Queries a Security Token Service (STS) token to assume a Resource Access Management (RAM) role during role-based single sign-on (SSO) by using OpenID Connect (OIDC).
Operation description
Prerequisites
- An OIDC token is obtained from an external identity provider (IdP).
- An OIDC IdP is created in the RAM console. For more information, see Create an OIDC IdP or CreateOIDCProvider .
- A RAM role whose trusted entity is an OIDC IdP is created in the RAM console. For more information, see Create a RAM role for a trusted IdP or CreateRole .
Debugging
Authorization information
Request parameters
| Parameter | Type | Required | Description | Example |
|---|---|---|---|---|
| OIDCProviderArn | string | Yes | The Alibaba Cloud Resource Name (ARN) of the OIDC IdP. You can view the ARN in the RAM console or by calling operations.
| acs:ram::113511544585****:oidc-provider/TestOidcIdp |
| RoleArn | string | Yes | The ARN of the RAM role. You can view the ARN in the RAM console or by calling operations.
| acs:ram::113511544585****:role/testoidc |
| OIDCToken | string | Yes | The OIDC token that is issued by the external IdP. The OIDC token must be 4 to 20,000 characters in length. Note
You must enter the original OIDC token. You do not need to enter the Base64-encoded OIDC token.
| eyJraWQiOiJKQzl3eHpyaHFKMGd0**** |
| Policy | string | No | The policy that specifies the permissions of the returned STS token. You can use this parameter to grant the STS token fewer permissions than the permissions granted to the RAM role.
The value must be 1 to 2,048 characters in length. | {"Statement": [{"Action": ["*"],"Effect": "Allow","Resource": ["*"]}],"Version":"1"} |
| DurationSeconds | long | No | The validity period of the STS token. Unit: seconds. Default value: 3600. Minimum value: 900. Maximum value: the value of the For more information about how to specify | 3600 |
| RoleSessionName | string | Yes | The custom name of the role session. Set this parameter based on your business requirements. In most cases, this parameter is set to the identity of the user who calls the operation, for example, the username. In ActionTrail logs, you can distinguish the users who assume the same RAM role to perform operations based on the value of the RoleSessionName parameter. This way, you can perform user-specific auditing. The value can contain letters, digits, periods (.), at signs (@), hyphens (-), and underscores (_). The value must be 2 to 64 characters in length. | TestOidcAssumedRoleSession |
Signature, SignatureMethod, SignatureVersion, and AccessKeyId. For more information about common request parameters, see Common request parameters.
Response parameters
Examples
Sample success responses
JSONformat
{
"RequestId": "3D57EAD2-8723-1F26-B69C-F8707D8B565D",
"OIDCTokenInfo": {
"Subject": "KryrkIdjylZb7agUgCEf****",
"Issuer": "https://dev-xxxxxx.okta.com",
"ClientIds": "496271242565057****",
"ExpirationTime": "2021-10-20T04:27:09Z",
"IssuanceTime": "2021-10-20T03:27:09Z",
"VerificationInfo": "Success"
},
"AssumedRoleUser": {
"AssumedRoleId": "33157794895460****",
"Arn": "acs:ram::113511544585****:role/testoidc/TestOidcAssumedRoleSession"
},
"Credentials": {
"SecurityToken": "CAIShwJ1q6Ft5B2yfSjIr5bSEsj4g7BihPWGWHz****",
"Expiration": "2021-10-20T04:27:09Z",
"AccessKeySecret": "CVwjCkNzTMupZ8NbTCxCBRq3K16jtcWFTJAyBEv2****",
"AccessKeyId": "STS.NUgYrLnoC37mZZCNnAbez****"
}
}Error codes
For a list of error codes, visit the Service error codes.
Change history
| Change time | Summary of changes | Operation |
|---|---|---|
| 2024-04-11 | The internal configuration of the API is changed, but the call is not affected | View Change Details |
| 2023-09-27 | The response structure of the API has changed | View Change Details |