MANTA-5485 Add support for STS and IAM #27

cneira · 2025-11-26T21:57:53Z

Added Secure Token Service (STS) and Identity and Access Management ( Roles and Policies).
This change adds a couple of new endpoints to generate temporary keys and associate Roles and Policies, temporary access keys expire and are required to use a session token to be authenticated by mahi using Sigv4.

This is what this PR implements:

STS AssumeRole: Issue temporary credentials with JWT session tokens
IAM role validation: Support for arn:aws|manta|triton:iam::UUID:role/name formats
JWT session tokens: HMAC-SHA256 signed tokens with configurable duration (15min-12hr)
Automatic secret rotation (I'm using a cron here but I think that won't work if we have than a single authcache instance.
- SigV4 authentication :

the arn:aws|manta|triton:iam::UUID:role/name was kept using the same AWS format so is easier to migrate policies between Manta S3 and AWS.

I'm doing this PR as draft as it includes components that I need to be sure that's the right approach before submitting.
This change is tied to sdc-ufds as the schema for access keys to reflect the temporary ones is done in that repo.

Co-authored-by: Claude <[email protected]>

- Add complete STS implementation with AssumeRole/GetSessionToken - Implement v1.1 JWT session tokens with secure key rotation - Add temporary credential generation and session token validation - Enhance SigV4 auth to handle STS-issued temporary credentials - Add UFDS integration for credential storage and lookup - Implement payload-based key identification for rotation support - Add multi-secret verification with configurable grace periods Generated with Claude Code Co-Authored-By: Claude <[email protected]>

danmcd

Checkpoint, continue on lib/server/server.js

danmcd · 2025-12-01T19:34:33Z

lib/replicator/transforms/accesskey.js

+        return;
+    }
+
+    var accesskeyid = changes.accesskeyid[0];


As I mentioned over in #25, do these inputs that aren't changes.status need any further sanitizing or checking apart from "exists"? Or do they get passed along to entities that sanitized or check?

From my current understanding, when access keys(or any other object) are replicated from the redis cache, UFDS will enforce the schema constraints for the object and fail to add the record if they are not valid. So we should not have inconsistent records. But, when mahi store policies, the policies are only validated when an assumerole call tries to use them.

danmcd · 2025-12-01T19:37:59Z

lib/replicator/transforms/accesskey.js

+    if (!modEntry._owner) {
+        cb(new Error('_owner is required'));
+        return;
+    }


Same questions about sanitizing or checking here.

danmcd · 2025-12-01T19:55:36Z

lib/replicator/transforms/sdcaccountrole.js

        name: name,
        account: account,
-        policies: memberpolicy
+        policies: memberpolicy,


Will this percolate through to non-S3 functions of mahi and more? If so are they ignored? Also if so, a non-S3-blessed user can't scribble things in here for nefarious purposes?

The property added for this STS work is assumerolepolicydocument. This is a new property that current UFDS clients are not using except mahi. So I think today is not a problem.

lib/server/errors.js

danmcd · 2025-12-01T21:38:08Z

Also does this impact node-mahi#10 ?

lib/server/sts.js

travispaul · 2025-12-02T17:11:27Z

Also does this impact node-mahi#10 ?

@danmcd I'm not sure about node-mahi but this will likely impact TritonDataCenter/sdc-cloudapi/pull/153, TritonDataCenter/node-triton/pull/350 and we might also need to make some changes to node-ufds since the temporary keys are using the same objectclass in ufds as the permanent keys.

Update after testing today: Will open a PR for node-ufds and update the PRs mentioned above to account for the temporary keys. Nothing is broken and nothing here will depend upon those changes but I'd like the user-facing side to be a little nicer.

lib/server/server.js

danmcd

Incremental checkpoint. Thanks for using xxd(1) of /dev/random.

lib/server/errors.js

danmcd

Ooops, premature approval, sorry.

Premature approval.

danmcd

Checkpoint, resuming with lib/server/session-token.js

danmcd · 2025-12-03T15:03:27Z

boot/rotate-session-secret.sh

@@ -0,0 +1,323 @@
+#!/bin/bash


License & copyright?

danmcd · 2025-12-03T15:04:05Z

boot/setup.sh

    svccfg import $SVC_ROOT/smf/manifests/mahi-redis.xml
    svcadm enable redis
 }



Copyright update above needed?

danmcd · 2025-12-03T15:22:55Z

lib/server/server.js

+     *
+     * @error 401 Authentication required if caller headers missing
+     *
+     * @since 1.0.0


Silly question: These @note, @param.... tags: these are generated, or input for something else?

