on http://localhost:8888/
|
||||
```
|
||||
|
||||
This will open the login page of keycloak, upon successful login, STS credentials along with any buckets discovered using the credentials will be printed on the screen, for example:
|
||||
|
||||
```
|
||||
{
|
||||
"buckets": [
|
||||
"bucket-x"
|
||||
],
|
||||
"credentials": {
|
||||
"AccessKeyID": "6N2BALX7ELO827DXS3GK",
|
||||
"SecretAccessKey": "23JKqAD+um8ObHqzfIh+bfqwG9V8qs9tFY6MqeFR+xxx",
|
||||
"SessionToken": "eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJhY2Nlc3NLZXkiOiI2TjJCQUxYN0VMTzgyN0RYUzNHSyIsImFjciI6IjAiLCJhdWQiOiJhY2NvdW50IiwiYXV0aF90aW1lIjoxNTY5OTEwNTUyLCJhenAiOiJhY2NvdW50IiwiZW1haWxfdmVyaWZpZWQiOmZhbHNlLCJleHAiOjE1Njk5MTQ1NTQsImlhdCI6MTU2OTkxMDk1NCwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo4MDgxL2F1dGgvcmVhbG1zL2RlbW8iLCJqdGkiOiJkOTk4YTBlZS01NDk2LTQ4OWYtYWJlMi00ZWE5MjJiZDlhYWYiLCJuYmYiOjAsInBvbGljeSI6InJlYWR3cml0ZSIsInByZWZlcnJlZF91c2VybmFtZSI6Im5ld3VzZXIxIiwic2Vzc2lvbl9zdGF0ZSI6IjJiYTAyYTI2LWE5MTUtNDUxNC04M2M1LWE0YjgwYjc4ZTgxNyIsInN1YiI6IjY4ZmMzODVhLTA5MjItNGQyMS04N2U5LTZkZTdhYjA3Njc2NSIsInR5cCI6IklEIn0._UG_-ZHgwdRnsp0gFdwChb7VlbPs-Gr_RNUz9EV7TggCD59qjCFAKjNrVHfOSVkKvYEMe0PvwfRKjnJl3A_mBA"",
|
||||
"SignerType": 1
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
> NOTE: You can use the `-cscopes` parameter to restrict the requested scopes, for example to `"openid,policy_role_attribute"`, being `policy_role_attribute` a client_scope / client_mapper that maps a role attribute called policy to a `policy` claim returned by Keycloak.
|
||||
|
||||
These credentials can now be used to perform MinIO API operations.
|
||||
|
||||
### Using MinIO Console
|
||||
|
||||
- Open MinIO URL on the browser, lets say <http://localhost:9000/>
|
||||
- Click on `Login with SSO`
|
||||
- User will be redirected to the Keycloak user login page, upon successful login the user will be redirected to MinIO page and logged in automatically,
|
||||
the user should see now the buckets and objects they have access to.
|
||||
|
||||
## Explore Further
|
||||
|
||||
- [MinIO Admin Complete Guide](https://docs.min.io/community/minio-object-store/reference/minio-mc-admin.html)
|
||||
- [The MinIO documentation website](https://docs.min.io/community/minio-object-store/index.html)
|
||||
164
docs/sts/assume-role.go
Normal file
164
docs/sts/assume-role.go
Normal file
@@ -0,0 +1,164 @@
|
||||
//go:build ignore
|
||||
// +build ignore
|
||||
|
||||
// Copyright (c) 2015-2021 MinIO, Inc.
|
||||
//
|
||||
// This file is part of MinIO Object Storage stack
|
||||
//
|
||||
// This program is free software: you can redistribute it and/or modify
|
||||
// it under the terms of the GNU Affero General Public License as published by
|
||||
// the Free Software Foundation, either version 3 of the License, or
|
||||
// (at your option) any later version.
|
||||
//
|
||||
// This program is distributed in the hope that it will be useful
|
||||
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
// GNU Affero General Public License for more details.
|
||||
//
|
||||
// You should have received a copy of the GNU Affero General Public License
|
||||
// along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"flag"
|
||||
"fmt"
|
||||
"io"
|
||||
"log"
|
||||
"net/url"
|
||||
"os"
|
||||
"time"
|
||||
|
||||
"github.com/minio/madmin-go/v3"
|
||||
"github.com/minio/minio-go/v7"
|
||||
cr "github.com/minio/minio-go/v7/pkg/credentials"
|
||||
)
|
||||
|
||||
var (
|
||||
// Minio endpoint (for STS API)
|
||||
stsEndpoint string
|
||||
|
||||
// User account credentials
|
||||
minioUsername string
|
||||
minioPassword string
|
||||
|
||||
// Display credentials flag
|
||||
displayCreds bool
|
||||
|
||||
// Credential expiry duration
|
||||
expiryDuration time.Duration
|
||||
|
||||
// Bucket to list
|
||||
bucketToList string
|
||||
|
||||
// Session policy file (FIXME: add support in minio-go)
|
||||
sessionPolicyFile string
|
||||
)
|
||||
|
||||
func init() {
|
||||
flag.StringVar(&stsEndpoint, "sts-ep", "http://localhost:9000", "STS endpoint")
|
||||
flag.StringVar(&minioUsername, "u", "", "MinIO Username")
|
||||
flag.StringVar(&minioPassword, "p", "", "MinIO Password")
|
||||
flag.BoolVar(&displayCreds, "d", false, "Only show generated credentials")
|
||||
flag.DurationVar(&expiryDuration, "e", 0, "Request a duration of validity for the generated credential")
|
||||
flag.StringVar(&bucketToList, "b", "", "Bucket to list (defaults to username)")
|
||||
flag.StringVar(&sessionPolicyFile, "s", "", "File containing session policy to apply to the STS request")
|
||||
}
|
||||
|
||||
func main() {
|
||||
flag.Parse()
|
||||
if minioUsername == "" || minioPassword == "" {
|
||||
flag.PrintDefaults()
|
||||
return
|
||||
}
|
||||
|
||||
// The credentials package in minio-go provides an interface to call the
|
||||
// STS API.
|
||||
|
||||
// Initialize credential options
|
||||
var stsOpts cr.STSAssumeRoleOptions
|
||||
stsOpts.AccessKey = minioUsername
|
||||
stsOpts.SecretKey = minioPassword
|
||||
|
||||
if sessionPolicyFile != "" {
|
||||
var policy string
|
||||
if f, err := os.Open(sessionPolicyFile); err != nil {
|
||||
log.Fatalf("Unable to open session policy file: %v", err)
|
||||
} else {
|
||||
defer f.Close()
|
||||
bs, err := io.ReadAll(f)
|
||||
if err != nil {
|
||||
log.Fatalf("Error reading session policy file: %v", err)
|
||||
}
|
||||
policy = string(bs)
|
||||
}
|
||||
stsOpts.Policy = policy
|
||||
}
|
||||
if expiryDuration != 0 {
|
||||
stsOpts.DurationSeconds = int(expiryDuration.Seconds())
|
||||
}
|
||||
li, err := cr.NewSTSAssumeRole(stsEndpoint, stsOpts)
|
||||
if err != nil {
|
||||
log.Fatalf("Error initializing STS Identity: %v", err)
|
||||
}
|
||||
|
||||
stsEndpointURL, err := url.Parse(stsEndpoint)
|
||||
if err != nil {
|
||||
log.Fatalf("Error parsing sts endpoint: %v", err)
|
||||
}
|
||||
|
||||
opts := &minio.Options{
|
||||
Creds: li,
|
||||
Secure: stsEndpointURL.Scheme == "https",
|
||||
}
|
||||
|
||||
mopts := &madmin.Options{
|
||||
Creds: li,
|
||||
Secure: stsEndpointURL.Scheme == "https",
|
||||
}
|
||||
|
||||
v, err := li.Get()
|
||||
if err != nil {
|
||||
log.Fatalf("Error retrieving STS credentials: %v", err)
|
||||
}
|
||||
|
||||
if displayCreds {
|
||||
fmt.Println("Only displaying credentials:")
|
||||
fmt.Println("AccessKeyID:", v.AccessKeyID)
|
||||
fmt.Println("SecretAccessKey:", v.SecretAccessKey)
|
||||
fmt.Println("SessionToken:", v.SessionToken)
|
||||
return
|
||||
}
|
||||
|
||||
// API requests are secure (HTTPS) if secure=true and insecure (HTTP) otherwise.
|
||||
// New returns an MinIO Admin client object.
|
||||
madmClnt, err := madmin.NewWithOptions(stsEndpointURL.Host, mopts)
|
||||
if err != nil {
|
||||
log.Fatalln(err)
|
||||
}
|
||||
|
||||
err = madmClnt.ServiceRestart(context.Background())
|
||||
if err != nil {
|
||||
log.Fatalln(err)
|
||||
}
|
||||
|
||||
// Use generated credentials to authenticate with MinIO server
|
||||
minioClient, err := minio.New(stsEndpointURL.Host, opts)
|
||||
if err != nil {
|
||||
log.Fatalf("Error initializing client: %v", err)
|
||||
}
|
||||
|
||||
// Use minIO Client object normally like the regular client.
|
||||
if bucketToList == "" {
|
||||
bucketToList = minioUsername
|
||||
}
|
||||
fmt.Printf("Calling list objects on bucket named `%s` with temp creds:\n===\n", bucketToList)
|
||||
objCh := minioClient.ListObjects(context.Background(), bucketToList, minio.ListObjectsOptions{})
|
||||
for obj := range objCh {
|
||||
if obj.Err != nil {
|
||||
log.Fatalf("Listing error: %v", obj.Err)
|
||||
}
|
||||
fmt.Printf("Key: %s\nSize: %d\nLast Modified: %s\n===\n", obj.Key, obj.Size, obj.LastModified)
|
||||
}
|
||||
}
|
||||
138
docs/sts/assume-role.md
Normal file
138
docs/sts/assume-role.md
Normal file
@@ -0,0 +1,138 @@
|
||||
# AssumeRole [](https://slack.min.io)
|
||||
|
||||
## Introduction
|
||||
|
||||
Returns a set of temporary security credentials that you can use to access MinIO resources. AssumeRole requires authorization credentials for an existing user on MinIO. The advantages of this API are
|
||||
|
||||
- To be able to reliably use S3 multipart APIs feature of the SDKs without re-inventing the wheel of pre-signing the each URL in multipart API. This is very tedious to implement with all the scenarios of fault tolerance that's already implemented by the client SDK. The general client SDKs don't support multipart with presigned URLs.
|
||||
- To be able to easily get the temporary credentials to upload to a prefix. Make it possible for a client to upload a whole folder using the session. The server side applications need not create a presigned URL and serve to the client for each file. Since, the client would have the session it can do it by itself.
|
||||
|
||||
The temporary security credentials returned by this API consists of an access key, a secret key, and a security token. Applications can use these temporary security credentials to sign calls to MinIO API operations. The policy applied to these temporary credentials is inherited from the MinIO user credentials. By default, the temporary security credentials created by AssumeRole last for one hour. However, use the optional DurationSeconds parameter to specify the duration of the credentials. This value varies from 900 seconds (15 minutes) up to the maximum session duration of 365 days.
|
||||
|
||||
## API Request Parameters
|
||||
|
||||
### Version
|
||||
|
||||
Indicates STS API version information, the only supported value is '2011-06-15'. This value is borrowed from AWS STS API documentation for compatibility reasons.
|
||||
|
||||
| Params | Value |
|
||||
| :-- | :-- |
|
||||
| *Type* | *String* |
|
||||
| *Required* | *Yes* |
|
||||
|
||||
### AUTHPARAMS
|
||||
|
||||
Indicates STS API Authorization information. If you are familiar with AWS Signature V4 Authorization header, this STS API supports signature V4 authorization as mentioned [here](https://docs.aws.amazon.com/general/latest/gr/signature-version-4.html)
|
||||
|
||||
### DurationSeconds
|
||||
|
||||
The duration, in seconds. The value can range from 900 seconds (15 minutes) up to 365 days. If value is higher than this setting, then operation fails. By default, the value is set to 3600 seconds.
|
||||
|
||||
| Params | Value |
|
||||
| :-- | :-- |
|
||||
| *Type* | *Integer* |
|
||||
| *Valid Range* | *Minimum value of 900. Maximum value of 31536000.* |
|
||||
| *Required* | *No* |
|
||||
|
||||
### Policy
|
||||
|
||||
An IAM policy in JSON format that you want to use as an inline session policy. This parameter is optional. Passing policies to this operation returns new temporary credentials. The resulting session's permissions are the intersection of the canned policy name and the policy set here. You cannot use this policy to grant more permissions than those allowed by the canned policy name being assumed.
|
||||
|
||||
| Params | Value |
|
||||
| :-- | :-- |
|
||||
| *Type* | *String* |
|
||||
| *Valid Range* | *Minimum length of 1. Maximum length of 2048.* |
|
||||
| *Required* | *No* |
|
||||
|
||||
### Response Elements
|
||||
|
||||
XML response for this API is similar to [AWS STS AssumeRole](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html#API_AssumeRole_ResponseElements)
|
||||
|
||||
### Errors
|
||||
|
||||
XML error response for this API is similar to [AWS STS AssumeRole](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html#API_AssumeRole_Errors)
|
||||
|
||||
## Sample `POST` Request
|
||||
|
||||
```
|
||||
http://minio:9000/?Action=AssumeRole&DurationSeconds=3600&Version=2011-06-15&Policy={"Version":"2012-10-17","Statement":[{"Sid":"Stmt1","Effect":"Allow","Action":"s3:*","Resource":"arn:aws:s3:::*"}]}&AUTHPARAMS
|
||||
```
|
||||
|
||||
## Sample Response
|
||||
|
||||
```
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<AssumeRoleResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
|
||||
<AssumeRoleResult>
|
||||
<AssumedRoleUser>
|
||||
<Arn/>
|
||||
<AssumeRoleId/>
|
||||
</AssumedRoleUser>
|
||||
<Credentials>
|
||||
<AccessKeyId>Y4RJU1RNFGK48LGO9I2S</AccessKeyId>
|
||||
<SecretAccessKey>sYLRKS1Z7hSjluf6gEbb9066hnx315wHTiACPAjg</SecretAccessKey>
|
||||
<Expiration>2019-08-08T20:26:12Z</Expiration>
|
||||
<SessionToken>eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJhY2Nlc3NLZXkiOiJZNFJKVTFSTkZHSzQ4TEdPOUkyUyIsImF1ZCI6IlBvRWdYUDZ1Vk80NUlzRU5SbmdEWGo1QXU1WWEiLCJhenAiOiJQb0VnWFA2dVZPNDVJc0VOUm5nRFhqNUF1NVlhIiwiZXhwIjoxNTQxODExMDcxLCJpYXQiOjE1NDE4MDc0NzEsImlzcyI6Imh0dHBzOi8vbG9jYWxob3N0Ojk0NDMvb2F1dGgyL3Rva2VuIiwianRpIjoiYTBiMjc2MjktZWUxYS00M2JmLTg3MzktZjMzNzRhNGNkYmMwIn0.ewHqKVFTaP-j_kgZrcOEKroNUjk10GEp8bqQjxBbYVovV0nHO985VnRESFbcT6XMDDKHZiWqN2vi_ETX_u3Q-w</SessionToken>
|
||||
</Credentials>
|
||||
</AssumeRoleResult>
|
||||
<ResponseMetadata>
|
||||
<RequestId>c6104cbe-af31-11e0-8154-cbc7ccf896c7</RequestId>
|
||||
</ResponseMetadata>
|
||||
</AssumeRoleResponse>
|
||||
```
|
||||
|
||||
## Using AssumeRole API
|
||||
|
||||
```
|
||||
export MINIO_ROOT_USER=minio
|
||||
export MINIO_ROOT_PASSWORD=minio123
|
||||
minio server ~/test
|
||||
```
|
||||
|
||||
Create new users following the multi-user guide [here](https://docs.min.io/community/minio-object-store/administration/identity-access-management.html)
|
||||
|
||||
### Testing an example with awscli tool
|
||||
|
||||
> Use the same username and password created in the previous steps.
|
||||
|
||||
```
|
||||
[foobar]
|
||||
region = us-east-1
|
||||
aws_access_key_id = foobar
|
||||
aws_secret_access_key = foo12345
|
||||
```
|
||||
|
||||
> NOTE: In the following commands `--role-arn` and `--role-session-name` are not meaningful for MinIO and can be set to any value satisfying the command line requirements.
|
||||
|
||||
```
|
||||
$ aws --profile foobar --endpoint-url http://localhost:9000 sts assume-role --policy '{"Version":"2012-10-17","Statement":[{"Sid":"Stmt1","Effect":"Allow","Action":"s3:*","Resource":"arn:aws:s3:::*"}]}' --role-arn arn:xxx:xxx:xxx:xxxx --role-session-name anything
|
||||
{
|
||||
"AssumedRoleUser": {
|
||||
"Arn": ""
|
||||
},
|
||||
"Credentials": {
|
||||
"SecretAccessKey": "xbnWUoNKgFxi+uv3RI9UgqP3tULQMdI+Hj+4psd4",
|
||||
"SessionToken": "eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJhY2Nlc3NLZXkiOiJLOURUSU1VVlpYRVhKTDNBVFVPWSIsImV4cCI6MzYwMDAwMDAwMDAwMCwicG9saWN5IjoidGVzdCJ9.PetK5wWUcnCJkMYv6TEs7HqlA4x_vViykQ8b2T_6hapFGJTO34sfTwqBnHF6lAiWxRoZXco11B0R7y58WAsrQw",
|
||||
"Expiration": "2019-02-20T19:56:59-08:00",
|
||||
"AccessKeyId": "K9DTIMUVZXEXJL3ATUOY"
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### Testing an example with `assume-role.go`
|
||||
|
||||
The included program in this directory can also be used for testing:
|
||||
|
||||
``` shell
|
||||
$ go run assume-role.go -u foobar -p foo12345 -d
|
||||
Only displaying credentials:
|
||||
AccessKeyID: 27YDRYEM0S9B44AJJX9X
|
||||
SecretAccessKey: LHPdHeaLiYk+pDZ3hgN3sdwXpJC2qbhBfZ8ii9Z3
|
||||
SessionToken: eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJhY2Nlc3NLZXkiOiIyN1lEUllFTTBTOUI0NEFKSlg5WCIsImV4cCI6MzYwMDAwMDAwMDAwMCwicG9saWN5IjoiY29uc29sZUFkbWluIn0.2d9t0UOm1jQmwe31_5CyN63f6CL-fhqZSO-XhZIp-NH5QteWv9oSMjIrcNWzMgNDblrUfAZ0JSs8a1ciLQF9Ww
|
||||
|
||||
```
|
||||
|
||||
## Explore Further
|
||||
|
||||
- [MinIO Admin Complete Guide](https://docs.min.io/community/minio-object-store/reference/minio-mc-admin.html)
|
||||
- [The MinIO documentation website](https://docs.min.io/community/minio-object-store/index.html)
|
||||
116
docs/sts/casdoor.md
Normal file
116
docs/sts/casdoor.md
Normal file
@@ -0,0 +1,116 @@
|
||||
# Casdoor Quickstart Guide [](https://slack.min.io)
|
||||
|
||||
Casdoor is a UI-first centralized authentication / Single-Sign-On (SSO) platform supporting OAuth 2.0, OIDC and SAML, integrated with Casbin RBAC and ABAC permission management. This document covers configuring Casdoor identity provider support with MinIO.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
Configure and install casdoor server by following [Casdoor Server Installation](https://casdoor.org/docs/basic/server-installation).
|
||||
For a quick installation, docker-compose reference configs are also available on the [Casdoor Try with Docker](https://casdoor.org/docs/basic/try-with-docker).
|
||||
|
||||
### Configure Casdoor
|
||||
|
||||
- Go to Applications
|
||||
- Create or use an existing Casdoor application
|
||||
- Edit the application
|
||||
- Copy `Client ID` and `Client secret`
|
||||
- Add your redirect url (callback url) to `Redirect URLs`
|
||||
- Save
|
||||
|
||||
- Go to Users
|
||||
- Edit the user
|
||||
- Add your MinIO policy (ex: `readwrite`) in `Tag`
|
||||
- Save
|
||||
|
||||
- Open your favorite browser and visit: **http://`CASDOOR_ENDPOINT`/.well-known/openid-configuration**, you will see the OIDC configure of Casdoor.
|
||||
|
||||
### Configure MinIO
|
||||
|
||||
```
|
||||
export MINIO_ROOT_USER=minio
|
||||
export MINIO_ROOT_PASSWORD=minio123
|
||||
minio server /mnt/export
|
||||
```
|
||||
|
||||
Here are all the available options to configure OpenID connect
|
||||
|
||||
```
|
||||
mc admin config set myminio/ identity_openid
|
||||
|
||||
KEY:
|
||||
identity_openid enable OpenID SSO support
|
||||
|
||||
ARGS:
|
||||
config_url* (url) openid discovery document e.g. "https://accounts.google.com/.well-known/openid-configuration"
|
||||
client_id (string) unique public identifier for apps e.g. "292085223830.apps.googleusercontent.com"
|
||||
claim_name (string) JWT canned policy claim name, defaults to "policy"
|
||||
claim_prefix (string) JWT claim namespace prefix e.g. "customer1/"
|
||||
scopes (csv) Comma separated list of OpenID scopes for server, defaults to advertised scopes from discovery document e.g. "email,admin"
|
||||
comment (sentence) optionally add a comment to this setting
|
||||
```
|
||||
|
||||
and ENV based options
|
||||
|
||||
```
|
||||
mc admin config set myminio/ identity_openid --env
|
||||
|
||||
KEY:
|
||||
identity_openid enable OpenID SSO support
|
||||
|
||||
ARGS:
|
||||
MINIO_IDENTITY_OPENID_CONFIG_URL* (url) openid discovery document e.g. "https://accounts.google.com/.well-known/openid-configuration"
|
||||
MINIO_IDENTITY_OPENID_CLIENT_ID (string) unique public identifier for apps e.g. "292085223830.apps.googleusercontent.com"
|
||||
MINIO_IDENTITY_OPENID_CLAIM_NAME (string) JWT canned policy claim name, defaults to "policy"
|
||||
MINIO_IDENTITY_OPENID_CLAIM_PREFIX (string) JWT claim namespace prefix e.g. "customer1/"
|
||||
MINIO_IDENTITY_OPENID_SCOPES (csv) Comma separated list of OpenID scopes for server, defaults to advertised scopes from discovery document e.g. "email,admin"
|
||||
MINIO_IDENTITY_OPENID_COMMENT (sentence) optionally add a comment to this setting
|
||||
```
|
||||
|
||||
Set `identity_openid` config with `config_url`, `client_id` and restart MinIO
|
||||
|
||||
```
|
||||
~ mc admin config set myminio identity_openid config_url="http://CASDOOR_ENDPOINT/.well-known/openid-configuration" client_id=<client id> client_secret=<client secret> claim_name="tag"
|
||||
```
|
||||
|
||||
> NOTE: As MinIO needs to use a claim attribute in JWT for its policy, you should configure it in casdoor as well. Currently, casdoor uses `tag` as a workaround for configuring MinIO's policy.
