|
1
|
package oss
|
1
|
package oss
|
|
2
|
|
2
|
|
|
3
|
import (
|
3
|
import (
|
|
4
|
- "crypto/hmac"
|
|
|
|
5
|
- "crypto/sha1"
|
|
|
|
6
|
- "crypto/tls"
|
|
|
|
7
|
- "encoding/base64"
|
|
|
|
8
|
- "io/ioutil"
|
|
|
|
9
|
- "net/http"
|
|
|
|
10
|
- "net/url"
|
|
|
|
11
|
- "time"
|
4
|
+ "github.com/aliyun/aliyun-sts-go-sdk/sts"
|
|
12
|
)
|
5
|
)
|
|
13
|
|
6
|
|
|
14
|
-type AliyunStsClient struct {
|
|
|
|
15
|
- ChildAccountKeyId string
|
|
|
|
16
|
- ChildAccountSecret string
|
|
|
|
17
|
- RoleAcs string
|
7
|
+type StsCredentials struct {
|
|
|
|
8
|
+ AccessKeyId string `json:"access_key_id"`
|
|
|
|
9
|
+ AccessKeySecret string `json:"access_key_secret"`
|
|
|
|
10
|
+ Expiration int64 `json:"expiration"`
|
|
|
|
11
|
+ SecurityToken string `json:"security_token"`
|
|
18
|
}
|
12
|
}
|
|
19
|
|
13
|
|
|
20
|
-func NewStsClient(key, secret, roleAcs string) *AliyunStsClient {
|
|
|
|
21
|
- return &AliyunStsClient{
|
|
|
|
22
|
- ChildAccountKeyId: key,
|
|
|
|
23
|
- ChildAccountSecret: secret,
|
|
|
|
24
|
- RoleAcs: roleAcs,
|
|
|
|
25
|
- }
|
14
|
+type AssumedRoleUser struct {
|
|
|
|
15
|
+ AssumedRoleId string `json:"assumed_role_id"`
|
|
|
|
16
|
+ Arn string `json:"arn"`
|
|
26
|
}
|
17
|
}
|
|
27
|
|
18
|
|
|
28
|
-func (cli *AliyunStsClient) GenerateSignatureUrl(sessionName, durationSeconds string) (string, error) {
|
|
|
|
29
|
- assumeUrl := "SignatureVersion=1.0"
|
|
|
|
30
|
- assumeUrl += "&Format=JSON"
|
|
|
|
31
|
- assumeUrl += "&Timestamp=" + url.QueryEscape(time.Now().UTC().Format("2006-01-02T15:04:05Z"))
|
|
|
|
32
|
- assumeUrl += "&RoleArn=" + url.QueryEscape(cli.RoleAcs)
|
|
|
|
33
|
- assumeUrl += "&RoleSessionName=" + sessionName
|
|
|
|
34
|
- assumeUrl += "&AccessKeyId=" + cli.ChildAccountKeyId
|
|
|
|
35
|
- assumeUrl += "&SignatureMethod=HMAC-SHA1"
|
|
|
|
36
|
- assumeUrl += "&Version=2015-04-01"
|
|
|
|
37
|
- assumeUrl += "&Action=AssumeRole"
|
|
|
|
38
|
- assumeUrl += "&SignatureNonce=" + "TODO"
|
|
|
|
39
|
- assumeUrl += "&DurationSeconds=" + durationSeconds
|
|
|
|
40
|
-
|
|
|
|
41
|
- // 解析成V type
|
|
|
|
42
|
- signToString, err := url.ParseQuery(assumeUrl)
|
|
|
|
43
|
- if err != nil {
|
|
|
|
44
|
- return "", err
|
|
|
|
45
|
- }
|
|
|
|
46
|
-
|
|
|
|
47
|
- // URL顺序化
|
|
|
|
48
|
- result := signToString.Encode()
|
|
|
|
49
|
-
|
|
|
|
50
|
- // 拼接
|
|
|
|
51
|
- StringToSign := "GET" + "&" + "%2F" + "&" + url.QueryEscape(result)
