Add new API endpoint to revoke STS tokens #21072
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
There was a problem hiding this comment.
Pull Request Overview
This pull request adds a new API endpoint to revoke STS tokens by user, either by token type or via full revoke.
- Introduces RevokeTokens functionality in the IAM system and associated store.
- Updates STS endpoint handlers to include an optional tokenRevokeType in the token claims.
- Adds a new admin route and corresponding tests to validate token revocation behavior.
Reviewed Changes
Copilot reviewed 8 out of 9 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| cmd/user-provider-utils.go | Provides helper function for resolving the internal username based on provider. |
| cmd/sts-handlers_test.go | Adds tests to cover various token revocation scenarios. |
| cmd/sts-handlers.go | Updates STS endpoint handlers to include tokenRevokeType extraction and claim assignment. |
| cmd/iam.go | Exposes a RevokeTokens function in the IAMSys interface. |
| cmd/iam-store.go | Implements the revocation logic for temporary credentials based on token type. |
| cmd/admin-router.go | Adds a new admin route for token revocation based on user provider. |
| cmd/admin-handlers-users.go | Implements the admin handler for token revocation with validation and error responses. |
Files not reviewed (1)
- go.mod: Language not supported
Comments suppressed due to low confidence (2)
cmd/admin-handlers-users.go:2057
- [nitpick] Consider providing a more specific and descriptive error message for token revocation failures instead of using the generic ErrInvalidRequest.
writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrInvalidRequest), r.URL) // TODO: copy error code over
cmd/iam-store.go:2061
- Evaluate whether returning an error upon failing to extract claims from a token is the desired behavior; if one malformed token should not block revocation of valid tokens, consider handling the error more gracefully.
if v, _ := claims.Lookup(tokenRevokeTypeClaim); v != tokenRevokeType {
harshavardhana
approved these changes
Mar 31, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Community Contribution License
All community contributions in this pull request are licensed to the project maintainers
under the terms of the Apache 2 license.
By creating this pull request I represent that I have the right to license the
contributions to the project maintainers under the Apache 2 license.
Description
Adds the ability to revoke STS tokens by user. There are two options for this, either all STS tokens for a user can be revoked (full revoke) or by tokenRevokeType. This tokenRevokeType is an attribute that can be added to an STS token at creation when calling AssumeRole, then if RevokeTokens is called on the parent user with that tokenRevokeType, only those matching tokens will be revoked.
Adds new RevokeTokens function with endpoints at revoke-tokens/internal and revoke-tokens/ldap. These APIs can be used to revoke tokens for users matching their provider, and the internal API also allows for any kind of user to "self-revoke" when the user value is left blank.
Backport from miniohq/eos#498
Motivation and Context
How to test this PR?
Create STS tokens with/without revoke types using minio-go, revoke using minio/mc#5160
Types of changes
Checklist:
commit-idorPR #here)