MinioClientWithClientGrantsProvider.java

/*
 * MinIO Java SDK for Amazon S3 Compatible Cloud Storage, (C) 2020 MinIO, Inc.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     https://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

import com.fasterxml.jackson.annotation.JsonAutoDetect;
import com.fasterxml.jackson.databind.DeserializationFeature;
import com.fasterxml.jackson.databind.ObjectMapper;
import com.fasterxml.jackson.databind.introspect.VisibilityChecker;
import io.minio.MinioClient;
import io.minio.StatObjectArgs;
import io.minio.StatObjectResponse;
import io.minio.credentials.ClientGrantsProvider;
import io.minio.credentials.Jwt;
import io.minio.credentials.Provider;
import java.io.IOException;
import java.security.ProviderException;
import java.util.Objects;
import javax.annotation.Nonnull;
import okhttp3.FormBody;
import okhttp3.OkHttpClient;
import okhttp3.Request;
import okhttp3.RequestBody;
import okhttp3.Response;

public class MinioClientWithClientGrantsProvider {
  static Jwt getJwt(
      @Nonnull String clientId, @Nonnull String clientSecret, @Nonnull String idpEndpoint) {
    Objects.requireNonNull(clientId, "Client id must not be null");
    Objects.requireNonNull(clientSecret, "ClientSecret must not be null");

    RequestBody requestBody =
        new FormBody.Builder()
            .add("username", clientId)
            .add("password", clientSecret)
            .add("grant_type", "client_credentials")
            .build();

    Request request = new Request.Builder().url(idpEndpoint).post(requestBody).build();

    OkHttpClient client = new OkHttpClient();
    try (Response response = client.newCall(request).execute()) {
      ObjectMapper mapper = new ObjectMapper();
      mapper.disable(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES);
      mapper.setVisibility(
          VisibilityChecker.Std.defaultInstance()
              .withFieldVisibility(JsonAutoDetect.Visibility.ANY));
      return mapper.readValue(response.body().charStream(), Jwt.class);
    } catch (IOException e) {
      throw new ProviderException(e);
    }
  }

  public static void main(String[] args) throws Exception {
    // IDP endpoint.
    String idpEndpoint =
        "https://IDP-HOST:IDP-PORT/auth/realms/master/protocol/openid-connect/token";

    // Client-ID to fetch JWT.
    String clientId = "IDP-CLIENT-ID";

    // Client secret to fetch JWT.
    String clientSecret = "IDP-CLIENT-SECRET";

    // STS endpoint usually point to MinIO server.
    String stsEndpoint = "http://STS-HOST:STS-PORT/";

    // Policy to Credentials. - optional, primary policy
    // is inherited from JWT claims mapping.
    String policy = null;

    //
    // String policy =
    //     new StringBuilder()
    //         .append("{\n")
    //         .append("    \"Statement\": [\n")
    //         .append("       " + " {\n")
    //         .append("            \"Action\": [\n")
    //         .append("                \"s3:GetBucketLocation\",\n")
    //         .append("                \"s3:ListBucket\"\n")
    //         .append("            ],\n")
    //         .append("            \"Effect\": \"Allow\",\n")
    //         .append("            \"Principal\": \"*\",\n")
    //         .append("            \"Resource\": \"arn:aws:s3:::test\"\n")
    //         .append("        }\n")
    //         .append("    ],\n")
    //         .append("    \"Version\": \"2012-10-17\"\n")
    //         .append("}\n")
    //         .toString();

    Provider provider =
        new ClientGrantsProvider(
            () -> getJwt(clientId, clientSecret, idpEndpoint), stsEndpoint, null, policy, null);

    MinioClient minioClient =
        MinioClient.builder()
            .endpoint("https://MINIO-HOST:MINIO-PORT")
            .credentialsProvider(provider)
            .build();

    // Get information of an object.
    StatObjectResponse stat =
        minioClient.statObject(
            StatObjectArgs.builder().bucket("my-bucketname").object("my-objectname").build());
    System.out.println(stat);
  }
}