Add ToC for all STS API docs (minio#8318)

woli · Sep 27, 2019 · f3022e8 · f3022e8
1 parent c28405a
commit f3022e8
Show file tree

Hide file tree

Showing 4 changed files with 141 additions and 67 deletions.
diff --git a/docs/sts/assume-role.md b/docs/sts/assume-role.md
@@ -1,24 +1,42 @@
-## AssumeRole [![Slack](https://slack.min.io/slack?type=svg)](https://slack.min.io)
+# AssumeRole [![Slack](https://slack.min.io/slack?type=svg)](https://slack.min.io)
+
+**Table of Contents**
+
+- [Introduction](#introduction)
+- [API Request Parameters](#api-request-parameters)
+    - [Version](#version)
+    - [AUTHPARAMS](#authparams)
+    - [DurationSeconds](#durationseconds)
+    - [Policy](#policy)
+    - [Response Elements](#response-elements)
+    - [Errors](#errors)
+- [Sample Request](#sample-request)
+- [Sample Response](#sample-response)
+- [Testing](#testing)
+
+
+## Introduction
+
 Returns a set of temporary security credentials that you can use to access MinIO resources. AssumeRole requires authorization credentials for an existing user on MinIO. The advantages of this API are
 
 - To be able to reliably use S3 multipart APIs feature of the SDKs without re-inventing the wheel of pre-signing the each URL in multipart API. This is very tedious to implement with all the scenarios of fault tolerance that's already implemented by the client SDK. The general client SDKs don't support multipart with presigned URLs.
 - To be able to easily get the temporary credentials to upload to a prefix. Make it possible for a client to upload a whole folder using the session. The server side applications need not create a presigned URL and serve to the client for each file. Since, the client would have the session it can do it by itself.
 
 The temporary security credentials returned by this API consists of an access key, a secret key, and a security token. Applications can use these temporary security credentials to sign calls to MinIO API operations. The policy applied to these temporary credentials is inherited from the MinIO user credentials. By default, the temporary security credentials created by AssumeRole last for one hour. However, use the optional DurationSeconds parameter to specify the duration of the credentials. This value varies from 900 seconds (15 minutes) up to the maximum session duration to 12 hours.
 
-### API Request Parameters
-#### Version
+## API Request Parameters
+### Version
 Indicates STS API version information, the only supported value is '2011-06-15'. This value is borrowed from AWS STS API documentation for compatibility reasons.
 
 | Params     | Value    |
 | :--        | :--      |
 | *Type*     | *String* |
 | *Required* | *Yes*    |
 
-#### AUTHPARAMS
+### AUTHPARAMS
 Indicates STS API Authorization information. If you are familiar with AWS Signature V4 Authorization header, this STS API supports signature V4 authorization as mentioned [here](https://docs.aws.amazon.com/general/latest/gr/signature-version-4.html)
 
-#### DurationSeconds
+### DurationSeconds
 The duration, in seconds. The value can range from 900 seconds (15 minutes) up to 12 hours. If value is higher than this setting, then operation fails. By default, the value is set to 3600 seconds.
 
 | Params        | Value                                           |
@@ -27,7 +45,7 @@ The duration, in seconds. The value can range from 900 seconds (15 minutes) up t
 | *Valid Range* | *Minimum value of 900. Maximum value of 43200.* |
 | *Required*    | *No*                                            |
 
-#### Policy
+### Policy
 An IAM policy in JSON format that you want to use as an inline session policy. This parameter is optional. Passing policies to this operation returns new temporary credentials. The resulting session's permissions are the intersection of the canned policy name and the policy set here. You cannot use this policy to grant more permissions than those allowed by the canned policy name being assumed.
 
 | Params        | Value                                          |
@@ -36,18 +54,18 @@ An IAM policy in JSON format that you want to use as an inline session policy. T
 | *Valid Range* | *Minimum length of 1. Maximum length of 2048.* |
 | *Required*    | *No*                                           |
 
