2018-10-09 23:00:01 +02:00
/ *
2019-04-09 20:39:42 +02:00
* MinIO Cloud Storage , ( C ) 2018 MinIO , Inc .
2018-10-09 23:00:01 +02:00
*
* Licensed under the Apache License , Version 2.0 ( the "License" ) ;
* you may not use this file except in compliance with the License .
* You may obtain a copy of the License at
*
* http : //www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing , software
* distributed under the License is distributed on an "AS IS" BASIS ,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND , either express or implied .
* See the License for the specific language governing permissions and
* limitations under the License .
* /
package cmd
import (
2019-09-30 23:05:19 +02:00
"context"
2018-10-09 23:00:01 +02:00
"encoding/xml"
2019-09-30 23:05:19 +02:00
"fmt"
2018-10-09 23:00:01 +02:00
"net/http"
2019-07-03 07:34:32 +02:00
xhttp "github.com/minio/minio/cmd/http"
2019-09-30 23:05:19 +02:00
"github.com/minio/minio/cmd/logger"
2018-10-09 23:00:01 +02:00
)
// writeSTSErrorRespone writes error headers
2019-09-30 23:05:19 +02:00
func writeSTSErrorResponse ( ctx context . Context , w http . ResponseWriter , errCode STSErrorCode , errCtxt error ) {
err := stsErrCodes . ToSTSErr ( errCode )
2018-10-09 23:00:01 +02:00
// Generate error response.
2019-09-30 23:05:19 +02:00
stsErrorResponse := STSErrorResponse { }
stsErrorResponse . Error . Code = err . Code
stsErrorResponse . RequestID = w . Header ( ) . Get ( xhttp . AmzRequestID )
stsErrorResponse . Error . Message = err . Description
if errCtxt != nil {
stsErrorResponse . Error . Message = fmt . Sprintf ( "%v" , errCtxt )
}
2019-10-12 03:50:54 +02:00
logKind := logger . All
switch errCode {
case ErrSTSInternalError , ErrSTSNotInitialized :
logKind = logger . Minio
default :
logKind = logger . Application
}
logger . LogIf ( ctx , errCtxt , logKind )
2018-10-09 23:00:01 +02:00
encodedErrorResponse := encodeResponse ( stsErrorResponse )
2019-02-15 02:54:33 +01:00
writeResponse ( w , err . HTTPStatusCode , encodedErrorResponse , mimeXML )
2018-10-09 23:00:01 +02:00
}
// STSError structure
type STSError struct {
Code string
Description string
HTTPStatusCode int
}
// STSErrorResponse - error response format
type STSErrorResponse struct {
XMLName xml . Name ` xml:"https://sts.amazonaws.com/doc/2011-06-15/ ErrorResponse" json:"-" `
Error struct {
Type string ` xml:"Type" `
Code string ` xml:"Code" `
Message string ` xml:"Message" `
} ` xml:"Error" `
RequestID string ` xml:"RequestId" `
}
// STSErrorCode type of error status.
type STSErrorCode int
// Error codes, non exhaustive list - http://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRoleWithSAML.html
const (
ErrSTSNone STSErrorCode = iota
2019-02-28 02:46:55 +01:00
ErrSTSAccessDenied
2018-10-09 23:00:01 +02:00
ErrSTSMissingParameter
ErrSTSInvalidParameterValue
2019-01-04 22:48:12 +01:00
ErrSTSWebIdentityExpiredToken
2018-10-09 23:00:01 +02:00
ErrSTSClientGrantsExpiredToken
ErrSTSInvalidClientGrantsToken
ErrSTSMalformedPolicyDocument
ErrSTSNotInitialized
ErrSTSInternalError
)
2019-02-15 02:54:33 +01:00
type stsErrorCodeMap map [ STSErrorCode ] STSError
func ( e stsErrorCodeMap ) ToSTSErr ( errCode STSErrorCode ) STSError {
apiErr , ok := e [ errCode ]
if ! ok {
return e [ ErrSTSInternalError ]
}
return apiErr
}
2018-10-09 23:00:01 +02:00
// error code to STSError structure, these fields carry respective
// descriptions for all the error responses.
2019-02-15 02:54:33 +01:00
var stsErrCodes = stsErrorCodeMap {
2019-02-28 02:46:55 +01:00
ErrSTSAccessDenied : {
Code : "AccessDenied" ,
Description : "Generating temporary credentials not allowed for this request." ,
HTTPStatusCode : http . StatusForbidden ,
} ,
2018-10-09 23:00:01 +02:00
ErrSTSMissingParameter : {
Code : "MissingParameter" ,
Description : "A required parameter for the specified action is not supplied." ,
HTTPStatusCode : http . StatusBadRequest ,
} ,
ErrSTSInvalidParameterValue : {
Code : "InvalidParameterValue" ,
Description : "An invalid or out-of-range value was supplied for the input parameter." ,
HTTPStatusCode : http . StatusBadRequest ,
} ,
2019-01-04 22:48:12 +01:00
ErrSTSWebIdentityExpiredToken : {
Code : "ExpiredToken" ,
Description : "The web identity token that was passed is expired or is not valid. Get a new identity token from the identity provider and then retry the request." ,
HTTPStatusCode : http . StatusBadRequest ,
} ,
2018-10-09 23:00:01 +02:00
ErrSTSClientGrantsExpiredToken : {
Code : "ExpiredToken" ,
2019-01-04 22:48:12 +01:00
Description : "The client grants that was passed is expired or is not valid. Get a new client grants token from the identity provider and then retry the request." ,
2018-10-09 23:00:01 +02:00
HTTPStatusCode : http . StatusBadRequest ,
} ,
ErrSTSInvalidClientGrantsToken : {
Code : "InvalidClientGrantsToken" ,
2019-04-09 20:39:42 +02:00
Description : "The client grants token that was passed could not be validated by MinIO." ,
2018-10-09 23:00:01 +02:00
HTTPStatusCode : http . StatusBadRequest ,
} ,
ErrSTSMalformedPolicyDocument : {
Code : "MalformedPolicyDocument" ,
Description : "The request was rejected because the policy document was malformed." ,
HTTPStatusCode : http . StatusBadRequest ,
} ,
ErrSTSNotInitialized : {
Code : "STSNotInitialized" ,
Description : "STS API not initialized, please try again." ,
HTTPStatusCode : http . StatusServiceUnavailable ,
} ,
ErrSTSInternalError : {
Code : "InternalError" ,
Description : "We encountered an internal error generating credentials, please try again." ,
HTTPStatusCode : http . StatusInternalServerError ,
} ,
}