Buckit Object Storage User Guide

Security Token Service (STS)

The Buckit Security Token Service (STS) APIs allow applications to generate temporary credentials for accessing the Buckit deployment.

The STS API is required for Buckit deployments configured to use external identity managers, as the API allows conversion of the external IDP credentials into AWS Signature v4-compatible credentials.

STS API Endpoints

Buckit supports the following STS API endpoints:

Endpoint	Supported IDP	Description
AssumeRole	Built-in users	Generates temporary credentials from an existing built-in user’s access key and secret key.
AssumeRoleWithWebIdentity	OpenID Connect	Generates an access key and secret key using the JWT token returned by the OIDC provider
AssumeRoleWithClientGrants	OpenID Connect / OAuth 2.0 client credentials grant	Generates an access key and secret key using an OAuth 2.0 access token returned by the identity provider.
AssumeRoleWithLDAPIdentity	Active Directory / LDAP	Generates an access key and secret key using the AD/LDAP credentials specified to the API endpoint.
AssumeRoleWithCustomToken	Buckit Identity Plugin	Generates a token for use with an external identity provider and the Buckit Identity Plugin.
AssumeRoleWithCertificate	X.509 / TLS certificate	Generates an access key and secret key by mapping the subject common name (CN) of a client TLS certificate to a matching policy.