-#### Response Elements
+### Response Elements
 XML response for this API is similar to [AWS STS AssumeRole](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html#API_AssumeRole_ResponseElements)
 
-#### Errors
+### Errors
 XML error response for this API is similar to [AWS STS AssumeRole](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html#API_AssumeRole_Errors)
 
-#### Sample Request
+## Sample Request
 ```
 http://minio:9000/?Action=AssumeRole&DurationSeconds=3600&Version=2011-06-15&Policy={"Version":"2012-10-17","Statement":[{"Sid":"Stmt1","Effect":"Allow","Action":"s3:*","Resource":"arn:aws:s3:::*"}]}&AUTHPARAMS
 ```
 
-#### Sample Response
+## Sample Response
 ```
 <?xml version="1.0" encoding="UTF-8"?>
 <AssumeRoleResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
@@ -69,7 +87,7 @@ http://minio:9000/?Action=AssumeRole&DurationSeconds=3600&Version=2011-06-15&Pol
 </AssumeRoleResponse>
 ```
 
-#### Testing
+## Testing
 ```
 $ export MINIO_ACCESS_KEY=minio
 $ export MINIO_SECRET_KEY=minio123

diff --git a/docs/sts/client-grants.md b/docs/sts/client-grants.md
@@ -1,12 +1,29 @@
-## AssumeRoleWithClientGrants [![Slack](https://slack.min.io/slack?type=svg)](https://slack.min.io)
+# AssumeRoleWithClientGrants [![Slack](https://slack.min.io/slack?type=svg)](https://slack.min.io)
+
+**Table of Contents**
+
+- [Introduction](#introduction)
+- [API Request Parameters](#api-request-parameters)
+    - [Token](#token)
+    - [Version](#version)
+    - [DurationSeconds](#durationseconds)
+    - [Policy](#policy)
+    - [Response Elements](#response-elements)
+    - [Errors](#errors)
+- [Sample Request](#sample-request)
+- [Sample Response](#sample-response)
+- [Testing](#testing)
+
+## Introduction
+
 Returns a set of temporary security credentials for applications/clients who have been authenticated through client credential grants provided by identity provider. Example providers include WSO2, KeyCloak etc.
 
 Calling AssumeRoleWithClientGrants does not require the use of MinIO default credentials. Therefore, client application can be distributed that requests temporary security credentials without including MinIO default credentials. Instead, the identity of the caller is validated by using a JWT access token from the identity provider. The temporary security credentials returned by this API consists of an access key, a secret key, and a security token. Applications can use these temporary security credentials to sign calls to MinIO API operations.
 
 By default, the temporary security credentials created by AssumeRoleWithClientGrants last for one hour. However, use the optional DurationSeconds parameter to specify the duration of the credentials. This value varies from 900 seconds (15 minutes) up to the maximum session duration to 12 hours.
 
-### API Request Parameters
-#### Token
+## API Request Parameters
+### Token
 The OAuth 2.0 access token that is provided by the identity provider. Application must get this token by authenticating the application using client credential grants before the application makes an AssumeRoleWithClientGrants call.
 
 | Params               | Value                                          |
@@ -15,15 +32,15 @@ The OAuth 2.0 access token that is provided by the identity provider. Applicatio
 | *Length Constraints* | *Minimum length of 4. Maximum length of 2048.* |
 | *Required*           | *Yes*                                          |
 
-#### Version
+### Version
