Configure StsWebIdentityCredentialsProvider without roleArn for OIDC

[Zey-Uzh]

I am using JSON Web Token Claim from https://min.io/docs/minio/linux/administration/identity-access-management/oidc-access-management.html#json-web-token-claim
There is no roleArn here, only JWT-token from OIDC.
I am trying to use StsWebIdentityCredentialsProvider to get credentials. But StsWebIdentityCredentialsProvider requires AssumeRoleWithWebIdentityParameters, where roleArn is mandatory.
Previously I used aws.sdk.kotlin.s3 version 0.19.0-beta and there roleArn could be omitted. Everything worked well.
How can I work with JSON Web Token Claim in latest version 1.4.63? I have studied the documentation, but did not find it.

[ianbotsf]

Hi @Zey-Uzh, as a caveat: StsWebIdentityCredentialsProvider is built specifically to call AWS Security Token Service and is not necessarily compatible with other implementations like MinIO.

That said, I can suggest a couple possibilities:

• I'm not an expert in MinIO but maybe you could attempt to set the roleArn to a blank or dummy value like ""?
• If you don't need a CredentialsProvider instance but just the credentials then you could use the low-level STS client to make the call. You can omit roleArn since its presence isn't enforced in the low-level API call:

  val stsClient = StsClient.fromEnvironment { ... }
  val response = stsClient .assumeRoleWithWebIdentity {
      webIdentityToken = ...
      roleSessionName = ...
  }
  val roleCredentials = requireNotNull(response.credentials)

• If you do need a CredentialsProvider instance then you can still make a low-level STS call and wrap it in your own credentials provider implementation:

  class MinioWebIdentityCredentialsProvider(
      private val webIdentityTokenFilePath: String,
      private val roleSessionName: String,
  ) : CloseableCredentialsProvider {
      val stsClient = StsClient.fromEnvironment { ... }
  
      override suspend fun resolve(attributes: Attributes): Credentials {
          val response = stsClient.assumeRoleWithWebIdentity {
              webIdentityToken = File(webIdentityTokenFilePath).readBytes()
              roleSessionName = this@MinioWebIdentityCredentialsProvider.roleSessionName 
          }
  
          val roleCredentials = requireNotNull(response.credentials)
  
          return Credentials(
              accessKeyId = roleCredentials.accessKeyId,
              secretAccessKey = roleCredentials.secretAccessKey,
              sessionToken = roleCredentials.sessionToken,
              expiration = roleCredentials.expiration,
          )
      }
  
      override fun close() {
          stsClient.close()
      }
  }

Do any of these suggestions work for you?

[Zey-Uzh]

Unfortunately, blank field didn't work, I've already tried that.

aws.sdk.kotlin.runtime.auth.credentials.internal.sts.model.StsException: 2 validation errors detected: Value '' at 'roleArn' failed to satisfy constraint: Member must have length greater than or equal to 20; Value '' at 'roleArn' failed to satisfy constraint: Member must satisfy regular expression pattern: [\u0009\u000A\u000D\u0020-\u007E\u0085\u00A0-\uD7FF\uE000-\uFFFD\u10000-\u10FFFF]+

And i can't use StsClient in my project because it's internal in package aws.sdk.kotlin.runtime.auth.credentials.internal.sts.

[ianbotsf]

I apologize, I should've been more clear. You're correct that the StsClient in aws.sdk.kotlin.runtime.auth.credentials.internal.sts is internal and only meant for use in the STS credentials providers. I meant to point you to the StsClient in aws.sdk.kotlin.services.sts, available in the aws.sdk.kotlin:sts module, which is public.

[Zey-Uzh]

Thanks for the answer! You helped me a lot!
This is probably the best option.

Your previous answer made me think that I just need to get Credentials by any means. I did it in my project with a request to the storage:

class MinioCredentialsProvider(
    private val tokenProvider: TokenProvider,
    private val okHttpClientBuilder: OkHttpClient.Builder,
    private val credentialsEndpoint: String
) : CredentialsProvider {
    override suspend fun resolve(attributes: Attributes): Credentials {
        val token = tokenProvider.provide()
        return exchangeTokenViaStorageEndpoint(
            token,
            credentialsEndpoint,
            okHttpClientBuilder
                .build()
        )
    }

    private fun exchangeTokenViaStorageEndpoint(
        jwtToken: String,
        credentialsEndpoint: String,
        httpClient: OkHttpClient
    ): Credentials {
        val formBody: RequestBody = FormBody.Builder()
            .add("Action", "AssumeRoleWithWebIdentity")
            .add("Version", "2011-06-15")
            .add("WebIdentityToken", jwtToken)
            .build()

        val request: Request = Request.Builder()
            .url(credentialsEndpoint)
            .post(formBody)
            .addHeader("Content-Type", "application/x-www-form-urlencoded")
            .build()

        val response = httpClient.newCall(request).execute()
        if (!response.isSuccessful) {
            throw MinioCredentialsException(
                "Failed to exchange JWT. Status: ${response.code}, Body: ${response.body?.string()}"
            )
        } else {
            val responseBody = response.body?.string()
            if (responseBody == null) {
                throw MinioCredentialsException("Empty response body")
            } else {
                return parseXmlResponse(responseBody)
            }
        }
    }

    private fun parseXmlResponse(xmlData: String): Credentials {
        // parse
    }
}

class MinioCredentialsException(message: String, cause: Throwable? = null) :
    Exception(message, cause)

However, your answer sounds more correct.