Principle Chapter III - STS Temporary Authentication
Principle Chapter III: STS temporary authentication
The bce-bos-uploader supports STS (Security Token Service) temporary authorization. The server generates a temporary set of AK/SK with specific permissions and validity. These temporary AK/SK credentials can be safely provided to the browser for direct use. Users only need to set the server-returned AK/SK and SessionToken in the bos-ak, bos-sk, and uptoken parameters of the bce-bos-uploader.
For an introduction to STS, please refer to [Temporary Authorization Access](BOS/API Reference/Access control.md#Temporary authorized access). Usage process:
- Configure Nodejs implementation of the application server side
- Obtaining temporary AK/SK/SessionToken
- Initialize bce-bos-uploader parameters
Nodejs implementation of the application server side
1 var http = require('http');
2 var url = require('url');
3 var util = require('util');
4 var STS = require('@baiducloud/sdk').STS;
5 var kCredentials = {
6 ak: 'Your AK'
7 sk: 'Your SK'
8 };
9 function buildStsResponse() {
10 var stsClient = new STS({
11 credentials: kCredentials,
12 region: 'bj'
13 });
14 return stsClient.getSessionToken(60 * 60 * 24, {
15 accessControlList: [{
16 service: 'bce:bos',
17 resource: ['bce-javascript-sdk-demo-test'],
18 region: '*',
19 effect: 'Allow',
20 permission: ['READ', 'WRITE']
21 }]
22 }).then(function (response) {
23 var body = response.body;
24 return {
25 AccessKeyId: body.accessKeyId,
26 SecretAccessKey: body.secretAccessKey,
27 SessionToken: body.sessionToken,
28 Expiration: body.expiration
29 };
30 });
31 }
32 http.createServer(function (req, res) {
33 console.log(req.url);
34 var query = url.parse(req.url, true).query;
35 var promise = null;
36 if (query.sts) {
37 promise = buildStsResponse();
38 }
39 promise.then(function (payload) {
40 res.writeHead(200, {
41 'Content-Type': 'text/javascript; charset=utf-8',
42 'Access-Control-Allow-Origin': '*'
43 });
44 if (query.callback) {
45 res.end(util.format('%s(%s)', query.callback, JSON.stringify(payload)));
46 }
47 else {
48 res.end(JSON.stringify(payload));
49 }
50 });
51 }).listen(1337);
52 console.log('Server running at http://0.0.0.0:1337/');On the server side, create a stsClient instance in a similar way to creating a bosClient instance. For the stsClient instance, there is mainly one method, which is getSessionToken. This method accepts two parameters. The first parameter is the validity period of the temporary authorization, in seconds; the second parameter is the specific permission control, see [STS Service Interface](BOS/API Reference/Access control.md#STS service APIs).
This method asynchronously connects to the STS authorization server and returns a promise object. The STS authorization server will provide data similar to the following:
1 {
2 body: {
3 "accessKeyId": "d87a16e5ce1d47c1917b38ed03fbb329",
4 "secretAccessKey": "e9b6f59ce06c45cdaaea2296111dab46",
5 "sessionToken": "MjUzZjQzNTY4OTE0NDRkNjg3N2E4YzJhZTc4YmU5ZDh8AAAAABwCAAB/HfHDVV2bu5xUf6rApt2YdSLG6+21UTC62EHvIuiaamtuMQQKNkR9PU2NJGVbuWgBn8Ot0atk0HnWYQGgwgyew24HtbrX3GFiR/cDymCowm0TI6OGq7k8pGuBiCczT8qZcarH7VdZBd1lkpYaXbtP7wQJqiochDXrswrCd+J/I2CeSQT6mJiMmvupUV06R89dWBL/Vcu7JQpdYBk0d5cp2B+gdaHddBobevlBmKQw50/oOykJIuho4Wn7FgOGPMPdod0Pf0s7lW/HgSnPOjZCgRl0pihs197rP3GWpnlJRyfdCY0g0GFG6T0/FsqDbxbi8lWzF1QRTmJzzh2Tax8xoPFKGMbpntp//vGP7oPYK1JoES34TjcdcZnLzIRnVIGaZAzmZMUhPEXE5RVX1w8jPEXMJJHSrFs3lJe13o9Dwg==",
6 "createTime": "2016-02-16T14:01:29Z",
7 "expiration": "2016-02-16T15:41:29Z",
8 "userId": "5e433c4a8fe74765a7ec6fc147e25c80"
9 }
10 }The server must deliver the accessKeyId, secretAccessKey, and sessionToken fields to the browser.
Browser front-end implementation
When using the STS temporary authorization system on the frontend, simply introduce the accessKeyId, secretAccessKey, and sessionToken parameters when initializing each service. For example, in the case of BOS:
1 var bosConfig = {
2 credentials: {
3 ak: '{accessKeyId}', // Temporary AK issued by the STS server
4 sk: '{secretAccessKey}' // Temporary SK issued by the STS server
5 },
6 sessionToken: '{sessionToken}', // sessionToken issued by the STS server
7 endpoint: 'http://bj.bcebos.com'
8 };
9 var client = new baidubce.sdk.BosClient(bosConfig);