# AssumeRoleWithLDAPIdentity

LLMS index: [llms.txt](/llms.txt)

---

<a id="assumerolewithldapidentity"></a>
<a id="minio-sts-assumerolewithldapidentity"></a>

The MinIO Security Token Service (STS) `AssumeRoleWithLDAPIdentity` API endpoint generates temporary access credentials using Active Directory or LDAP user credentials. This page documents the MinIO server `AssumeRoleWithLDAPIdentity` endpoint. For instructions on implementing STS using an S3-compatible SDK, defer to the documentation for that SDK.

The MinIO STS `AssumeRoleWithLDAPIdentity` API endpoint is modeled after the AWS [AssumeRoleWithWebIdentity](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html) endpoint and shares certain request/response elements. This page documents the MinIO-specific syntax and links out to the AWS reference for all shared elements.

## Request Endpoint {#request-endpoint}

The `AssumeRoleWithLDAPIdentity` endpoint has the following form:

```shell
POST https://minio.example.net?Action=AssumeRoleWithLDAPIdentity[&ARGS]
```

The following example uses all supported arguments. Replace the `minio.example.net` hostname with the appropriate URL for your MinIO cluster:

```shell
POST https://minio.example.net?Action=AssumeRoleWithLDAPIdentity
&LDAPUsername=USERNAME
&LDAPPassword=PASSWORD
&Version=2011-06-15
&Policy={}
```

### Request Query Parameters {#request-query-parameters}

This endpoint supports the following query parameters:

<table>
  <thead>
    <tr>
      <th><p>Parameter</p></th>
      <th><p>Type</p></th>
      <th><p>Description</p></th>
    </tr>
  </thead>
  <tbody>
    <tr>
      <td><p><code>LDAPUsername</code></p></td>
      <td><p>string</p></td>
      <td><p><em>Required</em></p><p>Specify the username of the AD/LDAP user as whom you want to
authenticate.</p></td>
    </tr>
    <tr>
      <td><p><code>LDAPPassword</code></p></td>
      <td><p>string</p></td>
      <td><p><em>Required</em></p><p>Specify the password for the <code>LDAPUsername</code>.</p></td>
    </tr>
    <tr>
      <td><p><code>Version</code></p></td>
      <td><p>string</p></td>
      <td><p><em>Required</em></p><p>Specify <code>2011-06-15</code>.</p></td>
    </tr>
    <tr>
      <td><p><code>DurationSeconds</code></p></td>
      <td><p>integer</p></td>
      <td><p><em>Optional</em></p><p>Specify the number of seconds after which the temporary credentials
expire. Defaults to <code>3600</code>.</p><ul><li><p>The minimum value is <code>900</code> or 15 minutes.</p></li><li><p>The maximum value is <code>604800</code> or 7 days.</p></li></ul><p>If <code>DurationSeconds</code> is omitted, MinIO checks the JWT token for an
<code>exp</code> claim before using the default duration. See
<a href="https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.4">RFC 7519 4.1.4: Expiration Time Claim</a>
for more information on JSON web token expiration.</p></td>
    </tr>
    <tr>
      <td><p><code>Policy</code></p></td>
      <td><p>string</p></td>
      <td><p><em>Optional</em></p><p>Specify the URL-encoded JSON-formatted <a href="/administration/identity-access-management/policy-based-access-control/#minio-policy">policy</a> to
use as an inline session policy.</p><ul><li><p>The minimum string length is <code>1</code>.</p></li><li><p>The maximum string length is <code>2048</code>.</p></li></ul><p>The resulting permissions for the temporary credentials are the
intersection between the <a href="/operations/external-iam/#minio-external-identity-management-ad-ldap-access-control">policy</a> matching the Distinguished
Name (DN) of the <code>LDAPUsername</code> and the specified inline policy.
Applications can only perform those operations for which they are
explicitly authorized.</p><p>The inline policy can specify a subset of permissions allowed by the
policy specified in the DN policy. Applications can never assume
more privileges than those specified in the DN policy.</p><p>Omit to use only the DN policy.</p><p>See <a href="/administration/identity-access-management/#minio-access-management">Access Management</a> for more information on MinIO
authentication and authorization.</p></td>
    </tr>
  </tbody>
</table>

## Response Elements {#response-elements}

The XML response for this API endpoint is similar to the AWS [AssumeRoleWithLDAPIdentity response](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithLDAPIdentity.html#API_AssumeRoleWithLDAPIdentity_ResponseElements). Specifically, MinIO returns an `AssumeRoleWithLDAPIdentityResult` object, where the `AssumedRoleUser.Credentials` object contains the temporary credentials generated by MinIO:

- `AccessKeyId` - The access key applications use for authentication.
- `SecretKeyId` - The secret key applications use for authentication.
- `Expiration` - The <a id="index-0"></a>[**RFC3339**](https://datatracker.ietf.org/doc/html/rfc3339.html) date and time after which the credentials expire.
- `SessionToken` - The session token applications use for authentication. Some SDKs may require this field when using temporary credentials.

The following example is similar to the response returned by the MinIO STS `AssumeRoleWithLDAPIdentity` endpoint:

```xml
<?xml version="1.0" encoding="UTF-8"?>
<AssumeRoleWithLDAPIdentityResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
<AssumeRoleWithLDAPIdentityResult>
   <AssumedRoleUser>
      <Arn/>
      <AssumeRoleId/>
   </AssumedRoleUser>
   <Credentials>
      <AccessKeyId>Y4RJU1RNFGK48LGO9I2S</AccessKeyId>
      <SecretAccessKey>sYLRKS1Z7hSjluf6gEbb9066hnx315wHTiACPAjg</SecretAccessKey>
      <Expiration>2019-08-08T20:26:12Z</Expiration>
      <SessionToken>eyJhbGciOiJIUzUxMiIsInR5cCI6IkpXVCJ9.eyJhY2Nlc3NLZXkiOiJZNFJKVTFSTkZHSzQ4TEdPOUkyUyIsImF1ZCI6IlBvRWdYUDZ1Vk80NUlzRU5SbmdEWGo1QXU1WWEiLCJhenAiOiJQb0VnWFA2dVZPNDVJc0VOUm5nRFhqNUF1NVlhIiwiZXhwIjoxNTQxODExMDcxLCJpYXQiOjE1NDE4MDc0NzEsImlzcyI6Imh0dHBzOi8vbG9jYWxob3N0Ojk0NDMvb2F1dGgyL3Rva2VuIiwianRpIjoiYTBiMjc2MjktZWUxYS00M2JmLTg3MzktZjMzNzRhNGNkYmMwIn0.ewHqKVFTaP-j_kgZrcOEKroNUjk10GEp8bqQjxBbYVovV0nHO985VnRESFbcT6XMDDKHZiWqN2vi_ETX_u3Q-w</SessionToken>
   </Credentials>
</AssumeRoleWithLDAPIdentityResult>
<ResponseMetadata/>
</AssumeRoleWithLDAPIdentityResponse>
```

## Error Elements {#error-elements}

The XML error response for this API endpoint is similar to the AWS [AssumeRoleWithLDAPIdentity response](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithLDAPIdentity.html#API_AssumeRoleWithLDAPIdentity_Errors).