|
||||
|
||||
Once successfully set restart the MinIO instance.
|
||||
|
||||
```
|
||||
mc admin service restart myminio
|
||||
```
|
||||
|
||||
### Using WebIdentiy API
|
||||
|
||||
On another terminal run `web-identity.go` a sample client application which obtains JWT id_tokens from an identity provider, in our case its Keycloak. Uses the returned id_token response to get new temporary credentials from the MinIO server using the STS API call `AssumeRoleWithWebIdentity`.
|
||||
|
||||
```
|
||||
$ go run docs/sts/web-identity.go -cid account -csec 072e7f00-4289-469c-9ab2-bbe843c7f5a8 -config-ep "http://CASDOOR_ENDPOINT/.well-known/openid-configuration" -port 8888
|
||||
2018/12/26 17:49:36 listening on http://localhost:8888/
|
||||
```
|
||||
|
||||
This will open the login page of Casdoor, upon successful login, STS credentials along with any buckets discovered using the credentials will be printed on the screen, for example:
|
||||
|
||||
```
|
||||
{
|
||||
buckets: [ ],
|
||||
credentials: {
|
||||
AccessKeyID: "EJOLVY3K3G4BF37YD1A0",
|
||||
SecretAccessKey: "1b+w8LlDqMQOquKxIlZ2ggP+bgE51iwNG7SUVPJJ",
|
||||
SessionToken: "eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJhY2Nlc3NLZXkiOiJFSk9MVlkzSzNHNEJGMzdZRDFBMCIsImFkZHJlc3MiOltdLCJhZmZpbGlhdGlvbiI6IiIsImFwcGxlIjoiIiwiYXVkIjpbIjI0YTI1ZWEwNzE0ZDkyZTc4NTk1Il0sImF2YXRhciI6Imh0dHBzOi8vY2FzYmluLm9yZy9pbWcvY2FzYmluLnN2ZyIsImF6dXJlYWQiOiIiLCJiaW8iOiIiLCJiaXJ0aGRheSI6IiIsImNyZWF0ZWRJcCI6IiIsImNyZWF0ZWRUaW1lIjoiMjAyMS0xMi0wNlQyMzo1ODo0MyswODowMCIsImRpbmd0YWxrIjoiIiwiZGlzcGxheU5hbWUiOiJjYmMiLCJlZHVjYXRpb24iOiIiLCJlbWFpbCI6IjE5OTkwNjI2LmxvdmVAMTYzLmNvbSIsImV4cCI6MTY0MzIwMjIyMCwiZmFjZWJvb2siOiIiLCJnZW5kZXIiOiIiLCJnaXRlZSI6IiIsImdpdGh1YiI6IiIsImdpdGxhYiI6IiIsImdvb2dsZSI6IiIsImhhc2giOiIiLCJob21lcGFnZSI6IiIsImlhdCI6MTY0MzE5MjEwMSwiaWQiOiIxYzU1NTgxZS01ZmEyLTQ4NTEtOWM2NC04MjNhNjYyZDBkY2IiLCJpZENhcmQiOiIiLCJpZENhcmRUeXBlIjoiIiwiaXNBZG1pbiI6dHJ1ZSwiaXNEZWZhdWx0QXZhdGFyIjpmYWxzZSwiaXNEZWxldGVkIjpmYWxzZSwiaXNGb3JiaWRkZW4iOmZhbHNlLCJpc0dsb2JhbEFkbWluIjp0cnVlLCJpc09ubGluZSI6ZmFsc2UsImlzcyI6Imh0dHA6Ly9sb2NhbGhvc3Q6ODAwMCIsImxhbmd1YWdlIjoiIiwibGFyayI6IiIsImxhc3RTaWduaW5JcCI6IiIsImxhc3RTaWduaW5UaW1lIjoiIiwibGRhcCI6IiIsImxpbmtlZGluIjoiIiwibG9jYXRpb24iOiIiLCJuYW1lIjoiY2JjIiwibmJmIjoxNjQzMTkyMTAxLCJub25jZSI6Im51bGwiLCJvd25lciI6ImJ1aWx0LWluIiwicGFzc3dvcmQiOiIiLCJwYXNzd29yZFNhbHQiOiIiLCJwZXJtYW5lbnRBdmF0YXIiOiIiLCJwaG9uZSI6IjE4ODE3NTgzMjA3IiwicHJlSGFzaCI6IjAwY2JiNGEyOTBjZDBjZDgwZmZkZWMyZjBhOWJlM2E2IiwicHJvcGVydGllcyI6e30sInFxIjoiIiwicmFua2luZyI6MCwicmVnaW9uIjoiIiwic2NvcmUiOjIwMDAsInNpZ251cEFwcGxpY2F0aW9uIjoiYXBwLWJ1aWx0LWluIiwic2xhY2siOiIiLCJzdWIiOiIxYzU1NTgxZS01ZmEyLTQ4NTEtOWM2NC04MjNhNjYyZDBkY2IiLCJ0YWciOiJyZWFkd3JpdGUiLCJ0aXRsZSI6IiIsInR5cGUiOiJub3JtYWwtdXNlciIsInVwZGF0ZWRUaW1lIjoiIiwid2VjaGF0IjoiIiwid2Vjb20iOiIiLCJ3ZWlibyI6IiJ9.C5ZoJrojpRSePg_Ef9O-JTnc9BgoDNC5JX5AxlE9npd2tNl3ftudhny47pG6GgNDeiCMiaxueNyb_HPEPltJTw",
|
||||
SignerType: 1
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
### Using MinIO Console
|
||||
|
||||
- Open MinIO URL on the browser, lets say <http://localhost:9000/>
|
||||
- Click on `Login with SSO`
|
||||
- User will be redirected to the Casdoor user login page, upon successful login the user will be redirected to MinIO page and logged in automatically,
|
||||
the user should see now the buckets and objects they have access to.
|
||||
|
||||
## Explore Further
|
||||
|
||||
- [Casdoor MinIO Integration](https://casdoor.org/docs/integration/minio)
|
||||
- [MinIO STS Quickstart Guide](https://docs.min.io/community/minio-object-store/developers/security-token-service.html)
|
||||
- [The MinIO documentation website](https://docs.min.io/community/minio-object-store/index.html)
|
||||
130
docs/sts/client-grants.go
Normal file
130
docs/sts/client-grants.go
Normal file
@@ -0,0 +1,130 @@
|
||||
//go:build ignore
|
||||
// +build ignore
|
||||
|
||||
// Copyright (c) 2015-2021 MinIO, Inc.
|
||||
//
|
||||
// This file is part of MinIO Object Storage stack
|
||||
//
|
||||
// This program is free software: you can redistribute it and/or modify
|
||||
// it under the terms of the GNU Affero General Public License as published by
|
||||
// the Free Software Foundation, either version 3 of the License, or
|
||||
// (at your option) any later version.
|
||||
//
|
||||
// This program is distributed in the hope that it will be useful
|
||||
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
// GNU Affero General Public License for more details.
|
||||
//
|
||||
// You should have received a copy of the GNU Affero General Public License
|
||||
// along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
package main
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"crypto/tls"
|
||||
"encoding/json"
|
||||
"flag"
|
||||
"fmt"
|
||||
"log"
|
||||
"net/http"
|
||||
"net/url"
|
||||
"strings"
|
||||
|
||||
minio "github.com/minio/minio-go/v7"
|
||||
"github.com/minio/minio-go/v7/pkg/credentials"
|
||||
)
|
||||
|
||||
// JWTToken - parses the output from IDP id_token.
|
||||
type JWTToken struct {
|
||||
AccessToken string `json:"access_token"`
|
||||
Expiry int `json:"expires_in"`
|
||||
}
|
||||
|
||||
var (
|
||||
stsEndpoint string
|
||||
idpEndpoint string
|
||||
clientID string
|
||||
clientSecret string
|
||||
)
|
||||
|
||||
func init() {
|
||||
flag.StringVar(&stsEndpoint, "sts-ep", "http://localhost:9000", "STS endpoint")
|
||||
flag.StringVar(&idpEndpoint, "idp-ep", "http://localhost:8080/auth/realms/minio/protocol/openid-connect/token", "IDP token endpoint")
|
||||
flag.StringVar(&clientID, "cid", "", "Client ID")
|
||||
flag.StringVar(&clientSecret, "csec", "", "Client secret")
|
||||
}
|
||||
|
||||
func getTokenExpiry() (*credentials.ClientGrantsToken, error) {
|
||||
data := url.Values{}
|
||||
data.Set("grant_type", "client_credentials")
|
||||
req, err := http.NewRequest(http.MethodPost, idpEndpoint, strings.NewReader(data.Encode()))
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
||||
req.SetBasicAuth(clientID, clientSecret)
|
||||
t := &http.Transport{
|
||||
TLSClientConfig: &tls.Config{
|
||||
InsecureSkipVerify: true,
|
||||
},
|
||||
}
|
||||
hclient := http.Client{
|
||||
Transport: t,
|
||||
}
|
||||
resp, err := hclient.Do(req)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
return nil, fmt.Errorf("%s", resp.Status)
|
||||
}
|
||||
|
||||
var idpToken JWTToken
|
||||
if err = json.NewDecoder(resp.Body).Decode(&idpToken); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
return &credentials.ClientGrantsToken{Token: idpToken.AccessToken, Expiry: idpToken.Expiry}, nil
|
||||
}
|
||||
|
||||
func main() {
|
||||
flag.Parse()
|
||||
if clientID == "" || clientSecret == "" {
|
||||
flag.PrintDefaults()
|
||||
return
|
||||
}
|
||||
|
||||
sts, err := credentials.NewSTSClientGrants(stsEndpoint, getTokenExpiry)
|
||||
if err != nil {
|
||||
log.Fatal(err)
|
||||
}
|
||||
|
||||
// Uncomment this to use MinIO API operations by initializing minio
|
||||
// client with obtained credentials.
|
||||
|
||||
opts := &minio.Options{
|
||||
Creds: sts,
|
||||
BucketLookup: minio.BucketLookupAuto,
|
||||
}
|
||||
|
||||
u, err := url.Parse(stsEndpoint)
|
||||
if err != nil {
|
||||
log.Fatal(err)
|
||||
}
|
||||
|
||||
clnt, err := minio.New(u.Host, opts)
|
||||
if err != nil {
|
||||
log.Fatal(err)
|
||||
}
|
||||
|
||||
d := bytes.NewReader([]byte("Hello, World"))
|
||||
n, err := clnt.PutObject(context.Background(), "my-bucketname", "my-objectname", d, d.Size(), minio.PutObjectOptions{})
|
||||
if err != nil {
|
||||
log.Fatalln(err)
|
||||
}
|
||||
|
||||
log.Println("Uploaded", "my-objectname", " of size: ", n, "Successfully.")
|
||||
}
|
||||
115
docs/sts/client-grants.md
Normal file
115
docs/sts/client-grants.md
Normal file
@@ -0,0 +1,115 @@
|
||||
# AssumeRoleWithClientGrants [](https://slack.min.io)
|
||||
|
||||
## Introduction
|
||||
|
||||
Returns a set of temporary security credentials for applications/clients who have been authenticated through client credential grants provided by identity provider. Example providers include KeyCloak, Okta etc.
|
||||
|
||||
Calling AssumeRoleWithClientGrants does not require the use of MinIO default credentials. Therefore, client application can be distributed that requests temporary security credentials without including MinIO default credentials. Instead, the identity of the caller is validated by using a JWT access token from the identity provider. The temporary security credentials returned by this API consists of an access key, a secret key, and a security token. Applications can use these temporary security credentials to sign calls to MinIO API operations.
|
||||
|
||||
By default, the temporary security credentials created by AssumeRoleWithClientGrants last for one hour. However, use the optional DurationSeconds parameter to specify the duration of the credentials. This value varies from 900 seconds (15 minutes) up to the maximum session duration of 365 days.
|
||||
|
||||
## API Request Parameters
|
||||
|
||||
### Token
|
||||
|
||||
The OAuth 2.0 access token that is provided by the identity provider. Application must get this token by authenticating the application using client credential grants before the application makes an AssumeRoleWithClientGrants call.
|
||||
|
||||
| Params | Value |
|
||||
| :-- | :-- |
|
||||
| *Type* | *String* |
|
||||
| *Length Constraints* | *Minimum length of 4. Maximum length of 2048.* |
|
||||
| *Required* | *Yes* |
|
||||
|
||||
### Version
|
||||
|
||||
Indicates STS API version information, the only supported value is '2011-06-15'. This value is borrowed from AWS STS API documentation for compatibility reasons.
|
||||
|
||||
| Params | Value |
|
||||
| :-- | :-- |
|
||||
| *Type* | *String* |
|
||||
| *Required* | *Yes* |
|
||||
|
||||
### DurationSeconds
|
||||
|
||||
The duration, in seconds. The value can range from 900 seconds (15 minutes) up to 365 days. If value is higher than this setting, then operation fails. By default, the value is set to 3600 seconds. If no *DurationSeconds* is specified expiry seconds is obtained from *Token*.
|
||||
|
||||
| Params | Value |
|
||||
| :-- | :-- |
|
||||
| *Type* | *Integer* |
|
||||
| *Valid Range* | *Minimum value of 900. Maximum value of 31536000.* |
|
||||
| *Required* | *No* |
|
||||
|
||||
### Policy
|
||||
|
||||
An IAM policy in JSON format that you want to use as an inline session policy. This parameter is optional. Passing policies to this operation returns new temporary credentials. The resulting session's permissions are the intersection of the canned policy name and the policy set here. You cannot use this policy to grant more permissions than those allowed by the canned policy name being assumed.
|
||||
|
||||
| Params | Value |
|
||||
| :-- | :-- |
|
||||
| *Type* | *String* |
|
||||
| *Valid Range* | *Minimum length of 1. Maximum length of 2048.* |
|
||||
| *Required* | *No* |
|
||||
|
||||
### Response Elements
|
||||
|
||||
XML response for this API is similar to [AWS STS AssumeRoleWithWebIdentity](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html#API_AssumeRoleWithWebIdentity_ResponseElements)
|
||||
|
||||
### Errors
|
||||
|
||||
XML error response for this API is similar to [AWS STS AssumeRoleWithWebIdentity](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html#API_AssumeRoleWithWebIdentity_Errors)
|
||||
|
||||
## Sample `POST` Request
|
||||
|
||||
```
|
||||
http://minio.cluster:9000?Action=AssumeRoleWithClientGrants&DurationSeconds=3600&Token=eyJ4NXQiOiJOVEF4Wm1NeE5ETXlaRGczTVRVMVpHTTBNekV6T0RKaFpXSTRORE5sWkRVMU9HRmtOakZpTVEiLCJraWQiOiJOVEF4Wm1NeE5ETXlaRGczTVRVMVpHTTBNekV6T0RKaFpXSTRORE5sWkRVMU9HRmtOakZpTVEiLCJhbGciOiJSUzI1NiJ9.eyJhdWQiOiJQb0VnWFA2dVZPNDVJc0VOUm5nRFhqNUF1NVlhIiwiYXpwIjoiUG9FZ1hQNnVWTzQ1SXNFTlJuZ0RYajVBdTVZYSIsImlzcyI6Imh0dHBzOlwvXC9sb2NhbGhvc3Q6OTQ0M1wvb2F1dGgyXC90b2tlbiIsImV4cCI6MTU0MTgwOTU4MiwiaWF0IjoxNTQxODA1OTgyLCJqdGkiOiI2Y2YyMGIwZS1lNGZmLTQzZmQtYTdiYS1kYTc3YTE3YzM2MzYifQ.Jm29jPliRvrK6Os34nSK3rhzIYLFjE__zdVGNng3uGKXGKzP3We_i6NPnhA0szJXMOKglXzUF1UgSz8MctbaxFS8XDusQPVe4LkB_45hwBm6TmBxzui911nt-1RbBLN_jZIlvl2lPrbTUH5hSn9kEkph6seWanTNQpz9tNEoVa6R_OX3kpJqxe8tLQUWw453A1JTwFNhdHa6-f1K8_Q_eEZ_4gOYINQ9t_fhTibdbkXZkJQFLop-Jwoybi9s4nwQU_dATocgcufq5eCeNItQeleT-23lGxIz0X7CiJrJynYLdd-ER0F77SumqEb5iCxhxuf4H7dovwd1kAmyKzLxpw&Version=2011-06-15
|
||||
```
|
||||
|
||||
## Sample Response
|
||||
|
||||
```
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<AssumeRoleWithClientGrantsResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
|
||||
<AssumeRoleWithClientGrantsResult>
|
||||
<AssumedRoleUser>
|
||||
<Arn/>
|
||||
<AssumeRoleId/>
|
||||
</AssumedRoleUser>
|
||||
<Credentials>
|
||||
<AccessKeyId>Y4RJU1RNFGK48LGO9I2S</AccessKeyId>
|
||||
<SecretAccessKey>sYLRKS1Z7hSjluf6gEbb9066hnx315wHTiACPAjg</SecretAccessKey>
|
||||
<Expiration>2019-08-08T20:26:12Z</Expiration>
|
||||
<SessionToken>eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJhY2Nlc3NLZXkiOiJZNFJKVTFSTkZHSzQ4TEdPOUkyUyIsImF1ZCI6IlBvRWdYUDZ1Vk80NUlzRU5SbmdEWGo1QXU1WWEiLCJhenAiOiJQb0VnWFA2dVZPNDVJc0VOUm5nRFhqNUF1NVlhIiwiZXhwIjoxNTQxODExMDcxLCJpYXQiOjE1NDE4MDc0NzEsImlzcyI6Imh0dHBzOi8vbG9jYWxob3N0Ojk0NDMvb2F1dGgyL3Rva2VuIiwianRpIjoiYTBiMjc2MjktZWUxYS00M2JmLTg3MzktZjMzNzRhNGNkYmMwIn0.ewHqKVFTaP-j_kgZrcOEKroNUjk10GEp8bqQjxBbYVovV0nHO985VnRESFbcT6XMDDKHZiWqN2vi_ETX_u3Q-w</SessionToken>
|
||||
</Credentials>
|
||||
</AssumeRoleWithClientGrantsResult>
|
||||
<ResponseMetadata/>
|
||||
</AssumeRoleWithClientGrantsResponse>
|
||||
```
|
||||
|
||||
## Using ClientGrants API
|
||||
|
||||
```
|
||||
export MINIO_ROOT_USER=minio
|
||||
export MINIO_ROOT_PASSWORD=minio123
|
||||
export MINIO_IDENTITY_OPENID_CONFIG_URL=http://localhost:8080/auth/realms/demo/.well-known/openid-configuration
|
||||
export MINIO_IDENTITY_OPENID_CLIENT_ID="843351d4-1080-11ea-aa20-271ecba3924a"
|
||||
minio server /mnt/export
|
||||
```
|
||||
|
||||
Testing with an example
|
||||
> Obtaining client ID and secrets follow [Keycloak configuring documentation](https://github.com/minio/minio/blob/master/docs/sts/keycloak.md)
|
||||
|
||||
```
|
||||
$ go run client-grants.go -cid PoEgXP6uVO45IsENRngDXj5Au5Ya -csec eKsw6z8CtOJVBtrOWvhRWL4TUCga
|
||||
|
||||
##### Credentials
|
||||
{
|
||||
"accessKey": "NUIBORZYTV2HG2BMRSXR",
|
||||
"secretKey": "qQlP5O7CFPc5m5IXf1vYhuVTFj7BRVJqh0FqZ86S",
|
||||
"expiration": "2018-08-21T17:10:29-07:00",
|
||||
"sessionToken": "eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJhY2Nlc3NLZXkiOiJOVUlCT1JaWVRWMkhHMkJNUlNYUiIsImF1ZCI6IlBvRWdYUDZ1Vk80NUlzRU5SbmdEWGo1QXU1WWEiLCJhenAiOiJQb0VnWFA2dVZPNDVJc0VOUm5nRFhqNUF1NVlhIiwiZXhwIjoxNTM0ODk2NjI5LCJpYXQiOjE1MzQ4OTMwMjksImlzcyI6Imh0dHBzOi8vbG9jYWxob3N0Ojk0NDMvb2F1dGgyL3Rva2VuIiwianRpIjoiNjY2OTZjZTctN2U1Ny00ZjU5LWI0MWQtM2E1YTMzZGZiNjA4In0.eJONnVaSVHypiXKEARSMnSKgr-2mlC2Sr4fEGJitLcJF_at3LeNdTHv0_oHsv6ZZA3zueVGgFlVXMlREgr9LXA"
|
||||
}
|
||||
```
|
||||
|
||||
## Explore Further
|
||||
|
||||
- [MinIO Admin Complete Guide](https://docs.min.io/community/minio-object-store/reference/minio-mc-admin.html)
|
||||
- [The MinIO documentation website](https://docs.min.io/community/minio-object-store/index.html)
|
||||
37
docs/sts/client-grants.py
Normal file
37
docs/sts/client-grants.py
Normal file
@@ -0,0 +1,37 @@
|
||||
#!/usr/bin/env python
|
||||
# -*- coding: utf-8 -*-
|
||||
|
||||
import logging
|
||||
|
||||
import boto3
|
||||
from boto3.session import Session
|
||||
from botocore.session import get_session
|
||||
|
||||
from client_grants import ClientGrantsCredentialProvider
|
||||
|
||||
boto3.set_stream_logger('boto3.resources', logging.DEBUG)
|
||||
|
||||
bc_session = get_session()
|
||||
bc_session.get_component('credential_provider').insert_before(
|
||||
'env',
|
||||
ClientGrantsCredentialProvider('NZLOOFRSluw9RfIkuHGqfk1HFp4a',
|
||||
'0Z4VTG8uJBSekn42HE40DK9vQb4a'),
|
||||
)
|
||||
|
||||
boto3_session = Session(botocore_session=bc_session)
|
||||
s3 = boto3_session.resource('s3', endpoint_url='http://localhost:9000')
|
||||
|
||||
with open('/etc/hosts', 'rb') as data:
|
||||
s3.meta.client.upload_fileobj(data,
|
||||
'testbucket',
|
||||
'hosts',
|
||||
ExtraArgs={'ServerSideEncryption': 'AES256'})
|
||||
|
||||
# Upload with server side encryption, using temporary credentials
|
||||
s3.meta.client.upload_file('/etc/hosts',
|
||||
'testbucket',
|
||||
'hosts',
|
||||
ExtraArgs={'ServerSideEncryption': 'AES256'})
|
||||
|
||||
# Download encrypted object using temporary credentials
|
||||
s3.meta.client.download_file('testbucket', 'hosts', '/tmp/hosts')