Those are for doxygen, with those tags the doxygen parser can generate documentation. I don't know if we are using another method to document the source code. But, if there is one, I'll change the comments to accomodate the one that's in use.

It looks like a lot of Triton repos use JSDoc, but I don't think we really do anything with it, and jsdoc is only listed as a dev dependency in a few places.

What is here looks to be the same format though, or is at least close enough to compatible:

$ npm install [email protected] # Need an older version to work with node v6.17.1 $ ./node_modules/.bin/jsdoc --verbose lib/server/server.js Parsing /home/travis/mahi/lib/server/server.js ... Generating output files... Finished running in 0.59 seconds.

My only nit is that I think @since 1.0.0 should be @since 2.1.0?

Thank you! I did not know about JSDoc, seems the @brief tag is not in JSDoc, but we could use @summary instead. I'll update the code to use that one.

Add distinct access key prefixes for STS temporary credentials: - MSTS: GetSessionToken credentials (cannot call IAM APIs) - MSAR: AssumeRole credentials (can call IAM APIs)

travispaul · 2025-12-08T17:59:15Z

lib/replicator/transforms/accesskey.js

+        cb(null, batch);
+        return;
+    }
+


Should modifications to temporary access keys be permitted? If so, we may need to account for the following scenario:

User had a temporary access key:

$ triton accesskey get MSTSA88BD414A9F51D44 ACCESSKEYID STATUS CREDENTIALTYPE UPDATED MSTSA88BD414A9F51D44 Active temporary 2025-12-08T17:42:55.256Z

It is in Mahi, as expected:

[root@6d8f09c5 (authcache) ~]$ curl -is "http://localhost/accounts/930896af-bf8c-48d4-885c-6573a94b1853" | json -Ha { ... "MSTSA88BD414A9F51D44": { "secret": "tdc_GxOjeStlKuPPakJBwgAkOQSl4qIpuROyISKPmFVhvDvr4w8Q", "type": "temporary", "expiration": "2025-12-08T18:40:40.539Z", "sessionToken": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1dWlkIjoiOTMwODk2YWYtYmY4Yy00OGQ0LTg4NWMtNjU3M2E5NGIxODUzIiwicm9sZUFybiI6ImFybjphd3M6c3RzOjo5MzA4OTZhZi1iZjhjLTQ4ZDQtODg1Yy02NTczYTk0YjE4NTM6c2Vzc2lvbiIsInNlc3Npb25OYW1lIjoic2Vzc2lvbi0xNzY1MjE1NjQwNTM5IiwidG9rZW5UeXBlIjoic3RzLXNlc3Npb24iLCJ0b2tlblZlcnNpb24iOiIxLjEiLCJrZXlJZCI6ImluaXRpYWwtMjAyNTEyMDUtMTY1MDM4IiwiaXNzIjoibWFudGEtbWFoaSIsImF1ZCI6Im1hbnRhLXMzIiwiaWF0IjoxNzY1MjE1NjQwLCJleHAiOjE3NjUyMTkyNDAsIm5iZiI6MTc2NTIxNTY0MH0.HgXi8mD1BC45ykGL0bw-36gq-Xr7LaRTpHLhooDjW8k", "principalUuid": "930896af-bf8c-48d4-885c-6573a94b1853", "assumedRole": null }, ... }

User changed the status to Inactive:

$ triton accesskey update MSTSA88BD414A9F51D44 status=Inactive accesskey update MSTSA88BD414A9F51D44 status=Inactive Updated access key MSTSA88BD414A9F51D44 (fields: status)

The key gets removed from Mahi as the status is non-Active.
This seems correct and fine to me, so far.