|
|
|
|
52
|
-
|
|
|
|
53
|
- // HMAC
|
|
|
|
54
|
- hashSign := hmac.New(sha1.New, []byte(cli.ChildAccountSecret+"&"))
|
|
|
|
55
|
- hashSign.Write([]byte(StringToSign))
|
|
|
|
56
|
-
|
|
|
|
57
|
- // 生成signature
|
|
|
|
58
|
- signature := base64.StdEncoding.EncodeToString(hashSign.Sum(nil))
|
|
|
|
59
|
-
|
|
|
|
60
|
- // Url 添加signature
|
|
|
|
61
|
- assumeUrl = "https://sts.aliyuncs.com/?" + assumeUrl + "&Signature=" + url.QueryEscape(signature)
|
|
|
|
62
|
-
|
|
|
|
63
|
- return assumeUrl, nil
|
19
|
+type StsData struct {
|
|
|
|
20
|
+ RequestId string `json:"request_id,omitempty"`
|
|
|
|
21
|
+ AssumedRoleUser AssumedRoleUser `json:"assumed_role_user,omitempty"`
|
|
|
|
22
|
+ Credentials StsCredentials `json:"credentials,omitempty"`
|
|
64
|
}
|
23
|
}
|
|
65
|
|
24
|
|
|
66
|
-// 请求构造好的URL,获得授权信息
|
|
|
|
67
|
-// 安全认证 HTTPS
|
|
|
|
68
|
-func (cli *AliyunStsClient) GetStsResponse(url string) ([]byte, error) {
|
|
|
|
69
|
- tr := &http.Transport{
|
|
|
|
70
|
- TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
|
|
|
|
71
|
- }
|
|
|
|
72
|
- client := &http.Client{Transport: tr}
|
|
|
|
73
|
-
|
|
|
|
74
|
- resp, err := client.Get(url)
|
25
|
+func GetStsCredentials() (*StsData, error) {
|
|
|
|
26
|
+ ossconfig := NewOssConfig()
|
|
|
|
27
|
+ stsClient := sts.NewClient(ossconfig.accessID, ossconfig.accessKey, ossconfig.roleAcs, ossconfig.sessionName)
|
|
|
|
28
|
+ resp, err := stsClient.AssumeRole(3600)
|
|
75
|
if err != nil {
|
29
|
if err != nil {
|
|
76
|
return nil, err
|
30
|
return nil, err
|
|
77
|
}
|
31
|
}
|
|
78
|
- defer resp.Body.Close()
|
|
|
|
79
|
-
|
|
|
|
80
|
- body, err := ioutil.ReadAll(resp.Body)
|
|
|
|
81
|
-
|
|
|
|
82
|
- return body, err
|
32
|
+ c := StsCredentials{
|
|
|
|
33
|
+ AccessKeyId: resp.Credentials.AccessKeyId,
|
|
|
|
34
|
+ AccessKeySecret: resp.Credentials.AccessKeySecret,
|
|
|
|
35
|
+ Expiration: resp.Credentials.Expiration.Unix(),
|
|
|
|
36
|
+ SecurityToken: resp.Credentials.SecurityToken,
|
|
|
|
37
|
+ }
|
|
|
|
38
|
+ ar := AssumedRoleUser{
|
|
|
|
39
|
+ AssumedRoleId: resp.AssumedRoleUser.AssumedRoleId,
|
|
|
|
40
|
+ Arn: resp.AssumedRoleUser.Arn,
|
|
|
|
41
|
+ }
|
|
|
|
42
|
+ return &StsData{
|
|
|
|
43
|
+ RequestId: resp.RequestId,
|
|
|
|
44
|
+ Credentials: c,
|
|
|
|
45
|
+ AssumedRoleUser: ar,
|
|
|
|
46
|
+ }, nil
|
|
83
|
} |
47
|
} |