|
||||
132
docs/sts/client_grants/__init__.py
Normal file
132
docs/sts/client_grants/__init__.py
Normal file
@@ -0,0 +1,132 @@
|
||||
# -*- coding: utf-8 -*-
|
||||
import json
|
||||
# standard.
|
||||
import os
|
||||
|
||||
import certifi
|
||||
# Dependencies
|
||||
import urllib3
|
||||
from botocore.credentials import CredentialProvider, RefreshableCredentials
|
||||
from botocore.exceptions import CredentialRetrievalError
|
||||
from dateutil.parser import parse
|
||||
|
||||
from .sts_element import STSElement
|
||||
|
||||
|
||||
class ClientGrantsCredentialProvider(CredentialProvider):
|
||||
"""
|
||||
ClientGrantsCredentialProvider implements CredentialProvider compatible
|
||||
implementation to be used with boto_session
|
||||
"""
|
||||
METHOD = 'assume-role-client-grants'
|
||||
CANONICAL_NAME = 'AssumeRoleClientGrants'
|
||||
|
||||
def __init__(self, cid, csec,
|
||||
idp_ep='http://localhost:8080/auth/realms/minio/protocol/openid-connect/token',
|
||||
sts_ep='http://localhost:9000'):
|
||||
self.cid = cid
|
||||
self.csec = csec
|
||||
self.idp_ep = idp_ep
|
||||
self.sts_ep = sts_ep
|
||||
|
||||
# Load CA certificates from SSL_CERT_FILE file if set
|
||||
ca_certs = os.environ.get('SSL_CERT_FILE')
|
||||
if not ca_certs:
|
||||
ca_certs = certifi.where()
|
||||
|
||||
self._http = urllib3.PoolManager(
|
||||
timeout=urllib3.Timeout.DEFAULT_TIMEOUT,
|
||||
maxsize=10,
|
||||
cert_reqs='CERT_NONE',
|
||||
ca_certs=ca_certs,
|
||||
retries=urllib3.Retry(
|
||||
total=5,
|
||||
backoff_factor=0.2,
|
||||
status_forcelist=[500, 502, 503, 504]
|
||||
)
|
||||
)
|
||||
|
||||
def load(self):
|
||||
"""
|
||||
Search for credentials with client_grants
|
||||
"""
|
||||
if self.cid is not None:
|
||||
fetcher = self._create_credentials_fetcher()
|
||||
return RefreshableCredentials.create_from_metadata(
|
||||
metadata=fetcher(),
|
||||
refresh_using=fetcher,
|
||||
method=self.METHOD,
|
||||
)
|
||||
else:
|
||||
return None
|
||||
|
||||
def _create_credentials_fetcher(self):
|
||||
method = self.METHOD
|
||||
|
||||
def fetch_credentials():
|
||||
# HTTP headers are case insensitive filter out
|
||||
# all duplicate headers and pick one.
|
||||
headers = {}
|
||||
headers['content-type'] = 'application/x-www-form-urlencoded'
|
||||
headers['authorization'] = urllib3.make_headers(
|
||||
basic_auth='%s:%s' % (self.cid, self.csec))['authorization']
|
||||
|
||||
response = self._http.urlopen('POST', self.idp_ep,
|
||||
body="grant_type=client_credentials",
|
||||
headers=headers,
|
||||
preload_content=True,
|
||||
)
|
||||
if response.status != 200:
|
||||
message = "Credential refresh failed, response: %s"
|
||||
raise CredentialRetrievalError(
|
||||
provider=method,
|
||||
error_msg=message % response.status,
|
||||
)
|
||||
|
||||
creds = json.loads(response.data)
|
||||
|
||||
query = {}
|
||||
query['Action'] = 'AssumeRoleWithClientGrants'
|
||||
query['Token'] = creds['access_token']
|
||||
query['DurationSeconds'] = creds['expires_in']
|
||||
query['Version'] = '2011-06-15'
|
||||
|
||||
query_components = []
|
||||
for key in query:
|
||||
if query[key] is not None:
|
||||
query_components.append("%s=%s" % (key, query[key]))
|
||||
|
||||
query_string = '&'.join(query_components)
|
||||
sts_ep_url = self.sts_ep
|
||||
if query_string:
|
||||
sts_ep_url = self.sts_ep + '?' + query_string
|
||||
|
||||
response = self._http.urlopen(
|
||||
'POST', sts_ep_url, preload_content=True)
|
||||
if response.status != 200:
|
||||
message = "Credential refresh failed, response: %s"
|
||||
raise CredentialRetrievalError(
|
||||
provider=method,
|
||||
error_msg=message % response.status,
|
||||
)
|
||||
|
||||
return parse_grants_response(response.data)
|
||||
|
||||
def parse_grants_response(data):
|
||||
"""
|
||||
Parser for AssumeRoleWithClientGrants response
|
||||
|
||||
:param data: Response data for AssumeRoleWithClientGrants request
|
||||
:return: dict
|
||||
"""
|
||||
root = STSElement.fromstring(
|
||||
'AssumeRoleWithClientGrantsResponse', data)
|
||||
result = root.find('AssumeRoleWithClientGrantsResult')
|
||||
creds = result.find('Credentials')
|
||||
return dict(
|
||||
access_key=creds.get_child_text('AccessKeyId'),
|
||||
secret_key=creds.get_child_text('SecretAccessKey'),
|
||||
token=creds.get_child_text('SessionToken'),
|
||||
expiry_time=parse(creds.get_child_text('Expiration')).isoformat())
|
||||
|
||||
return fetch_credentials
|
||||
78
docs/sts/client_grants/sts_element.py
Normal file
78
docs/sts/client_grants/sts_element.py
Normal file
@@ -0,0 +1,78 @@
|
||||
# -*- coding: utf-8 -*-
|
||||
from xml.etree import cElementTree
|
||||
from xml.etree.cElementTree import ParseError
|
||||
|
||||
if hasattr(cElementTree, 'ParseError'):
|
||||
_ETREE_EXCEPTIONS = (ParseError, AttributeError, ValueError, TypeError)
|
||||
else:
|
||||
_ETREE_EXCEPTIONS = (SyntaxError, AttributeError, ValueError, TypeError)
|
||||
|
||||
_STS_NS = {'sts': 'https://sts.amazonaws.com/doc/2011-06-15/'}
|
||||
|
||||
|
||||
class STSElement(object):
|
||||
"""STS aware XML parsing class. Wraps a root element name and
|
||||
cElementTree.Element instance. Provides STS namespace aware parsing
|
||||
functions.
|
||||
|
||||
"""
|
||||
|
||||
def __init__(self, root_name, element):
|
||||
self.root_name = root_name
|
||||
self.element = element
|
||||
|
||||
@classmethod
|
||||
def fromstring(cls, root_name, data):
|
||||
"""Initialize STSElement from name and XML string data.
|
||||
|
||||
:param name: Name for XML data. Used in XML errors.
|
||||
:param data: string data to be parsed.
|
||||
:return: Returns an STSElement.
|
||||
"""
|
||||
try:
|
||||
return cls(root_name, cElementTree.fromstring(data))
|
||||
except _ETREE_EXCEPTIONS as error:
|
||||
raise InvalidXMLError(
|
||||
'"{}" XML is not parsable. Message: {}'.format(
|
||||
root_name, error.message
|
||||
)
|
||||
)
|
||||
|
||||
def findall(self, name):
|
||||
"""Similar to ElementTree.Element.findall()
|
||||
|
||||
"""
|
||||
return [
|
||||
STSElement(self.root_name, elem)
|
||||
for elem in self.element.findall('sts:{}'.format(name), _STS_NS)
|
||||
]
|
||||
|
||||
def find(self, name):
|
||||
"""Similar to ElementTree.Element.find()
|
||||
|
||||
"""
|
||||
elt = self.element.find('sts:{}'.format(name), _STS_NS)
|
||||
return STSElement(self.root_name, elt) if elt is not None else None
|
||||
|
||||
def get_child_text(self, name, strict=True):
|
||||
"""Extract text of a child element. If strict, and child element is
|
||||
not present, raises InvalidXMLError and otherwise returns
|
||||
None.
|
||||
|
||||
"""
|
||||
if strict:
|
||||
try:
|
||||
return self.element.find('sts:{}'.format(name), _STS_NS).text
|
||||
except _ETREE_EXCEPTIONS as error:
|
||||
raise InvalidXMLError(
|
||||
('Invalid XML provided for "{}" - erroring tag <{}>. '
|
||||
'Message: {}').format(self.root_name, name, error.message)
|
||||
)
|
||||
else:
|
||||
return self.element.findtext('sts:{}'.format(name), None, _STS_NS)
|
||||
|
||||
def text(self):
|
||||
"""Fetch the current node's text
|
||||
|
||||
"""
|
||||
return self.element.text
|
||||
121
docs/sts/custom-token-identity.go
Normal file
121
docs/sts/custom-token-identity.go
Normal file
@@ -0,0 +1,121 @@
|
||||
//go:build ignore
|
||||
// +build ignore
|
||||
|
||||
// Copyright (c) 2015-2022 MinIO, Inc.
|
||||
//
|
||||
// This file is part of MinIO Object Storage stack
|
||||
//
|
||||
// This program is free software: you can redistribute it and/or modify
|
||||
// it under the terms of the GNU Affero General Public License as published by
|
||||
// the Free Software Foundation, either version 3 of the License, or
|
||||
// (at your option) any later version.
|
||||
//
|
||||
// This program is distributed in the hope that it will be useful
|
||||
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
// GNU Affero General Public License for more details.
|
||||
//
|
||||
// You should have received a copy of the GNU Affero General Public License
|
||||
// along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"flag"
|
||||
"fmt"
|
||||
"log"
|
||||
"net/url"
|
||||
"time"
|
||||
|
||||
"github.com/minio/minio-go/v7"
|
||||
cr "github.com/minio/minio-go/v7/pkg/credentials"
|
||||
)
|
||||
|
||||
var (
|
||||
// LDAP integrated Minio endpoint
|
||||
stsEndpoint string
|
||||
|
||||
// token to use with AssumeRoleWithCustomToken
|
||||
token string
|
||||
|
||||
// Role ARN to use
|
||||
roleArn string
|
||||
|
||||
// Display credentials flag
|
||||
displayCreds bool
|
||||
|
||||
// Credential expiry duration
|
||||
expiryDuration time.Duration
|
||||
|
||||
// Bucket to list
|
||||
bucketToList string
|
||||
)
|
||||
|
||||
func init() {
|
||||
flag.StringVar(&stsEndpoint, "sts-ep", "http://localhost:9000", "STS endpoint")
|
||||
flag.StringVar(&token, "t", "", "Token to use with AssumeRoleWithCustomToken STS API (required)")
|
||||
flag.StringVar(&roleArn, "r", "", "RoleARN to use with the request (required)")
|
||||
flag.BoolVar(&displayCreds, "d", false, "Only show generated credentials")
|
||||
flag.DurationVar(&expiryDuration, "e", 0, "Request a duration of validity for the generated credential")
|
||||
flag.StringVar(&bucketToList, "b", "mybucket", "Bucket to list (defaults to mybucket)")
|
||||
}
|
||||
|
||||
func main() {
|
||||
flag.Parse()
|
||||
if token == "" || roleArn == "" {
|
||||
flag.PrintDefaults()
|
||||
return
|
||||
}
|
||||
|
||||
// The credentials package in minio-go provides an interface to call the
|
||||
// AssumeRoleWithCustomToken STS API.
|
||||
|
||||
var opts []cr.CustomTokenOpt
|
||||
if expiryDuration != 0 {
|
||||
opts = append(opts, cr.CustomTokenValidityOpt(expiryDuration))
|
||||
}
|
||||
|
||||
// Initialize
|
||||
li, err := cr.NewCustomTokenCredentials(stsEndpoint, token, roleArn, opts...)
|
||||
if err != nil {
|
||||
log.Fatalf("Error initializing CustomToken Identity: %v", err)
|
||||
}
|
||||
|
||||
v, err := li.Get()
|
||||
if err != nil {
|
||||
log.Fatalf("Error retrieving STS credentials: %v", err)
|
||||
}
|
||||
|
||||
if displayCreds {
|
||||
fmt.Println("Only displaying credentials:")
|
||||
fmt.Println("AccessKeyID:", v.AccessKeyID)
|
||||
fmt.Println("SecretAccessKey:", v.SecretAccessKey)
|
||||
fmt.Println("SessionToken:", v.SessionToken)
|
||||
return
|
||||
}
|
||||
|
||||
// Use generated credentials to authenticate with MinIO server
|
||||
stsEndpointURL, err := url.Parse(stsEndpoint)
|
||||
if err != nil {
|
||||
log.Fatalf("Error parsing sts endpoint: %v", err)
|
||||
}
|
||||
copts := &minio.Options{
|
||||
Creds: li,
|
||||
Secure: stsEndpointURL.Scheme == "https",
|
||||
}
|
||||
minioClient, err := minio.New(stsEndpointURL.Host, copts)
|
||||
if err != nil {
|
||||
log.Fatalf("Error initializing client: ", err)
|
||||
}
|
||||
|
||||
// Use minIO Client object normally like the regular client.
|
||||
fmt.Printf("Calling list objects on bucket named `%s` with temp creds:\n===\n", bucketToList)
|
||||
objCh := minioClient.ListObjects(context.Background(), bucketToList, minio.ListObjectsOptions{})
|
||||
for obj := range objCh {
|
||||
if obj.Err != nil {
|
||||
log.Fatalf("Listing error: %v", obj.Err)
|
||||
}
|
||||
fmt.Printf("Key: %s\nSize: %d\nLast Modified: %s\n===\n", obj.Key, obj.Size, obj.LastModified)
|
||||
}
|
||||
}
|
||||
53
docs/sts/custom-token-identity.md
Normal file
53
docs/sts/custom-token-identity.md
Normal file
@@ -0,0 +1,53 @@
|
||||
# AssumeRoleWithCustomToken [](https://slack.min.io)
|
||||
|
||||
## Introduction
|
||||
|
||||
To integrate with custom authentication methods using the [Identity Management Plugin](../iam/identity-management-plugin.md)), MinIO provides an STS API extension called `AssumeRoleWithCustomToken`.
|
||||
|
||||
After configuring the plugin, use the generated Role ARN with `AssumeRoleWithCustomToken` to get temporary credentials to access object storage.
|
||||
|
||||
## API Request
|
||||
|
||||
To make an STS API request with this method, send a POST request to the MinIO endpoint with following query parameters:
|
||||
|
||||
| Parameter | Type | Required | |
|
||||
|-----------------|---------|----------|----------------------------------------------------------------------|
|
||||
| Action | String | Yes | Value must be `AssumeRoleWithCustomToken` |
|
||||
| Version | String | Yes | Value must be `2011-06-15` |
|
||||
| Token | String | Yes | Token to be authenticated by identity plugin |
|
||||
| RoleArn | String | Yes | Must match the Role ARN generated for the identity plugin |
|
||||
| DurationSeconds | Integer | No | Duration of validity of generated credentials. Must be at least 900. |
|
||||
|
||||
The validity duration of the generated STS credentials is the minimum of the `DurationSeconds` parameter (if passed) and the validity duration returned by the Identity Management Plugin.
|
||||
|
||||
## API Response
|
||||
|
||||
XML response for this API is similar to [AWS STS AssumeRoleWithWebIdentity](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html#API_AssumeRoleWithWebIdentity_ResponseElements)
|
||||
|
||||
## Example request and response
|
||||
|
||||
Sample request with `curl`:
|
||||
|
||||
```sh
|
||||
curl -XPOST 'http://localhost:9001/?Action=AssumeRoleWithCustomToken&Version=2011-06-15&Token=aaa&RoleArn=arn:minio:iam:::role/idmp-vGxBdLkOc8mQPU1-UQbBh-yWWVQ'
|
||||
```
|
||||
|
||||
Prettified Response:
|
||||
|
||||
```xml
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<AssumeRoleWithCustomTokenResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
|
||||
<AssumeRoleWithCustomTokenResult>
|
||||
<Credentials>
|
||||
<AccessKeyId>24Y5H9VHE14H47GEOKCX</AccessKeyId>
|
||||
<SecretAccessKey>H+aBfQ9B1AeWWb++84hvp4tlFBo9aP+hUTdLFIeg</SecretAccessKey>
|
||||
<Expiration>2022-05-25T19:56:34Z</Expiration>
|
||||
<SessionToken>eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJhY2Nlc3NLZXkiOiIyNFk1SDlWSEUxNEg0N0dFT0tDWCIsImV4cCI6MTY1MzUwODU5NCwiZ3JvdXBzIjpbImRhdGEtc2NpZW5jZSJdLCJwYXJlbnQiOiJjdXN0b206QWxpY2UiLCJyb2xlQXJuIjoiYXJuOm1pbmlvOmlhbTo6OnJvbGUvaWRtcC14eHgiLCJzdWIiOiJjdXN0b206QWxpY2UifQ.1tO1LmlUNXiy-wl-ZbkJLWTpaPlhaGqHehsi21lNAmAGCImHHsPb-GA4lRq6GkvHAODN5ZYCf_S-OwpOOdxFwA</SessionToken>
|
||||
</Credentials>
|
||||
<AssumedUser>custom:Alice</AssumedUser>
|
||||
</AssumeRoleWithCustomTokenResult>
|
||||
<ResponseMetadata>
|
||||
<RequestId>16F26E081E36DE63</RequestId>
|
||||
</ResponseMetadata>
|
||||
</AssumeRoleWithCustomTokenResponse>
|
||||
```
|
||||
103
docs/sts/dex.md
Normal file
103
docs/sts/dex.md
Normal file
@@ -0,0 +1,103 @@
|
||||
# Dex Quickstart Guide [](https://slack.min.io)
|
||||
|
||||
Dex is an identity service that uses OpenID Connect to drive authentication for apps. Dex acts as a portal to other identity providers through "connectors." This lets dex defer authentication to LDAP servers, SAML providers, or established identity providers like GitHub, Google, and Active Directory. Clients write their authentication logic once to talk to dex, then dex handles the protocols for a given backend.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
Install Dex by following [Dex Getting Started Guide](https://dexidp.io/docs/getting-started/)
|
||||
|
||||
### Start Dex
|
||||
|
||||
```
|
||||
~ ./bin/dex serve dex.yaml
|
||||
time="2020-07-12T20:45:50Z" level=info msg="config issuer: http://127.0.0.1:5556/dex"
|
||||
time="2020-07-12T20:45:50Z" level=info msg="config storage: sqlite3"
|
||||
time="2020-07-12T20:45:50Z" level=info msg="config static client: Example App"
|
||||
time="2020-07-12T20:45:50Z" level=info msg="config connector: mock"
|
||||
time="2020-07-12T20:45:50Z" level=info msg="config connector: local passwords enabled"
|
||||
time="2020-07-12T20:45:50Z" level=info msg="config response types accepted: [code token id_token]"
|
||||
time="2020-07-12T20:45:50Z" level=info msg="config using password grant connector: local"
|
||||
time="2020-07-12T20:45:50Z" level=info msg="config signing keys expire after: 3h0m0s"
|
||||
time="2020-07-12T20:45:50Z" level=info msg="config id tokens valid for: 3h0m0s"
|
||||
time="2020-07-12T20:45:50Z" level=info msg="listening (http) on 0.0.0.0:5556"
|
||||
```
|
||||
|
||||
### Configure MinIO server with Dex
|
||||
|
||||
```
|
||||
~ export MINIO_IDENTITY_OPENID_CLAIM_NAME=name
|
||||
~ export MINIO_IDENTITY_OPENID_CONFIG_URL=http://127.0.0.1:5556/dex/.well-known/openid-configuration
|
||||
~ minio server ~/test
|
||||
```
|
||||
|
||||
### Run the `web-identity.go`
|
||||
|
||||
```
|
||||
~ go run web-identity.go -cid example-app -csec ZXhhbXBsZS1hcHAtc2VjcmV0 \
|
||||
-config-ep http://127.0.0.1:5556/dex/.well-known/openid-configuration \
|
||||
-cscopes groups,openid,email,profile
|
||||
```
|
||||
|
||||
```
|
||||
~ mc admin policy create admin allaccess.json
|
||||
```
|
||||
|
||||
Contents of `allaccess.json`
|
||||
|
||||
```json
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"s3:*"
|
||||
],
|
||||
"Resource": [
|
||||
"arn:aws:s3:::*"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
### Visit <http://localhost:8080>
|
||||
|
||||
You will be redirected to dex login screen - click "Login with email", enter username password
|
||||
> username: admin@example.com
|
||||
> password: password
|
||||
|
||||
and then click "Grant access"
|
||||
|
||||
On the browser now you shall see the list of buckets output, along with your temporary credentials obtained from MinIO.