 Indicates STS API version information, the only supported value is '2011-06-15'.  This value is borrowed from AWS STS API documentation for compatibility reasons.
 
 | Params     | Value    |
 | :--        | :--      |
 | *Type*     | *String* |
 | *Required* | *Yes*    |
 
-#### DurationSeconds
+### DurationSeconds
 The duration, in seconds. The value can range from 900 seconds (15 minutes) up to 12 hours. If value is higher than this setting, then operation fails. By default, the value is set to 3600 seconds.
 
 | Params        | Value                                           |
@@ -32,7 +49,7 @@ The duration, in seconds. The value can range from 900 seconds (15 minutes) up t
 | *Valid Range* | *Minimum value of 900. Maximum value of 43200.* |
 | *Required*    | *No*                                            |
 
-#### Policy
+### Policy
 An IAM policy in JSON format that you want to use as an inline session policy. This parameter is optional. Passing policies to this operation returns new temporary credentials. The resulting session's permissions are the intersection of the canned policy name and the policy set here. You cannot use this policy to grant more permissions than those allowed by the canned policy name being assumed.
 
 | Params        | Value                                          |
@@ -41,18 +58,18 @@ An IAM policy in JSON format that you want to use as an inline session policy. T
 | *Valid Range* | *Minimum length of 1. Maximum length of 2048.* |
 | *Required*    | *No*                                           |
 
-#### Response Elements
+### Response Elements
 XML response for this API is similar to [AWS STS AssumeRoleWithWebIdentity](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html#API_AssumeRoleWithWebIdentity_ResponseElements)
 
-#### Errors
+### Errors
 XML error response for this API is similar to [AWS STS AssumeRoleWithWebIdentity](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html#API_AssumeRoleWithWebIdentity_Errors)
 
-#### Sample Request
+## Sample Request
 ```
 http://minio.cluster:9000?Action=AssumeRoleWithClientGrants&DurationSeconds=3600&Token=eyJ4NXQiOiJOVEF4Wm1NeE5ETXlaRGczTVRVMVpHTTBNekV6T0RKaFpXSTRORE5sWkRVMU9HRmtOakZpTVEiLCJraWQiOiJOVEF4Wm1NeE5ETXlaRGczTVRVMVpHTTBNekV6T0RKaFpXSTRORE5sWkRVMU9HRmtOakZpTVEiLCJhbGciOiJSUzI1NiJ9.eyJhdWQiOiJQb0VnWFA2dVZPNDVJc0VOUm5nRFhqNUF1NVlhIiwiYXpwIjoiUG9FZ1hQNnVWTzQ1SXNFTlJuZ0RYajVBdTVZYSIsImlzcyI6Imh0dHBzOlwvXC9sb2NhbGhvc3Q6OTQ0M1wvb2F1dGgyXC90b2tlbiIsImV4cCI6MTU0MTgwOTU4MiwiaWF0IjoxNTQxODA1OTgyLCJqdGkiOiI2Y2YyMGIwZS1lNGZmLTQzZmQtYTdiYS1kYTc3YTE3YzM2MzYifQ.Jm29jPliRvrK6Os34nSK3rhzIYLFjE__zdVGNng3uGKXGKzP3We_i6NPnhA0szJXMOKglXzUF1UgSz8MctbaxFS8XDusQPVe4LkB_45hwBm6TmBxzui911nt-1RbBLN_jZIlvl2lPrbTUH5hSn9kEkph6seWanTNQpz9tNEoVa6R_OX3kpJqxe8tLQUWw453A1JTwFNhdHa6-f1K8_Q_eEZ_4gOYINQ9t_fhTibdbkXZkJQFLop-Jwoybi9s4nwQU_dATocgcufq5eCeNItQeleT-23lGxIz0X7CiJrJynYLdd-ER0F77SumqEb5iCxhxuf4H7dovwd1kAmyKzLxpw&Version=2011-06-15
 ```
 
-#### Sample Response
+## Sample Response
 ```
 <?xml version="1.0" encoding="UTF-8"?>
 <AssumeRoleWithClientGrantsResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
@@ -72,7 +89,7 @@ http://minio.cluster:9000?Action=AssumeRoleWithClientGrants&DurationSeconds=3600
 </AssumeRoleWithClientGrantsResponse>
 ```
 
-#### Testing
+## Testing
 ```
 $ export MINIO_ACCESS_KEY=minio
 $ export MINIO_SECRET_KEY=minio123

diff --git a/docs/sts/ldap.md b/docs/sts/ldap.md
@@ -1,5 +1,26 @@
 # MinIO AD/LDAP Integration [![Slack](https://slack.min.io/slack?type=svg)](https://slack.min.io)
 