However, if the user changes the status back to Active:

$ triton accesskey update MSTSA88BD414A9F51D44 status=Active Updated access key MSTSA88BD414A9F51D44 (fields: status)

Then it gets added back to Mahi the same way as a permanent key without the additional details that a temporary key has:

[root@6d8f09c5 (authcache) ~]$ curl -is "http://localhost/accounts/930896af-bf8c-48d4-885c-6573a94b1853" | json -Ha { ... "MSTSA88BD414A9F51D44": "tdc_GxOjeStlKuPPakJBwgAkOQSl4qIpuROyISKPmFVhvDvr4w8Q" ... }

Great catch! We definitely don't need to allow modifications to temporary access keys.

cneira and others added 24 commits July 8, 2025 22:12

MANTA-5479 Mahi should be able to accept access keys for authentication

68f3ec1

Co-authored-by: Claude <[email protected]>

Update eng submodule for copyright checking

0a71251

Update documentation

4fc9550

Fixes for cyberduck Generic S3 client profile.

99381d5

bump version

6357782

pin to jenkins node for debugging

6f7c15d

jsstyled regex

2c7c041

fix copyright

c78197c

handle empty strings

e7a2647

fixup

0393339

update submodule

7137f00

jslint

350a6c8

Remove don't needed example.

7ef97d6

update eng

859cfbe

Fix sigv4 canonical urls that use content-length

1eb289b

Use the original content-md5 header from manta-buckets-api

7b675a3

Use prefix manta-s3 for content headers, bump version, add comments

b246b48

remove node allocation for debug

77513c3

remove XXX as this is required

74ad76c

MANTA-5471 - Support accesskey status updates (#26)

7958236

fix rotation scripts path

a74a458

Add jwt token rotation to crontab

b945903

missed grace period

5a7786d

cneira requested a review from a team November 26, 2025 21:57

cneira changed the title ~~Manta 5485~~ MANTA-5485 Add support for STS and IAM Nov 26, 2025

cneira added 4 commits November 28, 2025 16:07

fix STS assume role

ecc8918

add missing error interfaces

3484a55

restrict STS operations to authcache

cf5031e

fixup json in template

85bc234

danmcd reviewed Dec 1, 2025

View reviewed changes

Use accesskey secret generation from node-ufds

a85f4e0

travispaul reviewed Dec 2, 2025

View reviewed changes

lib/server/sts.js Outdated Show resolved Hide resolved

travispaul reviewed Dec 2, 2025

View reviewed changes

lib/server/server.js Show resolved Hide resolved

cneira added 2 commits December 2, 2025 16:16

Add comments for new STS/IAM errors

d50abb8

Add docs for new sts endpoints

fb046f8

cneira requested review from danmcd and travispaul December 2, 2025 22:34

copyright update

b5f594a

cneira marked this pull request as ready for review December 3, 2025 11:38

danmcd previously approved these changes Dec 3, 2025

View reviewed changes

lib/server/errors.js Show resolved Hide resolved

danmcd reviewed Dec 3, 2025

View reviewed changes

cneira added 4 commits December 3, 2025 14:40

STS assume role caller context in body

46a4420

Added JWT rotation document and test script.

edcbd5f

jstyle fix

ae5937a

Send refresh command to mahi-server when keys are rotated

49523ce

cneira requested a review from danmcd December 4, 2025 12:35

cneira added 5 commits December 4, 2025 13:16

JWT setup and rotation only must be done in 'manta' instances

66b2185

remove STS middleware

0ba5bc2

STS/IAM endpoints return 501 on non authcache instances

6424054

jslint

0828672

Distinguish AssumeRole and GetSessionToken temporary credentials

6a1ed71

Add distinct access key prefixes for STS temporary credentials: - MSTS: GetSessionToken credentials (cannot call IAM APIs) - MSAR: AssumeRole credentials (can call IAM APIs)

travispaul reviewed Dec 8, 2025

View reviewed changes

travispaul mentioned this pull request Dec 9, 2025

TRITON-2510 Add triton accesskeys commands to manage access keys. TritonDataCenter/node-triton#350

Open

Modifying a temporary key should not be valid.

e3ea0b0

cneira requested a review from travispaul December 9, 2025 19:53

MANTA-5485 Add support for STS and IAM #27

Are you sure you want to change the base?

MANTA-5485 Add support for STS and IAM #27

Uh oh!

Conversation

cneira commented Nov 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

danmcd left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

danmcd commented Dec 1, 2025

Uh oh!

Uh oh!

travispaul commented Dec 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

danmcd left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

danmcd left a comment

Choose a reason for hiding this comment

Uh oh!

danmcd left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

cneira commented Nov 26, 2025 •

edited

Loading

travispaul commented Dec 2, 2025 •

edited

Loading