2026-01-22 zwy minio临时凭证改为http申请

zhaowenyu

2026-01-22 f49cf7738d6368ebdde2472c9f554fd1a28c772d

2026-01-22 zwy minio临时凭证改为http申请

 ard-admin/src/main/resources/application-daqing.yml

@@ -87,5 +87,12 @@

# 机场单独用的oss配置，要http地址
dock:
  enable: true
  provider: minio
  endpoint: http://192.168.10.103:9011
  bucket: dock
  access-key: admin
  secret-key: ard12345
  bucket: dock
  expire: 3600
  region: us-east-1
  object-dir-prefix: wayline

 ard-admin/src/main/resources/application-prod.yml

@@ -85,5 +85,12 @@
  object-dir-prefix: wayline

dock:
  enable: true
  provider: minio
  endpoint: http://111.40.46.199:9011
  access-key: admin
  secret-key: ard12345
  bucket: dock
  expire: 3600
  region: us-east-1
  object-dir-prefix: wayline

 ard-sample/src/main/java/com/ard/sample/config/DockConfiguration.java

@@ -1,20 +1,113 @@
package com.ard.sample.config;

import com.ard.oss.model.enums.OssTypeEnum;
import io.minio.MinioClient;
import org.springframework.boot.context.properties.ConfigurationProperties;
import org.springframework.context.annotation.Bean;
import org.springframework.stereotype.Component;

@Component
@ConfigurationProperties(prefix = "dock")
public class DockConfiguration {
//    public static String endpoint;
//
//    public static String bucket;
//
//    public void setEndpoint(String endpoint) {
//        DockConfiguration.endpoint = endpoint;
//    }
//
//    public void setBucket(String bucket) {
//        DockConfiguration.bucket = bucket;
//    }
    /**
     * @see OssTypeEnum
     */
    public static String provider;

    /**
     * Whether to use the object storage service.
     */
    public static boolean enable;

    /**
     * The protocol needs to be included at the beginning of the address.
     */
    public static String endpoint;

    public static String accessKey;

    public static String secretKey;

    public static String region;

    public static Long expire;

    public static String roleSessionName;

    public static String roleArn;

    public static String bucket;

    public void setEndpoint(String endpoint) {
        DockConfiguration.endpoint = endpoint;
    public static String objectDirPrefix;

    public void setProvider(String provider) {
        DockConfiguration.provider = provider;
    }

    public void setEnable(boolean enable) {
        DockConfiguration.enable = enable;
    }

    public void setEndpoint(String endpoint) { DockConfiguration.endpoint = endpoint; }

    public void setAccessKey(String accessKey) {
        DockConfiguration.accessKey = accessKey;
    }

    public void setSecretKey(String secretKey) {
        DockConfiguration.secretKey = secretKey;
    }

    public void setRegion(String region) {
        DockConfiguration.region = region;
    }

    public void setExpire(Long expire) {
        DockConfiguration.expire = expire;
    }

    public void setRoleSessionName(String roleSessionName) {
        DockConfiguration.roleSessionName = roleSessionName;
    }

    public void setRoleArn(String roleArn) {
        DockConfiguration.roleArn = roleArn;
    }

    public void setBucket(String bucket) {
        DockConfiguration.bucket = bucket;
    }

    public void setObjectDirPrefix(String objectDirPrefix) {
        DockConfiguration.objectDirPrefix = objectDirPrefix;
    }

//    /**
//     * 创建MinioClient Bean（核心：适配反向代理的HTTP地址）
//     */
//    @Bean
//    public MinioClient minioClient() {
//        // 方式1：通过endpoint重载方法（推荐，明确指定端口和是否HTTPS）
//        // 解析endpoint的协议、IP、端口
//        String[] endpointParts = endpoint.split("//")[1].split(":");
//        String host = endpointParts[0]; // 192.168.10.103
//        int port = Integer.parseInt(endpointParts[1]); // 9011
//        boolean isHttps = endpoint.startsWith("https"); // 反向代理是HTTP，故为false
//
//        return MinioClient.builder()
//                .endpoint(host, port, isHttps) // 8.3.7核心：通过重载方法指定secure
//                .credentials(accessKey, secretKey)
//                .build();
//    }
}

 ard-sample/src/main/java/com/ard/sample/storage/service/impl/StorageServiceImpl.java

@@ -8,6 +8,7 @@
import com.ard.sample.config.DockConfiguration;
import com.ard.sample.storage.service.IStorageService;
import com.ard.oss.service.impl.OssServiceContext;
import com.ard.sample.utils.MinioStsUtils;
import io.minio.MinioClient;
import io.minio.PutObjectArgs;
import io.minio.credentials.StaticProvider;
@@ -37,31 +38,53 @@

    @Autowired
    private OssServiceContext ossService;
    @Autowired
    private MinioStsUtils minioStsUtils;

