Suport to login using temporary credentials from Security Token Service (STS API) using OpenID Connect web identity

[EternalDeiwos]

I considered writing this on #13377 or #13381, however these are mostly related to AWS specifically which isn't quite what I am looking for. I am currently using Wasabi for S3 and looking for a way to authenticate users from an IdP (SSO).

Wasabi supports AssumeRole, however to use that directly I would need to create users on Wasabi and manage their privileges there; and I would rather manage user accounts and their privileges from our IdP.

My goals are:

1. Avoid users having to use anything other than Cyberduck. Users should be able to install a profile and be prompted to login.
2. Configuring privileges (roles) is handled outside of Cyberduck.
3. Should be compatible with anything that returns credentials in a valid format, e.g. AssumeRoleWithWebIdentityResponse or AssumeRoleResponse

I would like to do something like the following:

1. Cyberduck opens a browser window to a configurable URL (as it does for Dropbox/GDrive).
2. User authenticates in the browser window to an external service.
3. External service uses Wasabi's STS to create appropriately privileged temporary credentials.
4. Callback to Cyberduck with ??? (see below)

I am not entirely sure how the callback to Wasabi could be done or what is feasible. The Cyberduck would obviously need the credentials, and some way to refresh the credentials when they are about to expire, like a session token or cookie.

While AWS' S3 SDK is very general and allows access to any compliant service, their authentication, particularly related to SSO seems to be very locked to their IdP. Additionally, using an external configuration file (e.g. ~/.aws/credentials) is not user friendly.

I've read through the documentation and not found anything helpful, and neither are other issues on the topic such as this one: #11133

[dkocher]

Related documentation from Minio.

OpenID Connect Access Management

[dkocher]

Wasabi Documentation ¹

Footnotes

1. https://docs.wasabi.com/docs/iam-and-sts-support?highlight=assumerole ↩

[dkocher]

The feature is now available in the latest snapshot build. You are welcome to give it a try with your setup. We have tested the combinations available as connection profiles in ¹:

• AWS S3+STS & Google OpenID Connect
• AWS S3/STS & Azure Active Directory (Azure AD)

The setup steps required in AWS are outlined in ². Feedback is much appreciated.

Footnotes

1. Sample connection profiles for S3 and OpenID Connect Federation profiles#58 ↩

2. Sample connection profiles for S3 and OpenID Connect Federation profiles#55 ↩