+**Table of Contents**
+
+- [Introduction](#introduction)
+- [Configuring AD/LDAP on MinIO](#configuring-adldap-on-minio)
+    - [Variable substitution in AD/LDAP configuration strings](#variable-substitution-in-adldap-configuration-strings)
+    - [Notes on configuring with Microsoft Active Directory (AD)](#notes-on-configuring-with-microsoft-active-directory-ad)
+- [Managing User/Group Access Policy](#managing-usergroup-access-policy)
+- [API Request Parameters](#api-request-parameters)
+    - [LDAPUsername](#ldapusername)
+    - [LDAPPassword](#ldappassword)
+    - [Version](#version)
+    - [Policy](#policy)
+    - [Response Elements](#response-elements)
+    - [Errors](#errors)
+- [Sample Request](#sample-request)
+- [Sample Response](#sample-response)
+- [Testing](#testing)
+
+
+## Introduction
+
 MinIO provides a custom STS API that allows integration with LDAP based corporate environments. The flow is as follows:
 
 1. User provides their AD/LDAP username and password to the STS API.
@@ -54,7 +75,7 @@ The **MINIO_IDENTITY_LDAP_USERNAME_FORMAT** environment variable supports substi
 
 The **MINIO_IDENTITY_LDAP_GROUP_SEARCH_FILTER** and **MINIO_IDENTITY_LDAP_GROUP_SEARCH_BASE_DN** environment variables support substitution of the *username* and *usernamedn* variables only.
 
-## Notes on configuring with Microsoft Active Directory (AD)
+### Notes on configuring with Microsoft Active Directory (AD)
 
 The LDAP STS API also works with Microsoft AD and can be configured as above. The following are some notes on determining the values of the configuration parameters described above.
 