|
||||
|
||||
```
|
||||
{
|
||||
"buckets": [
|
||||
"dl.minio.equipment",
|
||||
"dl.minio.service-fulfillment",
|
||||
"testbucket"
|
||||
],
|
||||
"credentials": {
|
||||
"AccessKeyID": "Q31CVS1PSCJ4OTK2YVEM",
|
||||
"SecretAccessKey": "rmDEOKARqKYmEyjWGhmhLpzcncyu7Jf8aZ9bjDic",
|
||||
"SessionToken": "eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJhY2Nlc3NLZXkiOiJRMzFDVlMxUFNDSjRPVEsyWVZFTSIsImF0X2hhc2giOiI4amItZFE2OXRtZEVueUZaMUttNWhnIiwiYXVkIjoiZXhhbXBsZS1hcHAiLCJlbWFpbCI6ImFkbWluQGV4YW1wbGUuY29tIiwiZW1haWxfdmVyaWZpZWQiOnRydWUsImV4cCI6IjE1OTQ2MDAxODIiLCJpYXQiOjE1OTQ1ODkzODQsImlzcyI6Imh0dHA6Ly8xMjcuMC4wLjE6NTU1Ni9kZXgiLCJuYW1lIjoiYWRtaW4iLCJzdWIiOiJDaVF3T0dFNE5qZzBZaTFrWWpnNExUUmlOek10T1RCaE9TMHpZMlF4TmpZeFpqVTBOallTQld4dlkyRnMifQ.nrbzIJz99Om7TvJ04jnSTmhvlM7aR9hMM1Aqjp2ONJ1UKYCvegBLrTu6cYR968_OpmnAGJ8vkd7sIjUjtR4zbw",
|
||||
"SignerType": 1
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
Now you have successfully configured Dex IdP with MinIO.
|
||||
|
||||
> NOTE: Dex supports groups with external connectors so you can use `groups` as policy claim instead of `name`.
|
||||
|
||||
```
|
||||
export MINIO_IDENTITY_OPENID_CLAIM_NAME=groups
|
||||
```
|
||||
|
||||
and add relevant policies on MinIO using `mc admin policy create myminio/ <group_name> group-access.json`
|
||||
|
||||
## Explore Further
|
||||
|
||||
- [MinIO STS Quickstart Guide](https://docs.min.io/community/minio-object-store/developers/security-token-service.html)
|
||||
- [The MinIO documentation website](https://docs.min.io/community/minio-object-store/index.html)
|
||||
78
docs/sts/dex.yaml
Normal file
78
docs/sts/dex.yaml
Normal file
@@ -0,0 +1,78 @@
|
||||
# The base path of dex and the external name of the OpenID Connect service.
|
||||
# This is the canonical URL that all clients MUST use to refer to dex. If a
|
||||
# path is provided, dex's HTTP service will listen at a non-root URL.
|
||||
issuer: http://127.0.0.1:5556/dex
|
||||
|
||||
# The storage configuration determines where dex stores its state. Supported
|
||||
# options include SQL flavors and Kubernetes third party resources.
|
||||
#
|
||||
# See the storage document at Documentation/storage.md for further information.
|
||||
storage:
|
||||
type: sqlite3
|
||||
config:
|
||||
file: examples/dex.db
|
||||
|
||||
# Configuration for the HTTP endpoints.
|
||||
web:
|
||||
http: 0.0.0.0:5556
|
||||
# Uncomment for HTTPS options.
|
||||
# https: 127.0.0.1:5554
|
||||
# tlsCert: /etc/dex/tls.crt
|
||||
# tlsKey: /etc/dex/tls.key
|
||||
|
||||
# Configuration for telemetry
|
||||
telemetry:
|
||||
http: 0.0.0.0:5558
|
||||
|
||||
# Uncomment this block to enable configuration for the expiration time durations.
|
||||
expiry:
|
||||
signingKeys: "3h"
|
||||
idTokens: "3h"
|
||||
|
||||
# Options for controlling the logger.
|
||||
logger:
|
||||
level: "debug"
|
||||
format: "text" # can also be "json"
|
||||
|
||||
# Default values shown below
|
||||
oauth2:
|
||||
# use ["code", "token", "id_token"] to enable implicit flow for web-only clients
|
||||
responseTypes: [ "code", "token", "id_token" ] # also allowed are "token" and "id_token"
|
||||
# By default, Dex will ask for approval to share data with application
|
||||
# (approval for sharing data from connected IdP to Dex is separate process on IdP)
|
||||
skipApprovalScreen: false
|
||||
# If only one authentication method is enabled, the default behavior is to
|
||||
# go directly to it. For connected IdPs, this redirects the browser away
|
||||
# from application to upstream provider such as the Google login page
|
||||
alwaysShowLoginScreen: false
|
||||
# Uncommend the passwordConnector to use a specific connector for password grants
|
||||
passwordConnector: local
|
||||
|
||||
# Instead of reading from an external storage, use this list of clients.
|
||||
#
|
||||
# If this option isn't chosen clients may be added through the gRPC API.
|
||||
staticClients:
|
||||
- id: example-app
|
||||
redirectURIs:
|
||||
- 'http://localhost:8080/oauth2/callback'
|
||||
name: 'Example App'
|
||||
secret: ZXhhbXBsZS1hcHAtc2VjcmV0
|
||||
|
||||
connectors:
|
||||
- type: mockCallback
|
||||
id: mock
|
||||
name: Example
|
||||
|
||||
# Let dex keep a list of passwords which can be used to login to dex.
|
||||
enablePasswordDB: true
|
||||
|
||||
# A static list of passwords to login the end user. By identifying here, dex
|
||||
# won't look in its underlying storage for passwords.
|
||||
#
|
||||
# If this option isn't chosen users may be added through the gRPC API.
|
||||
staticPasswords:
|
||||
- email: "admin@example.com"
|
||||
# bcrypt hash of the string "password"
|
||||
hash: "$2a$10$2b2cU8CPhOTaGrs1HRQuAueS7JTT5ZHsHSzYiFPm1leZck7Mc8T4W"
|
||||
username: "admin"
|
||||
userID: "08a8684b-db88-4b73-90a9-3cd1661f5466"
|
||||
72
docs/sts/etcd.md
Normal file
72
docs/sts/etcd.md
Normal file
@@ -0,0 +1,72 @@
|
||||
# etcd V3 Quickstart Guide [](https://slack.min.io)
|
||||
|
||||
etcd is a distributed key value store that provides a reliable way to store data across a cluster of machines.
|
||||
|
||||
## Get started
|
||||
|
||||
### 1. Prerequisites
|
||||
|
||||
- Docker 18.03 or above, refer here for [installation](https://docs.docker.com/install/).
|
||||
|
||||
### 2. Start etcd
|
||||
|
||||
etcd uses [gcr.io/etcd-development/etcd](https://console.cloud.google.com/gcr/images/etcd-development/GLOBAL/etcd) as a primary container registry.
|
||||
|
||||
```
|
||||
rm -rf /tmp/etcd-data.tmp && mkdir -p /tmp/etcd-data.tmp && \
|
||||
podman rmi gcr.io/etcd-development/etcd:v3.3.9 || true && \
|
||||
podman run \
|
||||
-p 2379:2379 \
|
||||
-p 2380:2380 \
|
||||
--mount type=bind,source=/tmp/etcd-data.tmp,destination=/etcd-data \
|
||||
--name etcd-gcr-v3.3.9 \
|
||||
gcr.io/etcd-development/etcd:v3.3.9 \
|
||||
/usr/local/bin/etcd \
|
||||
--name s1 \
|
||||
--data-dir /etcd-data \
|
||||
--listen-client-urls http://0.0.0.0:2379 \
|
||||
--advertise-client-urls http://0.0.0.0:2379 \
|
||||
--listen-peer-urls http://0.0.0.0:2380 \
|
||||
--initial-advertise-peer-urls http://0.0.0.0:2380 \
|
||||
--initial-cluster s1=http://0.0.0.0:2380 \
|
||||
--initial-cluster-token tkn \
|
||||
--initial-cluster-state new
|
||||
```
|
||||
|
||||
You may also setup etcd with TLS following this documentation [here](https://coreos.com/etcd/docs/latest/op-guide/security.html)
|
||||
|
||||
### 3. Setup MinIO with etcd
|
||||
|
||||
MinIO server expects environment variable for etcd as `MINIO_ETCD_ENDPOINTS`, this environment variable takes many comma separated entries.
|
||||
|
||||
```
|
||||
export MINIO_ETCD_ENDPOINTS=http://localhost:2379
|
||||
minio server /data
|
||||
```
|
||||
|
||||
NOTE: If `etcd` is configured with `Client-to-server authentication with HTTPS client certificates` then you need to use additional envs such as `MINIO_ETCD_CLIENT_CERT` pointing to path to `etcd-client.crt` and `MINIO_ETCD_CLIENT_CERT_KEY` path to `etcd-client.key` .
|
||||
|
||||
### 4. Test with MinIO STS API
|
||||
|
||||
Once etcd is configured, **any STS configuration** will work including Client Grants, Web Identity or AD/LDAP.
|
||||
|
||||
For example, you can configure STS with Client Grants (KeyCloak) using the guides at [MinIO STS Quickstart Guide](https://docs.min.io/community/minio-object-store/developers/security-token-service.html) and [KeyCloak Configuration Guide](https://github.com/minio/minio/blob/master/docs/sts/keycloak.md). Once this is done, STS credentials can be generated:
|
||||
|
||||
```
|
||||
go run client-grants.go -cid PoEgXP6uVO45IsENRngDXj5Au5Ya -csec eKsw6z8CtOJVBtrOWvhRWL4TUCga
|
||||
|
||||
##### Credentials
|
||||
{
|
||||
"accessKey": "IRBLVDGN5QGMDCMO1X8V",
|
||||
"secretKey": "KzS3UZKE7xqNdtRbKyfcWgxBS6P1G4kwZn4DXKuY",
|
||||
"expiration": "2018-08-21T15:49:38-07:00",
|
||||
"sessionToken": "eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJhY2Nlc3NLZXkiOiJJUkJMVkRHTjVRR01EQ01PMVg4ViIsImF1ZCI6IlBvRWdYUDZ1Vk80NUlzRU5SbmdEWGo1QXU1WWEiLCJhenAiOiJQb0VnWFA2dVZPNDVJc0VOUm5nRFhqNUF1NVlhIiwiZXhwIjoxNTM0ODkxNzc4LCJpYXQiOjE1MzQ4ODgxNzgsImlzcyI6Imh0dHBzOi8vbG9jYWxob3N0Ojk0NDMvb2F1dGgyL3Rva2VuIiwianRpIjoiMTg0NDMyOWMtZDY1YS00OGEzLTgyMjgtOWRmNzNmZTgzZDU2In0.4rKsZ8VkZnIS_ALzfTJ9UbEKPFlQVvIyuHw6AWTJcDFDVgQA2ooQHmH9wUDnhXBi1M7o8yWJ47DXP-TLPhwCgQ"
|
||||
}
|
||||
```
|
||||
|
||||
These credentials can now be used to perform MinIO API operations, these credentials automatically expire in 1hr. To understand more about credential expiry duration and client grants STS API read further [here](https://github.com/minio/minio/blob/master/docs/sts/client-grants.md).
|
||||
|
||||
## Explore Further
|
||||
|
||||
- [MinIO STS Quickstart Guide](https://docs.min.io/community/minio-object-store/developers/security-token-service.html)
|
||||
- [The MinIO documentation website](https://docs.min.io/community/minio-object-store/index.html)
|
||||
176
docs/sts/keycloak.md
Normal file
176
docs/sts/keycloak.md
Normal file
@@ -0,0 +1,176 @@
|
||||
# Keycloak Quickstart Guide [](https://slack.min.io)
|
||||
|
||||
Keycloak is an open source Identity and Access Management solution aimed at modern applications and services, this document covers configuring Keycloak identity provider support with MinIO.
|
||||
|
||||
## Prerequisites
|
||||
|
||||
Configure and install keycloak server by following [Keycloak Installation Guide](https://www.keycloak.org/docs/latest/server_installation/#installing-the-software).
|
||||
For a quick installation, docker-compose reference configs are also available on the [Keycloak GitHub](https://github.com/keycloak/keycloak-containers/tree/main/docker-compose-examples).
|
||||
|
||||
### Configure Keycloak Realm
|
||||
|
||||
- Go to Clients
|
||||
- Click on account
|
||||
- Settings
|
||||
- Change `Access Type` to `confidential`.
|
||||
- Save
|
||||
- Click on credentials tab
|
||||
- Copy the `Secret` to clipboard.
|
||||
- This value is needed for `MINIO_IDENTITY_OPENID_CLIENT_SECRET` for MinIO.
|
||||
|
||||
- Go to Users
|
||||
- Click on the user
|
||||
- Attribute, add a new attribute `Key` is `policy`, `Value` is name of the `policy` on MinIO (ex: `readwrite`)
|
||||
- Add and Save
|
||||
|
||||
- Go to Clients
|
||||
- Click on `account`
|
||||
- Settings, set `Valid Redirect URIs` to `*`, expand `Advanced Settings` and set `Access Token Lifespan` to `1 Hours`
|
||||
- Save
|
||||
|
||||
- Go to Clients
|
||||
- Click on `account`
|
||||
- Mappers
|
||||
- Create
|
||||
- `Name` with any text
|
||||
- `Mapper Type` is `User Attribute`
|
||||
- `User Attribute` is `policy`
|
||||
- `Token Claim Name` is `policy`
|
||||
- `Claim JSON Type` is `string`
|
||||
- Save
|
||||
|
||||
- Open <http://localhost:8080/auth/realms/{your-realm-name}/.well-known/openid-configuration> to verify OpenID discovery document, verify it has `authorization_endpoint` and `jwks_uri`
|
||||
|
||||
### Enable Keycloak Admin REST API support
|
||||
|
||||
Before being able to authenticate against the Admin REST API using a client_id and a client_secret you need to make sure the client is configured as it follows:
|
||||
|
||||
- `account` client_id is a confidential client that belongs to the realm `{realm}`
|
||||
- `account` client_id is has **Service Accounts Enabled** option enabled.
|
||||
- `account` client_id has a custom "Audience" mapper, in the Mappers section.
|
||||
- Included Client Audience: security-admin-console
|
||||
|
||||
#### Adding 'admin' Role
|
||||
|
||||
- Go to Roles
|
||||
- Add new Role `admin` with Description `${role_admin}`.
|
||||
- Add this Role into compositive role named `default-roles-{realm}` - `{realm}` should be replaced with whatever realm you created from `prerequisites` section. This role is automatically trusted in the 'Service Accounts' tab.
|
||||
|
||||
- Check that `account` client_id has the role 'admin' assigned in the "Service Account Roles" tab.
|
||||
|
||||
After that, you will be able to obtain an id_token for the Admin REST API using client_id and client_secret:
|
||||
|
||||
```
|
||||
curl \
|
||||
-d "client_id=<YOUR_CLIENT_ID>" \
|
||||
-d "client_secret=<YOUR_CLIENT_SECRET>" \
|
||||
-d "grant_type=client_credentials" \
|
||||
"http://localhost:8080/auth/realms/{realm}/protocol/openid-connect/token"
|
||||
```
|
||||
|
||||
The result will be a JSON document. To invoke the API you need to extract the value of the access_token property. You can then invoke the API by including the value in the Authorization header of requests to the API.
|
||||
|
||||
The following example shows how to get the details of the user with `{userid}` from `{realm}` realm:
|
||||
|
||||
```
|
||||
curl \
|
||||
-H "Authorization: Bearer eyJhbGciOiJSUz..." \
|
||||
"http://localhost:8080/auth/admin/realms/{realm}/users/{userid}"
|
||||
```
|
||||
|
||||
### Configure MinIO
|
||||
|
||||
```
|
||||
export MINIO_ROOT_USER=minio
|
||||
export MINIO_ROOT_PASSWORD=minio123
|
||||
minio server /mnt/export
|
||||
```
|
||||
|
||||
Here are all the available options to configure OpenID connect
|
||||
|
||||
```
|
||||
mc admin config set myminio/ identity_openid
|
||||
|
||||
KEY:
|
||||
identity_openid enable OpenID SSO support
|
||||
|
||||
ARGS:
|
||||
config_url* (url) openid discovery document e.g. "https://accounts.google.com/.well-known/openid-configuration"
|
||||
client_id (string) unique public identifier for apps e.g. "292085223830.apps.googleusercontent.com"
|
||||
claim_name (string) JWT canned policy claim name, defaults to "policy"
|
||||
claim_prefix (string) JWT claim namespace prefix e.g. "customer1/"
|
||||
scopes (csv) Comma separated list of OpenID scopes for server, defaults to advertised scopes from discovery document e.g. "email,admin"
|
||||
comment (sentence) optionally add a comment to this setting
|
||||
```
|
||||
|
||||
and ENV based options
|
||||
|
||||
```
|
||||
mc admin config set myminio/ identity_openid --env
|
||||
|
||||
KEY:
|
||||
identity_openid enable OpenID SSO support
|
||||
|
||||
ARGS:
|
||||
MINIO_IDENTITY_OPENID_CONFIG_URL* (url) openid discovery document e.g. "https://accounts.google.com/.well-known/openid-configuration"
|
||||
MINIO_IDENTITY_OPENID_CLIENT_ID (string) unique public identifier for apps e.g. "292085223830.apps.googleusercontent.com"
|
||||
MINIO_IDENTITY_OPENID_CLAIM_NAME (string) JWT canned policy claim name, defaults to "policy"
|
||||
MINIO_IDENTITY_OPENID_CLAIM_PREFIX (string) JWT claim namespace prefix e.g. "customer1/"
|
||||
MINIO_IDENTITY_OPENID_SCOPES (csv) Comma separated list of OpenID scopes for server, defaults to advertised scopes from discovery document e.g. "email,admin"
|
||||
MINIO_IDENTITY_OPENID_COMMENT (sentence) optionally add a comment to this setting
|
||||
```
|
||||
|
||||
Set `identity_openid` config with `config_url`, `client_id` and restart MinIO
|
||||
|
||||
```
|
||||
~ mc admin config set myminio identity_openid config_url="http://localhost:8080/auth/realms/{your-realm-name}/.well-known/openid-configuration" client_id="account"
|
||||
```
|
||||
|
||||
> NOTE: You can configure the `scopes` parameter to restrict the OpenID scopes requested by minio to the IdP, for example, `"openid,policy_role_attribute"`, being `policy_role_attribute` a client_scope / client_mapper that maps a role attribute called policy to a `policy` claim returned by Keycloak
|
||||
|
||||
Once successfully set restart the MinIO instance.
|
||||
|
||||
```
|
||||
mc admin service restart myminio
|
||||
```
|
||||
|
||||
### Using WebIdentiy API
|
||||
|
||||
Client ID can be found by clicking any of the clients listed [here](http://localhost:8080/auth/admin/master/console/#/realms/minio/clients). If you have followed the above steps docs, the default Client ID will be `account`.
|
||||
|
||||
```
|
||||
$ go run docs/sts/web-identity.go -cid account -csec 072e7f00-4289-469c-9ab2-bbe843c7f5a8 -config-ep "http://localhost:8080/auth/realms/minio/.well-known/openid-configuration" -port 8888
|
||||
2018/12/26 17:49:36 listening on http://localhost:8888/
|
||||
```
|
||||
|
||||
This will open the login page of keycloak, upon successful login, STS credentials along with any buckets discovered using the credentials will be printed on the screen, for example:
|
||||
|
||||
```
|
||||
{
|
||||
"buckets": [
|
||||
"bucket-x"
|
||||
],
|
||||
"credentials": {
|
||||
"AccessKeyID": "6N2BALX7ELO827DXS3GK",
|
||||
"SecretAccessKey": "23JKqAD+um8ObHqzfIh+bfqwG9V8qs9tFY6MqeFR+xxx",
|
||||
"SessionToken": "eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJhY2Nlc3NLZXkiOiI2TjJCQUxYN0VMTzgyN0RYUzNHSyIsImFjciI6IjAiLCJhdWQiOiJhY2NvdW50IiwiYXV0aF90aW1lIjoxNTY5OTEwNTUyLCJhenAiOiJhY2NvdW50IiwiZW1haWxfdmVyaWZpZWQiOmZhbHNlLCJleHAiOjE1Njk5MTQ1NTQsImlhdCI6MTU2OTkxMDk1NCwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo4MDgxL2F1dGgvcmVhbG1zL2RlbW8iLCJqdGkiOiJkOTk4YTBlZS01NDk2LTQ4OWYtYWJlMi00ZWE5MjJiZDlhYWYiLCJuYmYiOjAsInBvbGljeSI6InJlYWR3cml0ZSIsInByZWZlcnJlZF91c2VybmFtZSI6Im5ld3VzZXIxIiwic2Vzc2lvbl9zdGF0ZSI6IjJiYTAyYTI2LWE5MTUtNDUxNC04M2M1LWE0YjgwYjc4ZTgxNyIsInN1YiI6IjY4ZmMzODVhLTA5MjItNGQyMS04N2U5LTZkZTdhYjA3Njc2NSIsInR5cCI6IklEIn0._UG_-ZHgwdRnsp0gFdwChb7VlbPs-Gr_RNUz9EV7TggCD59qjCFAKjNrVHfOSVkKvYEMe0PvwfRKjnJl3A_mBA"",
|
||||
"SignerType": 1
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
> NOTE: You can use the `-cscopes` parameter to restrict the requested scopes, for example to `"openid,policy_role_attribute"`, being `policy_role_attribute` a client_scope / client_mapper that maps a role attribute called policy to a `policy` claim returned by Keycloak.
