Buckit Object Storage User Guide

`AssumeRoleWithClientGrants`

The Buckit Security Token Service (STS) AssumeRoleWithClientGrants API endpoint generates temporary credentials from an OAuth 2.0 access token obtained through a client credentials grant.

This endpoint requires a configured OpenID Connect (OIDC) provider. Buckit validates the JWT access token against the configured provider and issues temporary S3 credentials when the request succeeds.

The Buckit STS AssumeRoleWithClientGrants API endpoint is modeled after the AWS AssumeRoleWithWebIdentity response and error structure, with Buckit-specific request parameters.

Request Endpoint

The AssumeRoleWithClientGrants endpoint has the following form:

POST https://buckit.example.net?Action=AssumeRoleWithClientGrants[&ARGS]

The following example uses all supported arguments:

POST https://buckit.example.net?Action=AssumeRoleWithClientGrants
&Token=TOKEN
&Version=2011-06-15
&DurationSeconds=86000
&Policy={}
&RoleArn=ROLE_ARN

Request Query Parameters

This endpoint supports the following query parameters:

Parameter	Type	Description
`Token`	string	Required Specify the OAuth 2.0 access token returned by the configured OIDC provider.
`Version`	string	Required Specify `2011-06-15`.
`DurationSeconds`	integer	Optional Specify the number of seconds after which the temporary credentials expire. The minimum value is `900` or 15 minutes. The maximum value is `31536000` or 365 days. If omitted, Buckit derives the expiration from the JWT token or uses the provider defaults configured on the server.
`Policy`	string	Optional Specify the URL-encoded JSON-formatted policy to use as an inline session policy. The minimum string length is `1`. The maximum string length is `2048`.
`RoleArn`	string	Optional Specify the Role ARN for an OIDC RolePolicy mapping. If omitted, Buckit attempts to authorize the request using policy claims in the JWT token.

Response Elements

The XML response for this API endpoint is similar to the AWS AssumeRoleWithWebIdentity response. Specifically, Buckit returns an AssumeRoleWithClientGrantsResult object, where the Credentials object contains the temporary credentials generated by Buckit.

Error Elements

The XML error response for this API endpoint is similar to the AWS AssumeRoleWithWebIdentity errors.