Method getFederationTokenHandler

objectnode/sts_handler.go:29–114

https://docs.aws.amazon.com/zh_cn/STS/latest/APIReference/API_GetFederationToken.html

(w http.ResponseWriter, r *http.Request)

// https://docs.aws.amazon.com/zh_cn/STS/latest/APIReference/API_GetFederationToken.html
func (o *ObjectNode) getFederationTokenHandler(w http.ResponseWriter, r *http.Request) {
	var (
		err error
		erc *ErrorCode
	)
	defer func() {
		o.errorResponse(w, r, err, erc)
	}()
	// request param check
	if token := r.Header.Get(XAmzSecurityToken); token != "" {
		erc = AccessDeniedBySTS
		return
	}
	if action := r.PostFormValue(stsActionKey); action != stsActionValue {
		log.LogErrorf("getFederationTokenHandler: sts action invalid: requestID(%v) action(%v)",
			GetRequestID(r), action)
		erc = InvalidArgument
		return
	}
	name := r.PostFormValue(stsNameKey)
	matched, _ := regexp.MatchString(`^[\w+=,.@-]*$`, name)
	if len(name) < 2 || len(name) > 32 || !matched {
		log.LogErrorf("getFederationTokenHandler: sts name invalid: requestID(%v) name(%v) err(%v)",
			GetRequestID(r), name, err)
		erc = InvalidArgument
		return
	}
	policy := r.PostFormValue(stsPolicyKey)
	if _, err = ParsePolicyV2Config(policy); err != nil {
		log.LogErrorf("getFederationTokenHandler: sts policy invalid: requestID(%v) policy(%v) err(%v)",
			GetRequestID(r), policy, err)
		erc = &ErrorCode{
			ErrorCode:    "MalformedPolicyDocument",
			ErrorMessage: fmt.Sprintf("The policy document was malformed: %v.", err.Error()),
			StatusCode:   http.StatusBadRequest,
		}
		return
	}
	seconds := r.PostFormValue(stsDurationSecondsKey)
	durationSeconds, _ := strconv.ParseInt(seconds, 10, 64)
	if durationSeconds < 900 || durationSeconds > 129600 {
		durationSeconds = 43200
	}
	param := ParseRequestParam(r)
	user, err := o.getUserInfoByAccessKeyV2(param.AccessKey())
	if err != nil {
		log.LogErrorf("getFederationTokenHandler: get user info fail: requestID(%v) accessKey(%v) err(%v)",
			GetRequestID(r), param.AccessKey(), err)
		return
	}
	// federated ak/sk generation
	now := time.Now().UTC()
	expireUnixStr := fmt.Sprint(now.Unix() + durationSeconds)
	fedAk := stsAkPrefix + util.RandomString(13, util.Numeric|util.LowerLetter|util.UpperLetter)
	fedSk := util.RandomString(32, util.Numeric|util.LowerLetter|util.UpperLetter)
	sessionToken, err := EncodeFedSessionToken(user.AccessKey, user.SecretKey, fedAk, fedSk, name, policy, expireUnixStr)
	if err != nil {
		log.LogErrorf("getFederationTokenHandler: encode session token fail: requestID(%v) err(%v)",