|
||||
|
||||
These credentials can now be used to perform MinIO API operations.
|
||||
|
||||
### Using MinIO Console
|
||||
|
||||
- Open MinIO URL on the browser, lets say <http://localhost:9000/>
|
||||
- Click on `Login with SSO`
|
||||
- User will be redirected to the Keycloak user login page, upon successful login the user will be redirected to MinIO page and logged in automatically,
|
||||
the user should see now the buckets and objects they have access to.
|
||||
|
||||
## Explore Further
|
||||
|
||||
- [MinIO STS Quickstart Guide](https://docs.min.io/community/minio-object-store/developers/security-token-service.html)
|
||||
- [The MinIO documentation website](https://docs.min.io/community/minio-object-store/index.html)
|
||||
142
docs/sts/ldap.go
Normal file
142
docs/sts/ldap.go
Normal file
@@ -0,0 +1,142 @@
|
||||
//go:build ignore
|
||||
// +build ignore
|
||||
|
||||
// Copyright (c) 2015-2021 MinIO, Inc.
|
||||
//
|
||||
// This file is part of MinIO Object Storage stack
|
||||
//
|
||||
// This program is free software: you can redistribute it and/or modify
|
||||
// it under the terms of the GNU Affero General Public License as published by
|
||||
// the Free Software Foundation, either version 3 of the License, or
|
||||
// (at your option) any later version.
|
||||
//
|
||||
// This program is distributed in the hope that it will be useful
|
||||
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
// GNU Affero General Public License for more details.
|
||||
//
|
||||
// You should have received a copy of the GNU Affero General Public License
|
||||
// along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
package main
|
||||
|
||||
import (
|
||||
"context"
|
||||
"flag"
|
||||
"fmt"
|
||||
"io"
|
||||
"log"
|
||||
"net/url"
|
||||
"os"
|
||||
"time"
|
||||
|
||||
"github.com/minio/minio-go/v7"
|
||||
cr "github.com/minio/minio-go/v7/pkg/credentials"
|
||||
)
|
||||
|
||||
var (
|
||||
// LDAP integrated Minio endpoint
|
||||
stsEndpoint string
|
||||
|
||||
// LDAP credentials
|
||||
ldapUsername string
|
||||
ldapPassword string
|
||||
|
||||
// Display credentials flag
|
||||
displayCreds bool
|
||||
|
||||
// Credential expiry duration
|
||||
expiryDuration time.Duration
|
||||
|
||||
// Bucket to list
|
||||
bucketToList string
|
||||
|
||||
// Session policy file
|
||||
sessionPolicyFile string
|
||||
)
|
||||
|
||||
func init() {
|
||||
flag.StringVar(&stsEndpoint, "sts-ep", "http://localhost:9000", "STS endpoint")
|
||||
flag.StringVar(&ldapUsername, "u", "", "AD/LDAP Username")
|
||||
flag.StringVar(&ldapPassword, "p", "", "AD/LDAP Password")
|
||||
flag.BoolVar(&displayCreds, "d", false, "Only show generated credentials")
|
||||
flag.DurationVar(&expiryDuration, "e", 0, "Request a duration of validity for the generated credential")
|
||||
flag.StringVar(&bucketToList, "b", "", "Bucket to list (defaults to ldap username)")
|
||||
flag.StringVar(&sessionPolicyFile, "s", "", "File containing session policy to apply to the STS request")
|
||||
}
|
||||
|
||||
func main() {
|
||||
flag.Parse()
|
||||
if ldapUsername == "" || ldapPassword == "" {
|
||||
flag.PrintDefaults()
|
||||
return
|
||||
}
|
||||
|
||||
// The credentials package in minio-go provides an interface to call the
|
||||
// LDAP STS API.
|
||||
|
||||
// Initialize LDAP credentials
|
||||
var ldapOpts []cr.LDAPIdentityOpt
|
||||
if sessionPolicyFile != "" {
|
||||
var policy string
|
||||
if f, err := os.Open(sessionPolicyFile); err != nil {
|
||||
log.Fatalf("Unable to open session policy file %s: %v", sessionPolicyFile, err)
|
||||
} else {
|
||||
bs, err := io.ReadAll(f)
|
||||
if err != nil {
|
||||
log.Fatalf("Error reading session policy file: %v", err)
|
||||
}
|
||||
policy = string(bs)
|
||||
}
|
||||
ldapOpts = append(ldapOpts, cr.LDAPIdentityPolicyOpt(policy))
|
||||
}
|
||||
if expiryDuration != 0 {
|
||||
ldapOpts = append(ldapOpts, cr.LDAPIdentityExpiryOpt(expiryDuration))
|
||||
}
|
||||
li, err := cr.NewLDAPIdentity(stsEndpoint, ldapUsername, ldapPassword, ldapOpts...)
|
||||
if err != nil {
|
||||
log.Fatalf("Error initializing LDAP Identity: %v", err)
|
||||
}
|
||||
|
||||
stsEndpointURL, err := url.Parse(stsEndpoint)
|
||||
if err != nil {
|
||||
log.Fatalf("Error parsing sts endpoint: %v", err)
|
||||
}
|
||||
|
||||
opts := &minio.Options{
|
||||
Creds: li,
|
||||
Secure: stsEndpointURL.Scheme == "https",
|
||||
}
|
||||
|
||||
v, err := li.Get()
|
||||
if err != nil {
|
||||
log.Fatalf("Error retrieving STS credentials: %v", err)
|
||||
}
|
||||
|
||||
if displayCreds {
|
||||
fmt.Println("Only displaying credentials:")
|
||||
fmt.Println("AccessKeyID:", v.AccessKeyID)
|
||||
fmt.Println("SecretAccessKey:", v.SecretAccessKey)
|
||||
fmt.Println("SessionToken:", v.SessionToken)
|
||||
return
|
||||
}
|
||||
|
||||
// Use generated credentials to authenticate with MinIO server
|
||||
minioClient, err := minio.New(stsEndpointURL.Host, opts)
|
||||
if err != nil {
|
||||
log.Fatalf("Error initializing client: %v", err)
|
||||
}
|
||||
|
||||
// Use minIO Client object normally like the regular client.
|
||||
if bucketToList == "" {
|
||||
bucketToList = ldapUsername
|
||||
}
|
||||
fmt.Printf("Calling list objects on bucket named `%s` with temp creds:\n===\n", bucketToList)
|
||||
objCh := minioClient.ListObjects(context.Background(), bucketToList, minio.ListObjectsOptions{})
|
||||
for obj := range objCh {
|
||||
if obj.Err != nil {
|
||||
log.Fatalf("Listing error: %v", obj.Err)
|
||||
}
|
||||
fmt.Printf("Key: %s\nSize: %d\nLast Modified: %s\n===\n", obj.Key, obj.Size, obj.LastModified)
|
||||
}
|
||||
}
|
||||
323
docs/sts/ldap.md
Normal file
323
docs/sts/ldap.md
Normal file
@@ -0,0 +1,323 @@
|
||||
# AssumeRoleWithLDAPIdentity [](https://slack.min.io)
|
||||
|
||||
## Introduction
|
||||
|
||||
MinIO provides a custom STS API that allows integration with LDAP based corporate environments including Microsoft Active Directory. The MinIO server uses a separate LDAP service account to lookup user information. The login flow for a user is as follows:
|
||||
|
||||
- User provides their AD/LDAP username and password to the STS API.
|
||||
- MinIO looks up the user's information (specifically the user's Distinguished Name) in the LDAP server.
|
||||
- On finding the user's info, MinIO verifies the login credentials with the AD/LDAP server.
|
||||
- MinIO optionally queries the AD/LDAP server for a list of groups that the user is a member of.
|
||||
- MinIO then checks if there are any policies [explicitly associated](#managing-usergroup-access-policy) with the user or their groups.
|
||||
- On finding at least one associated policy, MinIO generates temporary credentials for the user storing the list of groups in a cryptographically secure session token. The temporary access key, secret key and session token are returned to the user.
|
||||
- The user can now use these credentials to make requests to the MinIO server.
|
||||
|
||||
The administrator will associate IAM access policies with each group and if required with the user too. The MinIO server then evaluates applicable policies on a user (these are the policies associated with the groups along with the policy on the user if any) to check if the request should be allowed or denied.
|
||||
|
||||
To ensure that changes in the LDAP directory are reflected in object storage access changes, MinIO performs an **Automatic LDAP sync**. MinIO periodically queries the LDAP service to:
|
||||
|
||||
- find accounts (user DNs) that have been removed; any active STS credentials or MinIO service accounts belonging to these users are purged.
|
||||
|
||||
- find accounts whose group memberships have changed; access policies available to a credential are updated to reflect the change, i.e. they will lose any privileges associated with a group they are removed from, and gain any privileges associated with a group they are added to.
|
||||
|
||||
**Please note that when AD/LDAP is configured, MinIO will not support long term users defined internally.** Only AD/LDAP users (and the root user) are allowed. In addition to this, the server will not support operations on users or groups using `mc admin user` or `mc admin group` commands except `mc admin user info` and `mc admin group info` to list set policies for users and groups. This is because users and groups are defined externally in AD/LDAP.
|
||||
|
||||
## Configuring AD/LDAP on MinIO
|
||||
|
||||
LDAP STS configuration can be performed via MinIO's standard configuration API (i.e. using `mc admin config set/get` commands) or equivalently via environment variables. For brevity we refer to environment variables here.
|
||||
|
||||
LDAP is configured via the following environment variables:
|
||||
|
||||
```
|
||||
$ mc admin config set myminio identity_ldap --env
|
||||
KEY:
|
||||
identity_ldap enable LDAP SSO support
|
||||
|
||||
ARGS:
|
||||
MINIO_IDENTITY_LDAP_SERVER_ADDR* (address) AD/LDAP server address e.g. "myldap.com" or "myldapserver.com:636"
|
||||
MINIO_IDENTITY_LDAP_SRV_RECORD_NAME (string) DNS SRV record name for LDAP service, if given, must be one of "ldap", "ldaps" or "on"
|
||||
MINIO_IDENTITY_LDAP_LOOKUP_BIND_DN (string) DN for LDAP read-only service account used to perform DN and group lookups
|
||||
MINIO_IDENTITY_LDAP_LOOKUP_BIND_PASSWORD (string) Password for LDAP read-only service account used to perform DN and group lookups
|
||||
MINIO_IDENTITY_LDAP_USER_DN_SEARCH_BASE_DN (list) ";" separated list of user search base DNs e.g. "dc=myldapserver,dc=com"
|
||||
MINIO_IDENTITY_LDAP_USER_DN_SEARCH_FILTER (string) Search filter to lookup user DN
|
||||
MINIO_IDENTITY_LDAP_USER_DN_ATTRIBUTES (list) "," separated list of user DN attributes e.g. "uid,cn,mail,sshPublicKey"
|
||||
MINIO_IDENTITY_LDAP_GROUP_SEARCH_FILTER (string) search filter for groups e.g. "(&(objectclass=groupOfNames)(memberUid=%s))"
|
||||
MINIO_IDENTITY_LDAP_GROUP_SEARCH_BASE_DN (list) ";" separated list of group search base DNs e.g. "dc=myldapserver,dc=com"
|
||||
MINIO_IDENTITY_LDAP_TLS_SKIP_VERIFY (on|off) trust server TLS without verification (default: 'off')
|
||||
MINIO_IDENTITY_LDAP_SERVER_INSECURE (on|off) allow plain text connection to AD/LDAP server (default: 'off')
|
||||
MINIO_IDENTITY_LDAP_SERVER_STARTTLS (on|off) use StartTLS connection to AD/LDAP server (default: 'off')
|
||||
MINIO_IDENTITY_LDAP_COMMENT (sentence) optionally add a comment to this setting
|
||||
```
|
||||
|
||||
### LDAP server connectivity
|
||||
|
||||
The variables relevant to configuring connectivity to the LDAP service are:
|
||||
|
||||
```
|
||||
MINIO_IDENTITY_LDAP_SERVER_ADDR* (address) AD/LDAP server address e.g. "myldap.com" or "myldapserver.com:1686"
|
||||
MINIO_IDENTITY_LDAP_SRV_RECORD_NAME (string) DNS SRV record name for LDAP service, if given, must be one of ldap, ldaps or on
|
||||
MINIO_IDENTITY_LDAP_TLS_SKIP_VERIFY (on|off) trust server TLS without verification, defaults to "off" (verify)
|
||||
MINIO_IDENTITY_LDAP_SERVER_INSECURE (on|off) allow plain text connection to AD/LDAP server, defaults to "off"
|
||||
MINIO_IDENTITY_LDAP_SERVER_STARTTLS (on|off) use StartTLS connection to AD/LDAP server, defaults to "off"
|
||||
```
|
||||
|
||||
The server address variable is _required_. TLS is assumed to be on by default. The port in the server address is optional and defaults to 636 if not provided.
|
||||
|
||||
**MinIO sends LDAP credentials to the LDAP server for validation. So we _strongly recommend_ to use MinIO with AD/LDAP server over TLS or StartTLS _only_. Using plain-text connection between MinIO and LDAP server means _credentials can be compromised_ by anyone listening to network traffic.**
|
||||
|
||||
If a self-signed certificate is being used, the certificate can be added to MinIO's certificates directory, so it can be trusted by the server.
|
||||
|
||||
#### DNS SRV Records
|
||||
|
||||
Many Active Directory and other LDAP services are setup with [DNS SRV Records](https://ldap.com/dns-srv-records-for-ldap/) for high-availability of the directory service. To use this to find LDAP servers to connect to, an LDAP client makes a DNS SRV record request to the DNS service on a domain that looks like `_service._proto.example.com`. For LDAP the `proto` value is always `tcp`, and `service` is usually `ldap` or `ldaps`.
|
||||
|
||||
To enable MinIO to use the SRV records, specify the `srv_record_name` config parameter (or equivalently the `MINIO_IDENTITY_LDAP_SRV_RECORD_NAME` environment variable). This parameter can be set to `ldap` or `ldaps` and MinIO will substitute it into the `service` value. For example, when `server_addr=myldapserver.com` and `srv_record_name=ldap`, MinIO will lookup the SRV record for `_ldap._tcp.myldapserver.com` and pick an appropriate target for LDAP requests.
|
||||
|
||||
If the DNS SRV record is at an entirely different place, say `_ldapsrv._tcpish.myldapserver.com`, then set `srv_record_name` to the special value `on` and set `server_addr=_ldapsrv._tcpish.myldapserver.com`.
|
||||
|
||||
When using this feature, do not specify a port in the `server_addr` as the port is picked up automatically from the SRV record.
|
||||
|
||||
With the default (empty) value for `srv_record_name`, MinIO **will not** perform any SRV record request.
|
||||
|
||||
The value of `srv_record_name` does not affect any TLS settings - they must be configured with their own parameters.
|
||||
|
||||
### Lookup-Bind
|
||||
|
||||
A low-privilege read-only LDAP service account is configured in the MinIO server by providing the account's Distinguished Name (DN) and password. This service account is used to perform directory lookups as needed.
|
||||
|
||||
```
|
||||
MINIO_IDENTITY_LDAP_LOOKUP_BIND_DN* (string) DN for LDAP read-only service account used to perform DN and group lookups
|
||||
MINIO_IDENTITY_LDAP_LOOKUP_BIND_PASSWORD (string) Password for LDAP read-only service account used to perform DN and group lookups
|
||||
```
|
||||
|
||||
If you set an empty lookup bind password, the lookup bind will use the unauthenticated authentication mechanism, as described in [RFC 4513 Section 5.1.2](https://tools.ietf.org/html/rfc4513#section-5.1.2).
|
||||
|
||||
### User lookup
|
||||
|
||||
When a user provides their LDAP credentials, MinIO runs a lookup query to find the user's Distinguished Name (DN). The search filter and base DN used in this lookup query are configured via the following variables:
|
||||
|
||||
```
|
||||
MINIO_IDENTITY_LDAP_USER_DN_SEARCH_BASE_DN* (list) ";" separated list of user search base DNs e.g. "dc=myldapserver,dc=com"
|
||||
MINIO_IDENTITY_LDAP_USER_DN_SEARCH_FILTER* (string) Search filter to lookup user DN
|
||||
```
|
||||
|
||||
The search filter must use the LDAP username to find the user DN. This is done via [variable substitution](#variable-substitution-in-configuration-strings).
|
||||
|
||||
The returned user's DN and their password are then verified with the LDAP server. The user DN may also be associated with an [access policy](#managing-usergroup-access-policy).
|
||||
|
||||
The User DN attributes configuration parameter:
|
||||
```
|
||||
MINIO_IDENTITY_LDAP_USER_DN_ATTRIBUTES (list) "," separated list of user DN attributes e.g. "uid,cn,mail,sshPublicKey"
|
||||
```
|
||||
is optional and can be used to specify additional attributes to lookup on the User DN record in the LDAP server. This is for certain display purposes and may be used for extended functionality that may be added in the future.
|
||||
|
||||
### Group membership search
|
||||
|
||||
MinIO can be optionally configured to find the groups of a user from AD/LDAP by specifying the following variables:
|
||||
|
||||
```
|
||||
MINIO_IDENTITY_LDAP_GROUP_SEARCH_FILTER (string) search filter for groups e.g. "(&(objectclass=groupOfNames)(memberUid=%s))"
|
||||
MINIO_IDENTITY_LDAP_GROUP_SEARCH_BASE_DN (list) ";" separated list of group search base DNs e.g. "dc=myldapserver,dc=com"
|
||||
```
|
||||
|
||||
The search filter must use the username or the DN to find the user's groups. This is done via [variable substitution](#variable-substitution-in-configuration-strings).
|
||||
|
||||
A group's DN may be associated with an [access policy](#managing-usergroup-access-policy).
|
||||
|
||||
#### Nested groups usage in LDAP/AD
|
||||
If you are using Active directory with nested groups you have to add LDAP_MATCHING_RULE_IN_CHAIN: :1.2.840.113556.1.4.1941: to your query.
|
||||
For example:
|
||||
```shell
|
||||
group_search_filter: (&(objectClass=group)(member:1.2.840.113556.1.4.1941:=%d))
|
||||
user_dn_search_filter: (&(memberOf:1.2.840.113556.1.4.1941:=CN=group,DC=dc,DC=net)(sAMAccountName=%s))
|
||||
```
|
||||
|
||||
### Sample settings
|
||||
|
||||
Here are some (minimal) sample settings for development or experimentation:
|
||||
|
||||
```shell
|
||||
export MINIO_IDENTITY_LDAP_SERVER_ADDR=myldapserver.com:636
|
||||
export MINIO_IDENTITY_LDAP_LOOKUP_BIND_DN='cn=admin,dc=min,dc=io'
|
||||
export MINIO_IDENTITY_LDAP_LOOKUP_BIND_PASSWORD=admin
|
||||
export MINIO_IDENTITY_LDAP_USER_DN_SEARCH_BASE_DN='ou=hwengg,dc=min,dc=io'
|
||||
export MINIO_IDENTITY_LDAP_USER_DN_SEARCH_FILTER='(uid=%s)'
|
||||
export MINIO_IDENTITY_LDAP_TLS_SKIP_VERIFY=on
|
||||
```
|
||||
|
||||
### Variable substitution in configuration strings
|
||||
|
||||
In the configuration variables, `%s` is substituted with the _username_ from the STS request and `%d` is substituted with the _distinguished username (user DN)_ of the LDAP user. Please see the following table for which configuration variables support these substitution variables:
|
||||
|
||||
| Variable | Supported substitutions |
|
||||
|---------------------------------------------|-------------------------|
|
||||
| `MINIO_IDENTITY_LDAP_USER_DN_SEARCH_FILTER` | `%s` |
|
||||
| `MINIO_IDENTITY_LDAP_GROUP_SEARCH_FILTER` | `%s` and `%d` |
|
||||
|
||||
## Managing User/Group Access Policy
|
||||
|
||||
Access policies may be associated by their name with a group or user directly. Access policies are first defined on the MinIO server using IAM policy JSON syntax. To define a new policy, you can use the [AWS policy generator](https://awspolicygen.s3.amazonaws.com/policygen.html). Copy the policy into a text file `mypolicy.json` and issue the command like so:
|
||||
|
||||
```sh
|
||||
mc admin policy create myminio mypolicy mypolicy.json
|
||||
```
|
||||
|
||||
To associate the policy with an LDAP user or group, use the full DN of the user or group:
|
||||
|
||||
```sh
|
||||
mc idp ldap policy attach myminio mypolicy --user='uid=james,cn=accounts,dc=myldapserver,dc=com'
|
||||
```
|
||||
|
||||
```sh
|
||||
mc idp ldap policy attach myminio mypolicy ----group='cn=projectx,ou=groups,ou=hwengg,dc=min,dc=io'
|
||||
```
|
||||
|
||||
To remove a policy association, use the similar `detach` command:
|
||||
|
||||
```sh
|
||||
mc idp ldap policy detach myminio mypolicy --user='uid=james,cn=accounts,dc=myldapserver,dc=com'
|
||||
```
|
||||
|
||||
```sh
|
||||
mc idp ldap policy detach myminio mypolicy ----group='cn=projectx,ou=groups,ou=hwengg,dc=min,dc=io'
|
||||
```
|
||||
|
||||
|
||||
Note that the commands above attempt to validate if the given entity (user or group) exist in the LDAP directory and return an error if they are not found.
