AssumeRoleWithCustomToken

The MinIO Security Token Service (STS) AssumeRoleWithCustomToken API endpoint exchanges a token validated by the MinIO External Identity Management Plugin for temporary S3 credentials.

Request Endpoint

The AssumeRoleWithCustomToken endpoint has the following form:

POST https://minio.example.net?Action=AssumeRoleWithCustomToken[&ARGS]

The following example uses all supported arguments. Replace the minio.example.net hostname with the appropriate URL for your MinIO cluster:

POST https://minio.example.net?Action=AssumeRoleWithCustomToken
&Token=TOKEN
&Version=2011-06-15
&DurationSeconds=86000
&RoleArn=ROLE_ARN_FROM_PLUGIN_CONFIGURATION

Request Query Parameters

This endpoint supports the following query parameters:

Parameter	Type	Description
`Token`	string	Required Specify the JSON Token to present to the external identity manager. MinIO expects the identity manager to parse the token and determine whether to authenticate client requests using that token.
`Version`	string	Required Specify `2011-06-15`.
`RoleArn`	string	Required Specify the ARN for the Identity Manager Plugin configuration to associate with this STS request. See `MINIO_IDENTITY_PLUGIN_ROLE_ID` or `identity_plugin role_id` for more information. Note that MinIO automatically prepends `idmp-` to a configured `ROLE_ID` when generating the RoleArn. Include that string with the `ROLE_ID` if required.
`DurationSeconds`	integer	Optional Specify the number of seconds after which the temporary credentials expire. If omitted, SILO uses the identity plugin's `maxValiditySeconds`. If supplied, the effective duration is the smaller of this request and the plugin limit. The plugin must return a limit between `900` and `31536000` seconds (15 minutes to 365 days). There is no fixed one-hour default for this endpoint. Request a positive duration suitable for the application.

Response Elements

MinIO returns an AssumeRoleWithCustomTokenResult object, where the Credentials object contains the temporary credentials generated by MinIO:

AccessKeyId - The access key applications use for authentication.
SecretAccessKey - The secret key applications use for authentication.
Expiration - The RFC3339 date and time after which the credentials expire.
SessionToken - Required with the access key and secret key when signing S3 requests with these temporary credentials.

The following example is similar to the response returned by the MinIO STS AssumeRoleWithCustomToken endpoint:

<?xml version="1.0" encoding="UTF-8"?>
<AssumeRoleWithCustomTokenResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
<AssumeRoleWithCustomTokenResult>
   <Credentials>
      <AccessKeyId>ACCESS_KEY</AccessKeyId>
      <SecretAccessKey>SECRET_KEY</SecretAccessKey>
      <Expiration>YYYY-MM-DDTHH:MM:SSZ</Expiration>
      <SessionToken>TOKEN</SessionToken>
   </Credentials>
   <AssumedUser>custom:Alice</AssumedUser>
</AssumeRoleWithCustomTokenResult>
<ResponseMetadata>
   <RequestId>UNIQUE_ID</RequestId>
</ResponseMetadata>
</AssumeRoleWithCustomTokenResponse>

Error Elements

The XML error response for this API endpoint is similar to the AWS AssumeRoleWithWebIdentity response.

JavaScript is required to load comments. View discussions on GitHub.