@@ -92,11 +113,34 @@ MINIO_IDENTITY_LDAP_GROUP_SEARCH_FILTER='(&(objectclass=group)(member=${username
 MINIO_IDENTITY_LDAP_GROUP_NAME_ATTRIBUTE='cn'
 ```
 
-## STS API Parameters
+## Managing User/Group Access Policy
+
+Access policies may be configured on a group or on a user directly. Access policies are first defined on the MinIO server using IAM policy JSON syntax. The `mc` tool is used to issue the necessary commands.
+
+**Note that by default no policy is set on a user**. Thus even if they successfully authenticate with AD/LDAP credentials, they have no access to object storage as the default access policy is to deny all access.
+
+To define a new policy, you can use the [AWS policy generator](https://awspolicygen.s3.amazonaws.com/policygen.html). Copy the policy into a text file `mypolicy.json` and issue the command like so:
+
+```sh
+mc admin policy add myminio mypolicy mypolicy.json
+```
+
+To assign the policy to a user or group, use:
+
+```sh
+mc admin policy set myminio mypolicy user=james
+```
+
+```sh
+mc admin policy set myminio mypolicy group=bigdatausers
+```
+
+**Please note that when AD/LDAP is configured, MinIO will not support long term users defined internally.** Only AD/LDAP users are allowed. In addition to this, the server will not support operations on users or groups using `mc admin user` or `mc admin group` commands except `mc admin user info` and `mc admin group info` to list set policies for users and groups. This is because users and groups are defined externally in AD/LDAP.
+
 
-### Request Parameters
+## API Request Parameters
 
-#### LDAPUsername
+### LDAPUsername
 Is AD/LDAP username to login. Application must ask user for this value to successfully obtain rotating access credentials from AssumeRoleWithLDAPIdentity.
 
 | Params               | Value                                          |
@@ -106,7 +150,7 @@ Is AD/LDAP username to login. Application must ask user for this value to succes
 | *Required*           | *Yes*                                          |
 
 
-#### LDAPPassword
+### LDAPPassword
 Is AD/LDAP username password to login. Application must ask user for this value to successfully obtain rotating access credentials from AssumeRoleWithLDAPIdentity.
 
 | Params               | Value                                          |
@@ -115,15 +159,15 @@ Is AD/LDAP username password to login. Application must ask user for this value
 | *Length Constraints* | *Minimum length of 4. Maximum length of 2048.* |
 | *Required*           | *Yes*                                          |
 
-#### Version
+### Version
 Indicates STS API version information, the only supported value is '2011-06-15'.  This value is borrowed from AWS STS API documentation for compatibility reasons.
 
 | Params     | Value    |
 | :--        | :--      |
 | *Type*     | *String* |
 | *Required* | *Yes*    |
 
-#### Policy
+### Policy
 An IAM policy in JSON format that you want to use as an inline session policy. This parameter is optional. Passing policies to this operation returns new temporary credentials. The resulting session's permissions are the intersection of the canned policy name and the policy set here. You cannot use this policy to grant more permissions than those allowed by the canned policy name being assumed.
 
 | Params        | Value                                          |
@@ -138,12 +182,12 @@ XML response for this API is similar to [AWS STS AssumeRoleWithWebIdentity](http
 ### Errors
 XML error response for this API is similar to [AWS STS AssumeRoleWithWebIdentity](https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithWebIdentity.html#API_AssumeRoleWithWebIdentity_Errors)
 
-### Sample Request
+## Sample Request
 ```
 http://minio.cluster:9000?Action=AssumeRoleWithLDAPIdentity&LDAPUsername=foouser&LDAPPassword=foouserpassword&Version=2011-06-15
 ```
 
-### Sample Response
+## Sample Response
 ```
 <?xml version="1.0" encoding="UTF-8"?>
 <AssumeRoleWithLDAPIdentityResponse xmlns="https://sts.amazonaws.com/doc/2011-06-15/">
@@ -163,7 +207,7 @@ http://minio.cluster:9000?Action=AssumeRoleWithLDAPIdentity&LDAPUsername=foouser
 </AssumeRoleWithLDAPIdentityResponse>
 ```
 
-### Testing
+## Testing
 ```
 $ export MINIO_ACCESS_KEY=minio
 $ export MINIO_SECRET_KEY=minio123
@@ -187,26 +231,3 @@ $ go run ldap.go -u foouser -p foopassword
 }
 ```
 
-## Managing User/Group Access Policy
-
-Access policies may be configured on a group or on a user directly. Access policies are first defined on the MinIO server using IAM policy JSON syntax. The `mc` tool is used to issue the necessary commands.
-
-**Note that by default no policy is set on a user**. Thus even if they successfully authenticate with AD/LDAP credentials, they have no access to object storage as the default access policy is to deny all access.
-
-To define a new policy, you can use the [AWS policy generator](https://awspolicygen.s3.amazonaws.com/policygen.html). Copy the policy into a text file `mypolicy.json` and issue the command like so:
-
-```sh
-mc admin policy add myminio mypolicy mypolicy.json
-```
-
-To assign the policy to a user or group, use:
-
-```sh
-mc admin policy set myminio mypolicy user=james
-```
-
-```sh
-mc admin policy set myminio mypolicy group=bigdatausers
-```
-
-**Please note that when AD/LDAP is configured, MinIO will not support long term users defined internally.** Only AD/LDAP users are allowed. In addition to this, the server will not support operations on users or groups using `mc admin user` or `mc admin group` commands except `mc admin user info` and `mc admin group info` to list set policies for users and groups. This is because users and groups are defined externally in AD/LDAP.