|
||||
|
||||
<details><summary> View **DEPRECATED** older policy association commands</summary>
|
||||
|
||||
Please **do not use** these as they may be removed or their behavior may change.
|
||||
|
||||
```sh
|
||||
mc admin policy attach myminio mypolicy --user='uid=james,cn=accounts,dc=myldapserver,dc=com'
|
||||
```
|
||||
|
||||
|
||||
```sh
|
||||
mc admin policy attach myminio mypolicy --group='cn=projectx,ou=groups,ou=hwengg,dc=min,dc=io'
|
||||
```
|
||||
|
||||
</details>
|
||||
|
||||
**Note that by default no policy is set on a user**. Thus even if they successfully authenticate with AD/LDAP credentials, they have no access to object storage as the default access policy is to deny all access.
|
||||
|
||||
## API Request Parameters
|
||||
|
||||
### LDAPUsername
|
||||
|
||||
Is AD/LDAP username to login. Application must ask user for this value to successfully obtain rotating access credentials from AssumeRoleWithLDAPIdentity.
|
||||
|
||||
| Params | Value |
|
||||
| :-- | :-- |
|
||||
| _Type_ | _String_ |
|
||||
| _Length Constraints_ | _Minimum length of 2. Maximum length of 2048._ |
|
||||
| _Required_ | _Yes_ |
|
||||
|
||||
### LDAPPassword
|
||||
|
||||
Is AD/LDAP username password to login. Application must ask user for this value to successfully obtain rotating access credentials from AssumeRoleWithLDAPIdentity.
|
||||
|
||||
| Params | Value |
|
||||
| :-- | :-- |
|
||||
| _Type_ | _String_ |
|
||||
| _Length Constraints_ | _Minimum length of 4. Maximum length of 2048._ |
|
||||
| _Required_ | _Yes_ |
|
||||
|
||||
### Version
|
||||
|
||||
Indicates STS API version information, the only supported value is '2011-06-15'. This value is borrowed from AWS STS API documentation for compatibility reasons.
|
||||
|
||||
| Params | Value |
|
||||
| :-- | :-- |
|
||||
| _Type_ | _String_ |
|
||||
| _Required_ | _Yes_ |
|
||||
|
||||
### DurationSeconds
|
||||
|
||||
The duration, in seconds. The value can range from 900 seconds (15 minutes) up to 365 days. If value is higher than this setting, then operation fails. By default, the value is set to 3600 seconds.
|
||||
|
||||
| Params | Value |
|
||||
| :-- | :-- |
|
||||
| _Type_ | _Integer_ |
|
||||
| _Valid Range_ | _Minimum value of 900. Maximum value of 31536000._ |
|
||||
| _Required_ | _No_ |
|
||||
|
||||
### Policy
|
||||
|
||||
An IAM policy in JSON format that you want to use as an inline session policy. This parameter is optional. Passing policies to this operation returns new temporary credentials. The resulting session's permissions are the intersection of the canned policy name and the policy set here. You cannot use this policy to grant more permissions than those allowed by the canned policy name being assumed.
|
||||
|
||||
| Params | Value |
|
||||
| :-- | :-- |
|
||||
| _Type_ | _String_ |
|
||||
| _Valid Range_ | _Minimum length of 1. Maximum length of 2048._ |
|
||||
| _Required_ | _No_ |
|
||||
|
||||
### Response Elements
|
||||
|
||||
XML response for this API is similar to [AWS STS AssumeRoleWithWebIdentity](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html#API_AssumeRoleWithWebIdentity_ResponseElements)
|
||||
|
||||
### Errors
|
||||
|
||||
XML error response for this API is similar to [AWS STS AssumeRoleWithWebIdentity](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html#API_AssumeRoleWithWebIdentity_Errors)
|
||||
|
||||
## Sample `POST` Request
|
||||
|
||||
```
|
||||
http://minio.cluster:9000?Action=AssumeRoleWithLDAPIdentity&LDAPUsername=foouser&LDAPPassword=foouserpassword&Version=2011-06-15&DurationSeconds=7200
|
||||
```
|
||||
|
||||
## Sample Response
|
||||
|
||||
```
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<AssumeRoleWithLDAPIdentityResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
|
||||
<AssumeRoleWithLDAPIdentityResult>
|
||||
<AssumedRoleUser>
|
||||
<Arn/>
|
||||
<AssumeRoleId/>
|
||||
</AssumedRoleUser>
|
||||
<Credentials>
|
||||
<AccessKeyId>Y4RJU1RNFGK48LGO9I2S</AccessKeyId>
|
||||
<SecretAccessKey>sYLRKS1Z7hSjluf6gEbb9066hnx315wHTiACPAjg</SecretAccessKey>
|
||||
<Expiration>2019-08-08T20:26:12Z</Expiration>
|
||||
<SessionToken>eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJhY2Nlc3NLZXkiOiJZNFJKVTFSTkZHSzQ4TEdPOUkyUyIsImF1ZCI6IlBvRWdYUDZ1Vk80NUlzRU5SbmdEWGo1QXU1WWEiLCJhenAiOiJQb0VnWFA2dVZPNDVJc0VOUm5nRFhqNUF1NVlhIiwiZXhwIjoxNTQxODExMDcxLCJpYXQiOjE1NDE4MDc0NzEsImlzcyI6Imh0dHBzOi8vbG9jYWxob3N0Ojk0NDMvb2F1dGgyL3Rva2VuIiwianRpIjoiYTBiMjc2MjktZWUxYS00M2JmLTg3MzktZjMzNzRhNGNkYmMwIn0.ewHqKVFTaP-j_kgZrcOEKroNUjk10GEp8bqQjxBbYVovV0nHO985VnRESFbcT6XMDDKHZiWqN2vi_ETX_u3Q-w</SessionToken>
|
||||
</Credentials>
|
||||
</AssumeRoleWithLDAPIdentity>
|
||||
<ResponseMetadata/>
|
||||
</AssumeRoleWithLDAPIdentityResponse>
|
||||
```
|
||||
|
||||
## Using LDAP STS API
|
||||
|
||||
With multiple OU hierarchies for users, and multiple group search base DN's.
|
||||
|
||||
```
|
||||
export MINIO_ROOT_USER=minio
|
||||
export MINIO_ROOT_PASSWORD=minio123
|
||||
export MINIO_IDENTITY_LDAP_SERVER_ADDR='my.ldap-active-dir-server.com:636'
|
||||
export MINIO_IDENTITY_LDAP_LOOKUP_BIND_DN='cn=admin,dc=min,dc=io'
|
||||
export MINIO_IDENTITY_LDAP_LOOKUP_BIND_PASSWORD=admin
|
||||
export MINIO_IDENTITY_LDAP_GROUP_SEARCH_BASE_DN='dc=minioad,dc=local;dc=somedomain,dc=com'
|
||||
export MINIO_IDENTITY_LDAP_GROUP_SEARCH_FILTER='(&(objectclass=groupOfNames)(member=%d))'
|
||||
minio server ~/test
|
||||
```
|
||||
|
||||
You can make sure it works appropriately using our [example program](https://raw.githubusercontent.com/minio/minio/master/docs/sts/ldap.go):
|
||||
|
||||
```
|
||||
$ go run ldap.go -u foouser -p foopassword
|
||||
|
||||
##### Credentials
|
||||
{
|
||||
"accessKey": "NUIBORZYTV2HG2BMRSXR",
|
||||
"secretKey": "qQlP5O7CFPc5m5IXf1vYhuVTFj7BRVJqh0FqZ86S",
|
||||
"expiration": "2018-08-21T17:10:29-07:00",
|
||||
"sessionToken": "eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJhY2Nlc3NLZXkiOiJOVUlCT1JaWVRWMkhHMkJNUlNYUiIsImF1ZCI6IlBvRWdYUDZ1Vk80NUlzRU5SbmdEWGo1QXU1WWEiLCJhenAiOiJQb0VnWFA2dVZPNDVJc0VOUm5nRFhqNUF1NVlhIiwiZXhwIjoxNTM0ODk2NjI5LCJpYXQiOjE1MzQ4OTMwMjksImlzcyI6Imh0dHBzOi8vbG9jYWxob3N0Ojk0NDMvb2F1dGgyL3Rva2VuIiwianRpIjoiNjY2OTZjZTctN2U1Ny00ZjU5LWI0MWQtM2E1YTMzZGZiNjA4In0.eJONnVaSVHypiXKEARSMnSKgr-2mlC2Sr4fEGJitLcJF_at3LeNdTHv0_oHsv6ZZA3zueVGgFlVXMlREgr9LXA"
|
||||
}
|
||||
```
|
||||
|
||||
## Explore Further
|
||||
|
||||
- [MinIO Admin Complete Guide](https://docs.min.io/community/minio-object-store/reference/minio-mc-admin.html)
|
||||
- [The MinIO documentation website](https://docs.min.io/community/minio-object-store/index.html)
|
||||
14
docs/sts/rw-ldap-username.json
Normal file
14
docs/sts/rw-ldap-username.json
Normal file
@@ -0,0 +1,14 @@
|
||||
{
|
||||
"Version": "2012-10-17",
|
||||
"Statement": [
|
||||
{
|
||||
"Effect": "Allow",
|
||||
"Action": [
|
||||
"s3:*"
|
||||
],
|
||||
"Resource": [
|
||||
"arn:aws:s3:::${ldap:username}/*"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
117
docs/sts/tls.md
Normal file
117
docs/sts/tls.md
Normal file
@@ -0,0 +1,117 @@
|
||||
# AssumeRoleWithCertificate [](https://slack.min.io)
|
||||
|
||||
## Introduction
|
||||
|
||||
MinIO provides a custom STS API that allows authentication with client X.509 / TLS certificates.
|
||||
|
||||
A major advantage of certificate-based authentication compared to other STS authentication methods, like OpenID Connect or LDAP/AD, is that client authentication works without any additional/external component that must be constantly available. Therefore, certificate-based authentication may provide better availability / lower operational complexity.
|
||||
|
||||
The MinIO TLS STS API can be configured via MinIO's standard configuration API (i.e. using `mc admin config set/get`). Further, it can be configured via the following environment variables:
|
||||
|
||||
```
|
||||
mc admin config set myminio identity_tls --env
|
||||
KEY:
|
||||
identity_tls enable X.509 TLS certificate SSO support
|
||||
|
||||
ARGS:
|
||||
MINIO_IDENTITY_TLS_SKIP_VERIFY (on|off) trust client certificates without verification. Defaults to "off" (verify)
|
||||
```
|
||||
|
||||
The MinIO TLS STS API is disabled by default. However, it can be *enabled* by setting environment variable:
|
||||
|
||||
```
|
||||
export MINIO_IDENTITY_TLS_ENABLE=on
|
||||
```
|
||||
|
||||
## Example
|
||||
|
||||
MinIO exposes a custom S3 STS API endpoint as `Action=AssumeRoleWithCertificate`. A client has to send an HTTP `POST` request to `https://<host>:<port>?Action=AssumeRoleWithCertificate&Version=2011-06-15`. Since the authentication and authorization happens via X.509 certificates the client has to send the request over **TLS** and has to provide
|
||||
a client certificate.
|
||||
|
||||
The following curl example shows how to authenticate to a MinIO server with client certificate and obtain STS access credentials.
|
||||
|
||||
```curl
|
||||
curl -X POST --key private.key --cert public.crt "https://minio:9000?Action=AssumeRoleWithCertificate&Version=2011-06-15&DurationSeconds=3600"
|
||||
```
|
||||
|
||||
```xml
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<AssumeRoleWithCertificateResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
|
||||
<AssumeRoleWithCertificateResult>
|
||||
<Credentials>
|
||||
<AccessKeyId>YC12ZBHUVW588BQAE5BM</AccessKeyId>
|
||||
<SecretAccessKey>Zgl9+zdE0pZ88+hLqtfh0ocLN+WQTJixHouCkZkW</SecretAccessKey>
|
||||
<Expiration>2021-07-19T20:10:45Z</Expiration
|
||||
<SessionToken>eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJhY2Nlc3NLZXkiOiJZQzEyWkJIVVZXNTg4QlFBRTVCTSIsImV4cCI6MTYyNjcyNTQ0NX0.wvMUf3w_x16qpVWgua8WxnV1Sgtv1jOnSu03vbrwOMzV3cI4q3_9WZD9LwlP-34DTsvbsg7gCBGh6YNriMMiQw</SessionToken>
|
||||
</Credentials>
|
||||
</AssumeRoleWithCertificateResult>
|
||||
<ResponseMetadata>
|
||||
<RequestId>169339CD8B3A6948</RequestId>
|
||||
</ResponseMetadata>
|
||||
</AssumeRoleWithCertificateResponse>
|
||||
```
|
||||
|
||||
## Authentication Flow
|
||||
|
||||
A client can request temp. S3 credentials via the STS API. It can authenticate via a client certificate and obtain a access/secret key pair as well as a session token. These credentials are associated to an S3 policy at the MinIO server.
|
||||
|
||||
In case of certificate-based authentication, MinIO has to map the client-provided certificate to an S3 policy. MinIO does this via the subject common name field of the X.509 certificate. So, MinIO will associate a certificate with a subject `CN = foobar` to a S3 policy named `foobar`.
|
||||
|
||||
The following self-signed certificate is issued for `consoleAdmin`. So, MinIO would associate it with the pre-defined `consoleAdmin` policy.
|
||||
|
||||
```
|
||||
Certificate:
|
||||
Data:
|
||||
Version: 3 (0x2)
|
||||
Serial Number:
|
||||
35:ac:60:46:ad:8d:de:18:dc:0b:f6:98:14:ee:89:e8
|
||||
Signature Algorithm: ED25519
|
||||
Issuer: CN = consoleAdmin
|
||||
Validity
|
||||
Not Before: Jul 19 15:08:44 2021 GMT
|
||||
Not After : Aug 18 15:08:44 2021 GMT
|
||||
Subject: CN = consoleAdmin
|
||||
Subject Public Key Info:
|
||||
Public Key Algorithm: ED25519
|
||||
ED25519 Public-Key:
|
||||
pub:
|
||||
5a:91:87:b8:77:fe:d4:af:d9:c7:c7:ce:55:ae:74:
|
||||
aa:f3:f1:fe:04:63:9b:cb:20:97:61:97:90:94:fa:
|
||||
12:8b
|
||||
X509v3 extensions:
|
||||
X509v3 Key Usage: critical
|
||||
Digital Signature
|
||||
X509v3 Extended Key Usage:
|
||||
TLS Web Client Authentication
|
||||
X509v3 Basic Constraints: critical
|
||||
CA:FALSE
|
||||
Signature Algorithm: ED25519
|
||||
7e:aa:be:ed:47:4d:b9:2f:fc:ed:7f:5a:fc:6b:c0:05:5b:f5:
|
||||
a0:31:fe:86:e3:8e:3f:49:af:6d:d5:ac:c7:c4:57:47:ce:97:
|
||||
7d:ab:b8:e9:75:ec:b4:39:fb:c8:cf:53:16:5b:1f:15:b6:7f:
|
||||
5a:d1:35:2d:fc:31:3a:10:e7:0c
|
||||
```
|
||||
|
||||
> Observe the `Subject: CN = consoleAdmin` field.
|
||||
|
||||
Also, note that the certificate has to contain the `Extended Key Usage: TLS Web Client Authentication`. Otherwise, MinIO would not accept the certificate as client certificate.
|
||||
|
||||
Now, the STS certificate-based authentication happens in 4 steps:
|
||||
|
||||
- Client sends HTTP `POST` request over a TLS connection hitting the MinIO TLS STS API.
|
||||
- MinIO verifies that the client certificate is valid.
|
||||
- MinIO tries to find a policy that matches the `CN` of the client certificate.
|
||||
- MinIO returns temp. S3 credentials associated to the found policy.
|
||||
|
||||
The returned credentials expiry after a certain period of time that can be configured via `&DurationSeconds=3600`. By default, the STS credentials are valid for 1 hour. The minimum expiration allowed is 15 minutes.
|
||||
|
||||
Further, the temp. S3 credentials will never out-live the client certificate. For example, if the `MINIO_IDENTITY_TLS_STS_EXPIRY` is 7 days but the certificate itself is only valid for the next 3 days, then MinIO will return S3 credentials that are valid for 3 days only.
|
||||
|
||||
## Caveat
|
||||
|
||||
*Applications that use direct S3 API will work fine, however interactive users uploading content using (when POSTing to the presigned URL an app generates) a popup becomes visible on browser to provide client certs, you would have to manually cancel and continue. This may be annoying to use but there is no workaround for now.*
|
||||
|
||||
## Explore Further
|
||||
|
||||
- [MinIO Admin Complete Guide](https://docs.min.io/community/minio-object-store/reference/minio-mc-admin.html)
|
||||
- [The MinIO documentation website](https://docs.min.io/community/minio-object-store/index.html)
|
||||
274
docs/sts/web-identity.go
Normal file
274
docs/sts/web-identity.go
Normal file
@@ -0,0 +1,274 @@
|
||||
//go:build ignore
|
||||
// +build ignore
|
||||
|
||||
// Copyright (c) 2015-2021 MinIO, Inc.
|
||||
//
|
||||
// This file is part of MinIO Object Storage stack
|
||||
//
|
||||
// This program is free software: you can redistribute it and/or modify
|
||||
// it under the terms of the GNU Affero General Public License as published by
|
||||
// the Free Software Foundation, either version 3 of the License, or
|
||||
// (at your option) any later version.
|
||||
//
|
||||
// This program is distributed in the hope that it will be useful
|
||||
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
// GNU Affero General Public License for more details.
|
||||
//
|
||||
// You should have received a copy of the GNU Affero General Public License
|
||||
// along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
|
||||
package main
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"crypto/rand"
|
||||
"encoding/base64"
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"flag"
|
||||
"fmt"
|
||||
"log"
|
||||
"net/http"
|
||||
"net/url"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
"golang.org/x/oauth2"
|
||||
|
||||
"github.com/minio/minio-go/v7"
|
||||
"github.com/minio/minio-go/v7/pkg/credentials"
|
||||
)
|
||||
|
||||
// Returns a base64 encoded random 32 byte string.
|
||||
func randomState() string {
|
||||
b := make([]byte, 32)
|
||||
rand.Read(b)
|
||||
return base64.RawURLEncoding.EncodeToString(b)
|
||||
}
|
||||
|
||||
var (
|
||||
stsEndpoint string
|
||||
configEndpoint string
|
||||
clientID string
|
||||
clientSec string
|
||||
clientScopes string
|
||||
port int
|
||||
)
|
||||
|
||||
// DiscoveryDoc - parses the output from openid-configuration
|
||||
// for example http://localhost:8080/auth/realms/minio/.well-known/openid-configuration
|
||||
type DiscoveryDoc struct {
|
||||
Issuer string `json:"issuer,omitempty"`
|
||||
AuthEndpoint string `json:"authorization_endpoint,omitempty"`
|
||||
TokenEndpoint string `json:"token_endpoint,omitempty"`
|
||||
UserInfoEndpoint string `json:"userinfo_endpoint,omitempty"`
|
||||
RevocationEndpoint string `json:"revocation_endpoint,omitempty"`
|
||||
JwksURI string `json:"jwks_uri,omitempty"`
|
||||
ResponseTypesSupported []string `json:"response_types_supported,omitempty"`
|
||||
SubjectTypesSupported []string `json:"subject_types_supported,omitempty"`
|
||||
IDTokenSigningAlgValuesSupported []string `json:"id_token_signing_alg_values_supported,omitempty"`
|
||||
ScopesSupported []string `json:"scopes_supported,omitempty"`
|
||||
TokenEndpointAuthMethods []string `json:"token_endpoint_auth_methods_supported,omitempty"`
|
||||
ClaimsSupported []string `json:"claims_supported,omitempty"`
|
||||
CodeChallengeMethodsSupported []string `json:"code_challenge_methods_supported,omitempty"`
|
||||
}
|
||||
|
||||
func parseDiscoveryDoc(ustr string) (DiscoveryDoc, error) {
|
||||
d := DiscoveryDoc{}
|
||||
req, err := http.NewRequest(http.MethodGet, ustr, nil)
|
||||
if err != nil {
|
||||
return d, err
|
||||
}
|
||||
clnt := http.Client{
|
||||
Transport: http.DefaultTransport,
|
||||
}
|
||||
resp, err := clnt.Do(req)
|
||||
if err != nil {
|
||||
return d, err
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
if resp.StatusCode != http.StatusOK {
|
||||
return d, fmt.Errorf("unexpected error returned by %s : status(%s)", ustr, resp.Status)
|
||||
}
|
||||
dec := json.NewDecoder(resp.Body)
|
||||
if err = dec.Decode(&d); err != nil {
|
||||
return d, err
|
||||
}
|
||||
return d, nil
|
||||
}
|
||||
|
||||
func init() {
|
||||
flag.StringVar(&stsEndpoint, "sts-ep", "http://localhost:9000", "STS endpoint")
|
||||
flag.StringVar(&configEndpoint, "config-ep",
|
||||
"http://localhost:8080/auth/realms/minio/.well-known/openid-configuration",
|
||||
"OpenID discovery document endpoint")
|
||||
flag.StringVar(&clientID, "cid", "", "Client ID")
|
||||
flag.StringVar(&clientSec, "csec", "", "Client Secret")
|
||||
flag.StringVar(&clientScopes, "cscopes", "openid", "Client Scopes")
|
||||
flag.IntVar(&port, "port", 8080, "Port")
|
||||
}
|
||||
|
||||
func implicitFlowURL(c oauth2.Config, state string) string {
|
||||
var buf bytes.Buffer
|
||||
buf.WriteString(c.Endpoint.AuthURL)
|
||||
v := url.Values{
|
||||
"response_type": {"id_token"},
|
||||
"response_mode": {"form_post"},
|
||||
"client_id": {c.ClientID},
|
||||
}
|
||||
if c.RedirectURL != "" {
|
||||
v.Set("redirect_uri", c.RedirectURL)
|
||||
}
|
||||
if len(c.Scopes) > 0 {
|
||||
v.Set("scope", strings.Join(c.Scopes, " "))
|
||||
}
|
||||
v.Set("state", state)
|
||||
v.Set("nonce", state)
|
||||
if strings.Contains(c.Endpoint.AuthURL, "?") {
|
||||
buf.WriteByte('&')
|
||||
} else {
|
||||
buf.WriteByte('?')
