Example of alternative auth methods

[benjamin-bergia]

Is there any doc or example of the "Providing an authentication gateway using an alternative authentication system to S3" feature?

I have a s3 compatible endpoint with a keypair to access it. I would like to run nginx-s3-gateway in front of it to be able to generate additional keypairs and restrict access for specific keys to specific buckets. Is there any way to pass a list of keypairs to nginx and let it handle the authentication?

[dekobon]

Hi Benjamin,

Is the idea that these would be the same type of keypairs that are already used by S3 and that you would use AWS signatures to validate, but in this case it would be different keypairs from what is used on the backend S3 service?

[benjamin-bergia]

Yes, currently my provider gave me a keypair to access to the S3 services but I can't easily generate additional ones on demand. I would like to use this gateway as a way to authenticate users with keypairs that I generate myself without having to share the keypair from my provider. On top of that I would like to control which bucket can be access with which specific keypair. Does it sound like something that can be done or is it out of the scope of the gateway?

[dekobon]

Hi @rmcsqrd , the NGINX S3 Gateway is really nothing more than a collection of configuration and njs scripts that show how to configure NGINX for the S3 gateway use case. Adding in additional signature based authentication is beyond the scope of the project, but it is something that can totally be done in njs.

In fact much of the code is already there to do it. All you are doing on the server-side is generating a http signature with the same parameters that the client generated theirs, and then checking to see if they match. There is an example of doing it in Javascript here.

Alternatively, if you didn't need S3 style signature based authentication, you could use TLS certificate based authentication, HTTP Basic authentication, or even OpenID Connect as well.

[cravi-aws20]

This is working only while passing "S3_Access_Key" & "S3_Secret_Key". But is there any possibilities to avoid these inputs and do it through IAM-Role based authentication in Native Kubernetes Cluster(non EKS).

We are passing the IAM role with STS permissions here, and we are able to get the S3 Buckets inside of the Kubernetes POD by passing the command(aws s3 ls <> and here we installed aws-cli on the image) but with this we couldn't get the same on URL endpoint. Because the scripts are using the "S3_Access_Key" & "S3_Secret_Key".

So is there any possibilities with this above?