AssumeRoleWithCertificate
The Buckit Security Token Service (STS) AssumeRoleWithCertificate API
endpoint generates temporary credentials by authenticating the client with an
X.509 / TLS client certificate.
This endpoint is disabled by default. To use it, enable Buckit’s TLS identity
provider support with MINIO_IDENTITY_TLS_ENABLE=on and configure the server
to accept client certificates.
Buckit maps the client certificate’s subject common name (CN) to a matching
policy. For example, a certificate with CN=consoleAdmin
is associated with a policy named consoleAdmin.
Request Endpoint
The AssumeRoleWithCertificate endpoint has the following form:
POST https://buckit.example.net?Action=AssumeRoleWithCertificate[&ARGS]
The request must use HTTPS and include a client certificate.
Request Query Parameters
This endpoint supports the following query parameters:
Parameter |
Type |
Description |
|---|---|---|
|
string |
Required Specify |
|
integer |
Optional Specify the number of seconds after which the temporary credentials expire.
|
Response Elements
Buckit returns an AssumeRoleWithCertificateResult object, where the
Credentials object contains the temporary credentials generated by Buckit:
AccessKeyId- The access key applications use for authentication.SecretAccessKey- The secret key applications use for authentication.Expiration- The RFC3339 date and time after which the credentials expire.SessionToken- The session token applications use for authentication.
Error Elements
Common failure cases include:
the TLS identity provider is not enabled
the request does not use HTTPS
the client certificate is missing or invalid
the certificate common name does not map to a valid policy