|
||||
}
|
||||
buf.WriteString(v.Encode())
|
||||
return buf.String()
|
||||
}
|
||||
|
||||
func main() {
|
||||
flag.Parse()
|
||||
if clientID == "" {
|
||||
flag.PrintDefaults()
|
||||
return
|
||||
}
|
||||
|
||||
ddoc, err := parseDiscoveryDoc(configEndpoint)
|
||||
if err != nil {
|
||||
log.Println(fmt.Errorf("Failed to parse OIDC discovery document %s", err))
|
||||
fmt.Println(err)
|
||||
return
|
||||
}
|
||||
|
||||
scopes := ddoc.ScopesSupported
|
||||
if clientScopes != "" {
|
||||
scopes = strings.Split(clientScopes, ",")
|
||||
}
|
||||
|
||||
ctx := context.Background()
|
||||
|
||||
config := oauth2.Config{
|
||||
ClientID: clientID,
|
||||
ClientSecret: clientSec,
|
||||
Endpoint: oauth2.Endpoint{
|
||||
AuthURL: ddoc.AuthEndpoint,
|
||||
TokenURL: ddoc.TokenEndpoint,
|
||||
},
|
||||
RedirectURL: fmt.Sprintf("http://10.0.0.67:%d/oauth2/callback", port),
|
||||
Scopes: scopes,
|
||||
}
|
||||
|
||||
state := randomState()
|
||||
|
||||
http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
|
||||
log.Printf("%s %s", r.Method, r.RequestURI)
|
||||
if r.RequestURI != "/" {
|
||||
http.NotFound(w, r)
|
||||
return
|
||||
}
|
||||
if clientSec != "" {
|
||||
http.Redirect(w, r, config.AuthCodeURL(state), http.StatusFound)
|
||||
} else {
|
||||
http.Redirect(w, r, implicitFlowURL(config, state), http.StatusFound)
|
||||
}
|
||||
})
|
||||
|
||||
http.HandleFunc("/oauth2/callback", func(w http.ResponseWriter, r *http.Request) {
|
||||
log.Printf("%s %s", r.Method, r.RequestURI)
|
||||
|
||||
if err := r.ParseForm(); err != nil {
|
||||
http.Error(w, err.Error(), http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
if r.Form.Get("state") != state {
|
||||
http.Error(w, "state did not match", http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
|
||||
var getWebTokenExpiry func() (*credentials.WebIdentityToken, error)
|
||||
if clientSec == "" {
|
||||
getWebTokenExpiry = func() (*credentials.WebIdentityToken, error) {
|
||||
return &credentials.WebIdentityToken{
|
||||
Token: r.Form.Get("id_token"),
|
||||
}, nil
|
||||
}
|
||||
} else {
|
||||
getWebTokenExpiry = func() (*credentials.WebIdentityToken, error) {
|
||||
oauth2Token, err := config.Exchange(ctx, r.URL.Query().Get("code"))
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
if !oauth2Token.Valid() {
|
||||
return nil, errors.New("invalid token")
|
||||
}
|
||||
|
||||
return &credentials.WebIdentityToken{
|
||||
Token: oauth2Token.Extra("id_token").(string),
|
||||
Expiry: int(oauth2Token.Expiry.Sub(time.Now().UTC()).Seconds()),
|
||||
}, nil
|
||||
}
|
||||
}
|
||||
|
||||
sts, err := credentials.NewSTSWebIdentity(stsEndpoint, getWebTokenExpiry)
|
||||
if err != nil {
|
||||
log.Println(fmt.Errorf("Could not get STS credentials: %s", err))
|
||||
http.Error(w, err.Error(), http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
|
||||
opts := &minio.Options{
|
||||
Creds: sts,
|
||||
BucketLookup: minio.BucketLookupAuto,
|
||||
}
|
||||
|
||||
u, err := url.Parse(stsEndpoint)
|
||||
if err != nil {
|
||||
log.Println(fmt.Errorf("Failed to parse STS Endpoint: %s", err))
|
||||
http.Error(w, err.Error(), http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
|
||||
clnt, err := minio.New(u.Host, opts)
|
||||
if err != nil {
|
||||
log.Println(fmt.Errorf("Error while initializing Minio client, %s", err))
|
||||
http.Error(w, err.Error(), http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
buckets, err := clnt.ListBuckets(r.Context())
|
||||
if err != nil {
|
||||
log.Println(fmt.Errorf("Error while listing buckets, %s", err))
|
||||
http.Error(w, err.Error(), http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
creds, _ := sts.Get()
|
||||
|
||||
bucketNames := []string{}
|
||||
|
||||
for _, bucket := range buckets {
|
||||
log.Println(fmt.Sprintf("Bucket discovered: %s", bucket.Name))
|
||||
bucketNames = append(bucketNames, bucket.Name)
|
||||
}
|
||||
response := make(map[string]interface{})
|
||||
response["credentials"] = creds
|
||||
response["buckets"] = bucketNames
|
||||
c, err := json.MarshalIndent(response, "", "\t")
|
||||
if err != nil {
|
||||
http.Error(w, err.Error(), http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
w.Write(c)
|
||||
})
|
||||
|
||||
address := fmt.Sprintf(":%v", port)
|
||||
log.Printf("listening on http://%s/", address)
|
||||
log.Fatal(http.ListenAndServe(address, nil))
|
||||
}
|
||||
275
docs/sts/web-identity.md
Normal file
275
docs/sts/web-identity.md
Normal file
@@ -0,0 +1,275 @@
|
||||
# AssumeRoleWithWebIdentity [](https://slack.min.io)
|
||||
|
||||
## Introduction
|
||||
|
||||
MinIO supports the standard AssumeRoleWithWebIdentity STS API to enable integration with OIDC/OpenID based identity provider environments. This allows the generation of temporary credentials with pre-defined access policies for applications/users to interact with MinIO object storage.
|
||||
|
||||
Calling AssumeRoleWithWebIdentity does not require the use of MinIO root or IAM credentials. Therefore, you can distribute an application (for example, on mobile devices) that requests temporary security credentials without including MinIO long lasting credentials in the application. Instead, the identity of the caller is validated by using a JWT id_token from the web identity provider. The temporary security credentials returned by this API consists of an access key, a secret key, and a security token. Applications can use these temporary security credentials to sign calls to MinIO API operations.
|
||||
|
||||
By default, the temporary security credentials created by AssumeRoleWithWebIdentity last for one hour. However, the optional DurationSeconds parameter can be used to specify the validity duration of the generated credentials. This value varies from 900 seconds (15 minutes) up to the maximum session duration of 365 days.
|
||||
|
||||
## Configuring OpenID Identity Provider on MinIO
|
||||
|
||||
Configuration can be performed via MinIO's standard configuration API (i.e. using `mc admin config set/get` commands) or equivalently via environment variables. For brevity we show only environment variables here:
|
||||
|
||||
```
|
||||
$ mc admin config set myminio identity_openid --env
|
||||
KEY:
|
||||
identity_openid[:name] enable OpenID SSO support
|
||||
|
||||
ARGS:
|
||||
MINIO_IDENTITY_OPENID_ENABLE* (on|off) enable identity_openid target, default is 'off'
|
||||
MINIO_IDENTITY_OPENID_DISPLAY_NAME (string) Friendly display name for this Provider/App
|
||||
MINIO_IDENTITY_OPENID_CONFIG_URL* (url) openid discovery document e.g. "https://accounts.google.com/.well-known/openid-configuration"
|
||||
MINIO_IDENTITY_OPENID_CLIENT_ID* (string) unique public identifier for apps e.g. "292085223830.apps.googleusercontent.com"
|
||||
MINIO_IDENTITY_OPENID_CLIENT_SECRET* (string) secret for the unique public identifier for apps
|
||||
MINIO_IDENTITY_OPENID_ROLE_POLICY (string) Set the IAM access policies applicable to this client application and IDP e.g. "app-bucket-write,app-bucket-list"
|
||||
MINIO_IDENTITY_OPENID_CLAIM_NAME (string) JWT canned policy claim name (default: 'policy')
|
||||
MINIO_IDENTITY_OPENID_SCOPES (csv) Comma separated list of OpenID scopes for server, defaults to advertised scopes from discovery document e.g. "email,admin"
|
||||
MINIO_IDENTITY_OPENID_VENDOR (string) Specify vendor type for vendor specific behavior to checking validity of temporary credentials and service accounts on MinIO
|
||||
MINIO_IDENTITY_OPENID_CLAIM_USERINFO (on|off) Enable fetching claims from UserInfo Endpoint for authenticated user
|
||||
MINIO_IDENTITY_OPENID_KEYCLOAK_REALM (string) Specify Keycloak 'realm' name, only honored if vendor was set to 'keycloak' as value, if no realm is specified 'master' is default
|
||||
MINIO_IDENTITY_OPENID_KEYCLOAK_ADMIN_URL (string) Specify Keycloak 'admin' REST API endpoint e.g. http://localhost:8080/auth/admin/
|
||||
MINIO_IDENTITY_OPENID_REDIRECT_URI_DYNAMIC (on|off) Enable 'Host' header based dynamic redirect URI (default: 'off')
|
||||
MINIO_IDENTITY_OPENID_COMMENT (sentence) optionally add a comment to this setting
|
||||
```
|
||||
|
||||
### Access Control Configuration Variables
|
||||
|
||||
Either `MINIO_IDENTITY_OPENID_ROLE_POLICY` (recommended) or `MINIO_IDENTITY_OPENID_CLAIM_NAME` must be specified but not both. See the section Access Control Policies to understand the differences between the two.
|
||||
|
||||
**NOTE**: When configuring multiple OpenID based authentication providers on a MinIO cluster, any number of Role Policy based providers may be configured, and at most one JWT Claim based provider may be configured.
|
||||
|
||||
<details><summary>Example 1: Two role policy providers</summary>
|
||||
|
||||
Sample environment variables:
|
||||
|
||||
```
|
||||
MINIO_IDENTITY_OPENID_DISPLAY_NAME="my first openid"
|
||||
MINIO_IDENTITY_OPENID_CONFIG_URL=http://myopenid.com/.well-known/openid-configuration
|
||||
MINIO_IDENTITY_OPENID_CLIENT_ID="minio-client-app"
|
||||
MINIO_IDENTITY_OPENID_CLIENT_SECRET="minio-client-app-secret"
|
||||
MINIO_IDENTITY_OPENID_SCOPES="openid,groups"
|
||||
MINIO_IDENTITY_OPENID_REDIRECT_URI="http://127.0.0.1:10000/oauth_callback"
|
||||
MINIO_IDENTITY_OPENID_ROLE_POLICY="consoleAdmin"
|
||||
|
||||
MINIO_IDENTITY_OPENID_DISPLAY_NAME_APP2="another oidc"
|
||||
MINIO_IDENTITY_OPENID_CONFIG_URL_APP2="http://anotheroidc.com/.well-known/openid-configuration"
|
||||
MINIO_IDENTITY_OPENID_CLIENT_ID_APP2="minio-client-app-2"
|
||||
MINIO_IDENTITY_OPENID_CLIENT_SECRET_APP2="minio-client-app-secret-2"
|
||||
MINIO_IDENTITY_OPENID_SCOPES_APP2="openid,groups"
|
||||
MINIO_IDENTITY_OPENID_REDIRECT_URI_APP2="http://127.0.0.1:10000/oauth_callback"
|
||||
MINIO_IDENTITY_OPENID_ROLE_POLICY_APP2="readwrite"
|
||||
|
||||
```
|
||||
</details>
|
||||
|
||||
<details><summary>Example 2: Single claim based provider</summary>
|
||||
|
||||
Sample environment variables:
|
||||
|
||||
```
|
||||
MINIO_IDENTITY_OPENID_DISPLAY_NAME="my openid"
|
||||
MINIO_IDENTITY_OPENID_CONFIG_URL=http://myopenid.com/.well-known/openid-configuration
|
||||
MINIO_IDENTITY_OPENID_CLIENT_ID="minio-client-app"
|
||||
MINIO_IDENTITY_OPENID_CLIENT_SECRET="minio-client-app-secret"
|
||||
MINIO_IDENTITY_OPENID_SCOPES="openid,groups"
|
||||
MINIO_IDENTITY_OPENID_REDIRECT_URI="http://127.0.0.1:10000/oauth_callback"
|
||||
MINIO_IDENTITY_OPENID_CLAIM_NAME="groups"
|
||||
```
|
||||
</details>
|
||||
|
||||
### Redirection from OpenID Provider
|
||||
|
||||
To login to MinIO, the user first loads the MinIO console on their browser, and selects the OpenID Provider they wish to use (the `MINIO_IDENTITY_OPENID_DISPLAY_NAME` value is shown here). The user is then redirected to the OpenID provider's login page and performs necessary login actions (e.g. entering credentials, responding to MFA authentication challenges, etc). After successful login, the user is redirected back to the MinIO console. This redirect URL is specified as a parameter by MinIO when the user is redirected to the OpenID Provider in the beginning. For some setups, extra configuration may be required for this step to work correctly.
|
||||
|
||||
For a simple setup where the user/client app accesses MinIO directly (i.e. with no intervening proxies/load-balancers), and each MinIO server (if there are more than one) has a unique domain name, this redirection should work automatically with no further configuration. For example, if the MinIO service is being accessed by the browser at the URL `https://minio-node-1.example.org`, the redirect URL will be `https://minio-node-1.example.org/oauth_callback` and all is well.
|
||||
|
||||
For deployments with a load-balancer (LB), it is required that the LB is configured to send requests from the same user/client-app to the same backend MinIO server (at least for the initial login request and subsequent redirection, as the OpenID auth flow's state parameter is currently local to the MinIO server). For this setup, set the `MINIO_BROWSER_REDIRECT_URL` parameter to the publicly/client-accessible endpoint for the MinIO Console. For example `MINIO_BROWSER_REDIRECT_URL=https://console.minio.example.org`. This will ensure that the redirect URL is set to `https://console.minio.example.org/oauth_callback` and the login process should work correctly.
|
||||
|
||||
For deployments employing DNS round-robin on a single domain to all the MinIO servers, it is possible that after redirection the browser may land on a different MinIO server. For example, the domain `console.minio.example.org` may resolve to `console-X.minio.example.org`, where `X` is `1`, `2`, `3` or `4`. For the login to work, if the user first landed on `console-1.minio.example.org`, they must be redirected back to the same place after logging in at the OpenID provider's web-page. To ensure this, set the `MINIO_IDENTITY_OPENID_REDIRECT_URI_DYNAMIC=on` parameter - this lets MinIO set the redirect URL based on the "Host" header of the (initial login) request.
|
||||
|
||||
The **deprecated** parameter `MINIO_IDENTITY_OPENID_REDIRECT_URI` works similar to the `MINIO_BROWSER_REDIRECT_URL` but needs to include the `/oauth_callback` suffix. Please do not use it, as it is sufficient to the set the `MINIO_BROWSER_REDIRECT_URL` parameter (which is required anyway for most load-balancer based setups to work correctly). This deprecated parameter **will be removed** in a future release.
|
||||
|
||||
## Specifying Access Control with IAM Policies
|
||||
|
||||
The STS API authenticates the user by verifying the JWT provided in the request. However access to object storage resources are controlled via named IAM policies defined in the MinIO instance. Once authenticated via the STS API, the MinIO server applies one or more IAM policies to the generated credentials. MinIO's AssumeRoleWithWebIdentity implementation supports specifying IAM policies in two ways:
|
||||
|
||||
1. Role Policy (Recommended): When specified as part of the OpenID provider configuration, all users authenticating via this provider are authorized to (only) use the specified role policy. The policy to associate with such users is specified via the `role_policy` configuration parameter or the `MINIO_IDENTITY_OPENID_ROLE_POLICY` environment variable. The value is a comma-separated list of IAM access policy names already defined in the server. In this situation, the server prints a role ARN at startup that must be specified as a `RoleArn` API request parameter in the STS AssumeRoleWithWebIdentity API call. When using Role Policies, multiple OpenID providers and/or client applications (with unique client IDs) may be configured with independent role policies. Each configuration is assigned a unique RoleARN by the MinIO server and this is used to select the policies to apply to temporary credentials generated in the AssumeRoleWithWebIdentity call.
|
||||
|
||||
2. `id_token` claims: When the role policy is not configured, MinIO looks for a specific claim in the `id_token` (JWT) returned by the OpenID provider in the STS request. The default claim is `policy` and can be overridden by the `claim_name` configuration parameter or the `MINIO_IDENTITY_OPENID_CLAIM_NAME` environment variable. The claim value can be a string (comma-separated list) or an array of IAM access policy names defined in the server. A `RoleArn` API request parameter *must not* be specified in the STS AssumeRoleWithWebIdentity API call.
|
||||
|
||||
## API Request Parameters
|
||||
|
||||
### WebIdentityToken
|
||||
|
||||
The OAuth 2.0 id_token that is provided by the web identity provider. Application must get this token by authenticating the user who is using your application with a web identity provider before the application makes an AssumeRoleWithWebIdentity call.
|
||||
|
||||
| Params | Value |
|
||||
| :-- | :-- |
|
||||
| *Type* | *String* |
|
||||
| *Length Constraints* | *Minimum length of 4. Maximum length of 2048.* |
|
||||
| *Required* | *Yes* |
|
||||
|
||||
### WebIdentityAccessToken (MinIO Extension)
|
||||
|
||||
There are situations when identity provider does not provide user claims in `id_token` instead it needs to be retrieved from UserInfo endpoint, this extension is only useful in this scenario. This is rare so use it accordingly depending on your Identity provider implementation. `access_token` is available as part of the OIDC authentication flow similar to `id_token`.
|
||||
|
||||
| Params | Value |
|
||||
| :-- | :-- |
|
||||
| *Type* | *String* |
|
||||
| *Required* | *No* |
|
||||
|
||||
### RoleArn
|
||||
|
||||
The role ARN to use. This must be specified if and only if the web identity provider is configured with a role policy.
|
||||
|
||||
| Params | Value |
|
||||
| :-- | :-- |
|
||||
| *Type* | *String* |
|
||||
| *Required* | *No* |
|
||||
|
||||
### Version
|
||||
|
||||
Indicates STS API version information, the only supported value is '2011-06-15'. This value is borrowed from AWS STS API documentation for compatibility reasons.
|
||||
|
||||
| Params | Value |
|
||||
| :-- | :-- |
|
||||
| *Type* | *String* |
|
||||
| *Required* | *Yes* |
|
||||
|
||||
### DurationSeconds
|
||||
|
||||
The duration, in seconds. The value can range from 900 seconds (15 minutes) up to 365 days. If value is higher than this setting, then operation fails. By default, the value is set to 3600 seconds. If no *DurationSeconds* is specified expiry seconds is obtained from *WebIdentityToken*.
|
||||
|
||||
| Params | Value |
|
||||
| :-- | :-- |
|
||||
| *Type* | *Integer* |
|
||||
| *Valid Range* | *Minimum value of 900. Maximum value of 31536000.* |
|
||||
| *Required* | *No* |
|
||||
|
||||
### Policy
|
||||
|
||||
An IAM policy in JSON format that you want to use as an inline session policy. This parameter is optional. Passing policies to this operation returns new temporary credentials. The resulting session's permissions are the intersection of the canned policy name and the policy set here. You cannot use this policy to grant more permissions than those allowed by the canned policy name being assumed.
|
||||
|
||||
| Params | Value |
|
||||
| :-- | :-- |
|
||||
| *Type* | *String* |
|
||||
| *Valid Range* | *Minimum length of 1. Maximum length of 2048.* |
|
||||
| *Required* | *No* |
|
||||
|
||||
### Response Elements
|
||||
|
||||
XML response for this API is similar to [AWS STS AssumeRoleWithWebIdentity](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html#API_AssumeRoleWithWebIdentity_ResponseElements)
|
||||
|
||||
### Errors
|
||||
|
||||
XML error response for this API is similar to [AWS STS AssumeRoleWithWebIdentity](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html#API_AssumeRoleWithWebIdentity_Errors)
|
||||
|
||||
## Sample `POST` Request
|
||||
|
||||
```
|
||||
http://minio.cluster:9000?Action=AssumeRoleWithWebIdentity&DurationSeconds=3600&WebIdentityToken=eyJ4NXQiOiJOVEF4Wm1NeE5ETXlaRGczTVRVMVpHTTBNekV6T0RKaFpXSTRORE5sWkRVMU9HRmtOakZpTVEiLCJraWQiOiJOVEF4Wm1NeE5ETXlaRGczTVRVMVpHTTBNekV6T0RKaFpXSTRORE5sWkRVMU9HRmtOakZpTVEiLCJhbGciOiJSUzI1NiJ9.eyJhdWQiOiJQb0VnWFA2dVZPNDVJc0VOUm5nRFhqNUF1NVlhIiwiYXpwIjoiUG9FZ1hQNnVWTzQ1SXNFTlJuZ0RYajVBdTVZYSIsImlzcyI6Imh0dHBzOlwvXC9sb2NhbGhvc3Q6OTQ0M1wvb2F1dGgyXC90b2tlbiIsImV4cCI6MTU0MTgwOTU4MiwiaWF0IjoxNTQxODA1OTgyLCJqdGkiOiI2Y2YyMGIwZS1lNGZmLTQzZmQtYTdiYS1kYTc3YTE3YzM2MzYifQ.Jm29jPliRvrK6Os34nSK3rhzIYLFjE__zdVGNng3uGKXGKzP3We_i6NPnhA0szJXMOKglXzUF1UgSz8MctbaxFS8XDusQPVe4LkB_45hwBm6TmBxzui911nt-1RbBLN_jZIlvl2lPrbTUH5hSn9kEkph6seWanTNQpz9tNEoVa6R_OX3kpJqxe8tLQUWw453A1JTwFNhdHa6-f1K8_Q_eEZ_4gOYINQ9t_fhTibdbkXZkJQFLop-Jwoybi9s4nwQU_dATocgcufq5eCeNItQeleT-23lGxIz0X7CiJrJynYLdd-ER0F77SumqEb5iCxhxuf4H7dovwd1kAmyKzLxpw&Version=2011-06-15
|
||||
```
|
||||
|
||||
## Sample Response
|
||||
|
||||
```
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<AssumeRoleWithWebIdentityResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
|
||||
<AssumeRoleWithWebIdentityResult>
|
||||
<AssumedRoleUser>
|
||||
<Arn/>
|
||||
<AssumeRoleId/>
|
||||
</AssumedRoleUser>
|
||||
<Credentials>
|
||||
<AccessKeyId>Y4RJU1RNFGK48LGO9I2S</AccessKeyId>
|
||||
<SecretAccessKey>sYLRKS1Z7hSjluf6gEbb9066hnx315wHTiACPAjg</SecretAccessKey>
|
||||
<Expiration>2019-08-08T20:26:12Z</Expiration>
|
||||
<SessionToken>eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJhY2Nlc3NLZXkiOiJZNFJKVTFSTkZHSzQ4TEdPOUkyUyIsImF1ZCI6IlBvRWdYUDZ1Vk80NUlzRU5SbmdEWGo1QXU1WWEiLCJhenAiOiJQb0VnWFA2dVZPNDVJc0VOUm5nRFhqNUF1NVlhIiwiZXhwIjoxNTQxODExMDcxLCJpYXQiOjE1NDE4MDc0NzEsImlzcyI6Imh0dHBzOi8vbG9jYWxob3N0Ojk0NDMvb2F1dGgyL3Rva2VuIiwianRpIjoiYTBiMjc2MjktZWUxYS00M2JmLTg3MzktZjMzNzRhNGNkYmMwIn0.ewHqKVFTaP-j_kgZrcOEKroNUjk10GEp8bqQjxBbYVovV0nHO985VnRESFbcT6XMDDKHZiWqN2vi_ETX_u3Q-w</SessionToken>
|
||||
</Credentials>
|
||||
</AssumeRoleWithWebIdentityResult>
|
||||
<ResponseMetadata/>
|
||||
</AssumeRoleWithWebIdentityResponse>
|
||||
```
|
||||
|
||||
## Using WebIdentity API
|
||||
|
||||
```
|
||||
export MINIO_ROOT_USER=minio
|
||||
export MINIO_ROOT_PASSWORD=minio123
|
||||
export MINIO_IDENTITY_OPENID_CONFIG_URL=https://accounts.google.com/.well-known/openid-configuration
|
||||
export MINIO_IDENTITY_OPENID_CLIENT_ID="843351d4-1080-11ea-aa20-271ecba3924a"
|
||||
# Optional: Allow to specify the requested OpenID scopes (OpenID only requires the `openid` scope)
|
||||
#export MINIO_IDENTITY_OPENID_SCOPES="openid,profile,email"
|
||||
minio server /mnt/export
|
||||
```
|
||||
|
||||
or using `mc`
|
||||
|
||||
```
|
||||
mc admin config get myminio identity_openid
|
||||
identity_openid config_url=https://accounts.google.com/.well-known/openid-configuration client_id=843351d4-1080-11ea-aa20-271ecba3924a
|
||||
```
|
||||
|
||||
Testing with an example
|
||||
> Visit [Google Developer Console](https://console.cloud.google.com) under Project, APIs, Credentials to get your OAuth2 client credentials. Add `http://localhost:8080/oauth2/callback` as a valid OAuth2 Redirect URL.
|
||||
|
||||
```
|
||||
$ go run web-identity.go -cid 204367807228-ok7601k6gj1pgge7m09h7d79co8p35xx.apps.googleusercontent.com -csec XsT_PgPdT1nO9DD45rMLJw7G
|
||||
2018/12/26 17:49:36 listening on http://localhost:8080/
|
||||
```
|
||||
|
||||
> NOTE: for a reasonable test outcome, make sure the assumed user has at least permission/policy to list all buckets. That policy would look like below:
|
||||
|
||||
```
|
||||
{
|
||||
"version": "2012-10-17",
|
||||
"statement": [
|
||||
{
|
||||
"effect": "Allow",
|
||||
"action": [
|
||||
"s3:ListAllMyBuckets"
|
||||
],
|
||||
"resource": [
|
||||
"arn:aws:s3:::*"
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
```
|
||||
|
||||
## Authorization Flow
|
||||
|
||||
- Visit <http://localhost:8080>, login will direct the user to the Google OAuth2 Auth URL to obtain a permission grant.
|
||||
- The redirection URI (callback handler) receives the OAuth2 callback, verifies the state parameter, and obtains a Token.
|
||||
- Using the id_token the callback handler further talks to Google OAuth2 Token URL to obtain an JWT id_token.
|
||||
- Once obtained the JWT id_token is further sent to STS endpoint i.e MinIO to retrieve temporary credentials.
|
||||
- Temporary credentials are displayed on the browser upon successful retrieval.
|
||||
|
||||
## Using MinIO Console
|
||||
|
||||
To support WebIdentity based login for MinIO Console, set openid configuration and restart MinIO
|
||||
|
||||
```
|
||||
mc admin config set myminio identity_openid config_url="<CONFIG_URL>" client_id="<client_identifier>"
|
||||
```
|
||||
|
||||
```
|
||||
mc admin service restart myminio
|
||||
```
|
||||
|
||||
Sample URLs for Keycloak are
|
||||
|
||||
`config_url` - `http://localhost:8080/auth/realms/demo/.well-known/openid-configuration`
|
||||
|
||||
JWT token returned by the Identity Provider should include a custom claim for the policy, this is required to create a STS user in MinIO. The name of the custom claim could be either `policy` or `<NAMESPACE_PREFIX>policy`. If there is no namespace then `claim_prefix` can be ignored. For example if the custom claim name is `https://min.io/policy` then, `claim_prefix` should be set as `https://min.io/`.
|
||||
|
||||
- Open MinIO Console and click `Login with SSO`
|
||||
- The user will be redirected to the Identity Provider login page
|
||||
- Upon successful login on Identity Provider page the user will be automatically logged into MinIO Console.
|
||||
|
||||
## Explore Further
|
||||
|
||||
- [MinIO Admin Complete Guide](https://docs.min.io/community/minio-object-store/reference/minio-mc-admin.html)
|
||||
- [The MinIO documentation website](https://docs.min.io/community/minio-object-store/index.html)
|
||||
101
docs/sts/web-identity.py
Normal file
101
docs/sts/web-identity.py
Normal file
@@ -0,0 +1,101 @@
|
||||
#!/usr/bin/env python
|
||||
# -*- coding: utf-8 -*-
|
||||
|
||||
import json
|
||||
import logging
|
||||
import urllib
|
||||
from uuid import uuid4
|
||||
|
||||
import boto3
|
||||
import requests
|
||||
from botocore.client import Config
|
||||
from flask import Flask, request
|
||||
|
||||
boto3.set_stream_logger('boto3.resources', logging.DEBUG)
|
||||
|
||||
authorize_url = "http://localhost:8080/auth/realms/minio/protocol/openid-connect/auth"
|
||||
token_url = "http://localhost:8080/auth/realms/minio/protocol/openid-connect/token"
|
||||
|
||||
# callback url specified when the application was defined
|
||||
callback_uri = "http://localhost:8000/oauth2/callback"
|
||||
|
||||
# keycloak id and secret
|
||||
client_id = 'account'
|
||||
client_secret = 'daaa3008-80f0-40f7-80d7-e15167531ff0'
|
||||
|
||||
sts_client = boto3.client(
|
||||
'sts',
|
||||
region_name='us-east-1',
|
||||
use_ssl=False,
|
||||
endpoint_url='http://localhost:9000',
|
||||
)
|
||||
|
||||
app = Flask(__name__)
|
||||
|
||||
|
||||
@app.route('/')
|
||||
def homepage():
|
||||
text = '<a href="%s">Authenticate with keycloak</a>'
|
||||
return text % make_authorization_url()
|
||||
|
||||
|
||||
def make_authorization_url():
|
||||
# Generate a random string for the state parameter
|
||||
# Save it for use later to prevent xsrf attacks
|
||||
|
||||
state = str(uuid4())
|
||||
params = {"client_id": client_id,
|
||||
"response_type": "code",
|
||||
"state": state,
|
||||
"redirect_uri": callback_uri,
|
||||
"scope": "openid"}
|
||||
|
||||
url = authorize_url + "?" + urllib.parse.urlencode(params)
|
||||
return url
|
||||
|
||||
|
||||
@app.route('/oauth2/callback')
|
||||
def callback():
|
||||
error = request.args.get('error', '')
|
||||
if error:
|
||||
return "Error: " + error
|
||||
|
||||
authorization_code = request.args.get('code')
|
||||
|
||||
data = {'grant_type': 'authorization_code',
|
||||
'code': authorization_code, 'redirect_uri': callback_uri}
|
||||
id_token_response = requests.post(
|
||||
token_url, data=data, verify=False,
|
||||
allow_redirects=False, auth=(client_id, client_secret))
|
||||
|
||||
print('body: ' + id_token_response.text)
|
||||
|
||||
# we can now use the id_token as much as we want to access protected resources.
|
||||
tokens = json.loads(id_token_response.text)
|
||||
id_token = tokens['id_token']
|
||||
|
||||
response = sts_client.assume_role_with_web_identity(
|
||||
RoleArn='arn:aws:iam::123456789012:user/svc-internal-api',
|
||||
RoleSessionName='test',
|
||||
WebIdentityToken=id_token,
|
||||
DurationSeconds=3600
|
||||
)
|
||||
|
||||
s3_resource = boto3.resource('s3',
|
||||
endpoint_url='http://localhost:9000',
|
||||
aws_access_key_id=response['Credentials']['AccessKeyId'],
|
||||
aws_secret_access_key=response['Credentials']['SecretAccessKey'],
|
||||
aws_session_token=response['Credentials']['SessionToken'],
|
||||
config=Config(signature_version='s3v4'),
|
||||
region_name='us-east-1')
|
||||
|
||||
bucket = s3_resource.Bucket('testbucket')
|
||||
|
||||
for obj in bucket.objects.all():
|
||||
print(obj)
|
||||
|
||||
return "success"
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
app.run(debug=True, port=8000)
|
||||
109
docs/sts/wso2.md
Normal file
109
docs/sts/wso2.md
Normal file
@@ -0,0 +1,109 @@
|
||||
# WSO2 Quickstart Guide [](https://slack.min.io)
|
||||
|
||||
WSO2 is an Identity Server open source and is released under Apache Software License Version 2.0, this document covers configuring WSO2 to be used as an identity provider for MinIO server STS API.
|
||||
|
||||
## Get started
|
||||
|
||||
### 1. Prerequisites
|
||||
|
||||
- JAVA 1.8 and above installed already and JAVA_HOME points to JAVA 1.8 installation.
|
||||
- Download WSO2 follow their [installation guide](https://docs.wso2.com/display/IS540/Installation+Guide).
|
||||
|
||||
### 2. Configure WSO2
|
||||
|
||||
Once WSO2 is up and running, configure WSO2 to generate Self contained id_tokens. In OAuth 2.0 specification there are primarily two ways to provide id_tokens
|
||||
|
||||
1. The id_token is an identifier that is hard to guess. For example, a randomly generated string of sufficient length, that the server handling the protected resource can use to lookup the associated authorization information.
|
||||
2. The id_token self-contains the authorization information in a manner that can be verified. For example, by encoding authorization information along with a signature into the token.
|
||||
|
||||
WSO2 generates tokens in first style by default, but if to be used with MinIO we should configure WSO2 to provide JWT tokens instead.
|
||||
|
||||
### 3. Generate Self-contained Access Tokens
|
||||
|
||||
By default, a UUID is issued as an id_token in WSO2 Identity Server, which is of the first type above. But, it also can be configured to issue a self-contained id_token (JWT), which is of the second type above.
|
||||
|
||||
- Open the `<IS_HOME>/repository/conf/identity/identity.xml` file and uncomment the following entry under `<OAuth>` element.
|
||||
|
||||
```
|
||||
<IdentityOAuthTokenGenerator>org.wso2.carbon.identity.oauth2.token.JWTTokenIssuer</IdentityOAuthTokenGenerator>
|
||||
```
|
||||
|
||||
- Restart the server.
|
||||
- Configure an [OAuth service provider](https://docs.wso2.com/display/IS540/Adding+and+Configuring+a+Service+Provider).
|
||||
- Initiate an id_token request to the WSO2 Identity Server, over a known [grant type](https://docs.wso2.com/display/IS540/OAuth+2.0+Grant+Types). For example, the following cURL command illustrates the syntax of an id_token request that can be initiated over the [Client Credentials Grant](https://docs.wso2.com/display/IS540/Client+Credentials+Grant) grant type.
|
||||
- Navigate to service provider section, expand Inbound Authentication Configurations and expand OAuth/OpenID Connect Configuration.
|
||||
- Copy the OAuth Client Key as the value for `<CLIENT_ID>`.
|
||||
- Copy the OAuth Client Secret as the value for `<CLIENT_SECRET>`.
|
||||
- By default, `<IS_HOST>` is localhost. However, if using a public IP, the respective IP address or domain needs to be specified.
|
||||
- By default, `<IS_HTTPS_PORT>` has been set to 9443. However, if the port offset has been incremented by n, the default port value needs to be incremented by n.
|
||||
|
||||
Request
|
||||
|
||||
```
|
||||
curl -u <CLIENT_ID>:<CLIENT_SECRET> -k -d "grant_type=client_credentials" -H "Content-Type:application/x-www-form-urlencoded" https://<IS_HOST>:<IS_HTTPS_PORT>/oauth2/token
|
||||
```
|
||||
|
||||
Example:
|
||||
|
||||
```
|
||||
curl -u PoEgXP6uVO45IsENRngDXj5Au5Ya:eKsw6z8CtOJVBtrOWvhRWL4TUCga -k -d "grant_type=client_credentials" -H "Content-Type:application/x-www-form-urlencoded" https://localhost:9443/oauth2/token
|
||||
```
|
||||
|
||||
In response, the self-contained JWT id_token will be returned as shown below.
|
||||
|
||||
```
|
||||
{
|
||||
"id_token": "eyJ4NXQiOiJOVEF4Wm1NeE5ETXlaRGczTVRVMVpHTTBNekV6T0RKaFpXSTRORE5sWkRVMU9HRmtOakZpTVEiLCJraWQiOiJOVEF4Wm1NeE5ETXlaRGczTVRVMVpHTTBNekV6T0RKaFpXSTRORE5sWkRVMU9HRmtOakZpTVEiLCJhbGciOiJSUzI1NiJ9.eyJhdWQiOiJQb0VnWFA2dVZPNDVJc0VOUm5nRFhqNUF1NVlhIiwiYXpwIjoiUG9FZ1hQNnVWTzQ1SXNFTlJuZ0RYajVBdTVZYSIsImlzcyI6Imh0dHBzOlwvXC9sb2NhbGhvc3Q6OTQ0M1wvb2F1dGgyXC90b2tlbiIsImV4cCI6MTUzNDg5MTc3OCwiaWF0IjoxNTM0ODg4MTc4LCJqdGkiOiIxODQ0MzI5Yy1kNjVhLTQ4YTMtODIyOC05ZGY3M2ZlODNkNTYifQ.ELZ8ujk2Xp9xTGgMqnCa5ehuimaAPXWlSCW5QeBbTJIT4M5OB_2XEVIV6p89kftjUdKu50oiYe4SbfrxmLm6NGSGd2qxkjzJK3SRKqsrmVWEn19juj8fz1neKtUdXVHuSZu6ws_bMDy4f_9hN2Jv9dFnkoyeNT54r4jSTJ4A2FzN2rkiURheVVsc8qlm8O7g64Az-5h4UGryyXU4zsnjDCBKYk9jdbEpcUskrFMYhuUlj1RWSASiGhHHHDU5dTRqHkVLIItfG48k_fb-ehU60T7EFWH1JBdNjOxM9oN_yb0hGwOjLUyCUJO_Y7xcd5F4dZzrBg8LffFmvJ09wzHNtQ",
|
||||
"token_type": "Bearer",
|
||||
"expires_in": 3600
|
||||
}
|
||||
```
|
||||
|
||||
### 4. JWT Claims
|
||||
|
||||
The id_token received is a signed JSON Web Token (JWT). Use a JWT decoder to decode the id_token to access the payload of the token that includes following JWT claims:
|
||||
|
||||
| Claim Name | Type | Claim Value |
|
||||
|:----------:|:--------------:|:---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------:|
|
||||
| iss | _string_ | The issuer of the JWT. The '> Identity Provider Entity Id ' value of the OAuth2/OpenID Connect Inbound Authentication configuration of the Resident Identity Provider is returned here. |
|
||||
| aud | _string array_ | The token audience list. The client identifier of the OAuth clients that the JWT is intended for, is sent herewith. |
|
||||
| azp | _string_ | The authorized party for which the token is issued to. The client identifier of the OAuth client that the token is issued for, is sent herewith. |
|
||||
| iat | _integer_ | The token issue time. |
|
||||
| exp | _integer_ | The token expiration time. |
|
||||
| jti | _string_ | Unique identifier for the JWT token. |
|
||||
| policy | _string_ | Canned policy name to be applied for STS credentials. (Recommended) |
|
||||
|
||||
Using the above `id_token` we can perform an STS request to MinIO to get temporary credentials for MinIO API operations. MinIO STS API uses [JSON Web Key Set Endpoint](https://docs.wso2.com/display/IS541/JSON+Web+Key+Set+Endpoint) to validate if JWT is valid and is properly signed.
|
||||
|
||||
**We recommend setting `policy` as a custom claim for the JWT service provider follow [here](https://docs.wso2.com/display/IS550/Configuring+Claims+for+a+Service+Provider) and [here](https://docs.wso2.com/display/IS550/Handling+Custom+Claims+with+the+JWT+Bearer+Grant+Type) for relevant docs on how to configure claims for a service provider.**
|
||||
|
||||
### 5. Setup MinIO with OpenID configuration URL
|
||||
|
||||
MinIO server expects environment variable for OpenID configuration url as `MINIO_IDENTITY_OPENID_CONFIG_URL`, this environment variable takes a single entry.
|
||||
|
||||
```
|
||||
export MINIO_IDENTITY_OPENID_CONFIG_URL=https://localhost:9443/oauth2/oidcdiscovery/.well-known/openid-configuration
|
||||
export MINIO_IDENTITY_OPENID_CLIENT_ID="843351d4-1080-11ea-aa20-271ecba3924a"
|
||||
minio server /mnt/data
|
||||
```
|
||||
|
||||
Assuming that MinIO server is configured to support STS API by following the doc [MinIO STS Quickstart Guide](https://docs.min.io/community/minio-object-store/developers/security-token-service.html), execute the following command to temporary credentials from MinIO server.
|
||||
|
||||
```
|
||||
go run client-grants.go -cid PoEgXP6uVO45IsENRngDXj5Au5Ya -csec eKsw6z8CtOJVBtrOWvhRWL4TUCga
|
||||
|
||||
##### Credentials
|
||||
{
|
||||
"accessKey": "IRBLVDGN5QGMDCMO1X8V",
|
||||
"secretKey": "KzS3UZKE7xqNdtRbKyfcWgxBS6P1G4kwZn4DXKuY",
|
||||
"expiration": "2018-08-21T15:49:38-07:00",
|
||||
"sessionToken": "eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJhY2Nlc3NLZXkiOiJJUkJMVkRHTjVRR01EQ01PMVg4ViIsImF1ZCI6IlBvRWdYUDZ1Vk80NUlzRU5SbmdEWGo1QXU1WWEiLCJhenAiOiJQb0VnWFA2dVZPNDVJc0VOUm5nRFhqNUF1NVlhIiwiZXhwIjoxNTM0ODkxNzc4LCJpYXQiOjE1MzQ4ODgxNzgsImlzcyI6Imh0dHBzOi8vbG9jYWxob3N0Ojk0NDMvb2F1dGgyL3Rva2VuIiwianRpIjoiMTg0NDMyOWMtZDY1YS00OGEzLTgyMjgtOWRmNzNmZTgzZDU2In0.4rKsZ8VkZnIS_ALzfTJ9UbEKPFlQVvIyuHw6AWTJcDFDVgQA2ooQHmH9wUDnhXBi1M7o8yWJ47DXP-TLPhwCgQ"
|
||||
}
|
||||
```
|
||||
|
||||
These credentials can now be used to perform MinIO API operations, these credentials automatically expire in 1hr. To understand more about credential expiry duration and client grants STS API read further [here](https://github.com/minio/minio/blob/master/docs/sts/client-grants.md).
|
||||
|
||||
## Explore Further
|
||||
|
||||
- [MinIO STS Quickstart Guide](https://docs.min.io/community/minio-object-store/developers/security-token-service.html)
|
||||
- [The MinIO documentation website](https://docs.min.io/community/minio-object-store/index.html)
|
||||
Reference in New Issue
Block a user