    @Override
    public StsCredentialsDTO getSTSCredentials() {
        CredentialsDTO credentials = ossService.getCredentials();
//        CredentialsDTO credentials = ossService.getCredentials();
        CredentialsDTO credentials = minioStsUtils.getCredentials();

        //验证一下minio的临时凭证是否可用
        log.info("验证临时凭证是否有效：{}", credentials);
        log.info("验证http临时凭证是否有效：{}", credentials);
        execMinio(DockConfiguration.endpoint,
                credentials.getAccessKeyId(),
                credentials.getAccessKeySecret(),
                credentials.getSecurityToken(),
                OssConfiguration.region,
                DockConfiguration.bucket,
                "test_object");
                "test_object_http");

//        log.info("验证https临时凭证是否有效：{}", credentials);
//        execMinio(OssConfiguration.endpoint,
//                credentials.getAccessKeyId(),
//                credentials.getAccessKeySecret(),
//                credentials.getSecurityToken(),
//                OssConfiguration.region,
//                DockConfiguration.bucket,
//                "test_object_https");

        return StsCredentialsDTO.builder()
                //机场媒体库minio配置信息用代理地址，桶用机场的桶。
                //.endpoint(OssConfiguration.endpoint)
                .endpoint(DockConfiguration.endpoint)
//                .bucket(OssConfiguration.bucket)
                .bucket(DockConfiguration.bucket)
//                .credentials(ossService.getCredentials())
                .credentials(credentials)
                .provider(OssConfiguration.provider)
                .objectKeyPrefix(OssConfiguration.objectDirPrefix)
                .region(OssConfiguration.region)
                .provider(DockConfiguration.provider)
                .objectKeyPrefix(DockConfiguration.objectDirPrefix)
                .region(DockConfiguration.region)
                .build();

//        return StsCredentialsDTO.builder()
//                //机场媒体库minio配置信息用代理地址，桶用机场的桶。
//                .endpoint(OssConfiguration.endpoint)
//                .bucket(OssConfiguration.bucket)
////                .credentials(ossService.getCredentials())
//                .credentials(credentials)
//                .provider(OssConfiguration.provider)
//                .objectKeyPrefix(OssConfiguration.objectDirPrefix)
//                .region(OssConfiguration.region)
//                .build();
    }

    @Override
@@ -83,16 +106,18 @@
                          String accessKeyId,
                          String accessKeySecret,
                          String securityToken,
                          String region,
                          String bucketName,
                          String testObjectName) {
        // 1. 替换为你要验证的临时凭证参数（从 getCredentials() 返回的结果中复制）
        try {
            log.info("🔑 正在验证{}临时凭证有效性...", endpoint);
            // 2. 用临时凭证（含 securityToken）初始化 MinIO 客户端
            MinioClient minioClient = MinioClient.builder()
                    .endpoint(endpoint)
//                    .credentials(accessKeyId, accessKeySecret) // 核心：传入 securityToken
                    .credentialsProvider(new StaticProvider(accessKeyId, accessKeySecret, securityToken))
                    .region("us-east-1") // 和你配置的 region 一致
                    .region(region) // 和你配置的 region 一致   us-east-1
                    .build();

            // 3. 执行验证操作：上传一个测试文件（模拟机场上传媒体文件）

 ard-sample/src/main/java/com/ard/sample/utils/MinioStsUtils.java

New file
@@ -0,0 +1,55 @@
package com.ard.sample.utils;

import com.ard.oss.model.CredentialsDTO;
import io.minio.credentials.AssumeRoleProvider;
import lombok.extern.slf4j.Slf4j;
import okhttp3.ConnectionPool;
import okhttp3.OkHttpClient;
import org.springframework.stereotype.Component;

import java.security.NoSuchAlgorithmException;
import java.security.ProviderException;
import java.util.concurrent.TimeUnit;

import static com.ard.sample.config.DockConfiguration.*;

/**
 * 获取http的STS凭证的工具类，用于简化STS临时凭证的获取过程。
 */
@Slf4j
@Component
public class MinioStsUtils {

    public CredentialsDTO getCredentials() {
        try {
            // 构建适配HTTP协议的OkHttpClient（移除所有SSL相关配置）
            OkHttpClient httpClient = new OkHttpClient.Builder()
                    // 保留原代码的连接池配置（禁用连接复用，如需复用可删除此行）
                    .connectionPool(new ConnectionPool(0, 1, TimeUnit.SECONDS))
                    .build();

            // 构建 AssumeRoleProvider，使用简化后的HTTP客户端
            AssumeRoleProvider provider = new AssumeRoleProvider(
                    endpoint,          // 注意：此处endpoint需改为HTTP地址（如 http://sts.example.com）
                    accessKey,         // 主账号AccessKey
                    secretKey,         // 主账号SecretKey
                    Math.toIntExact(expire), // 凭证过期时间（转int）
                    null,              // 可选参数（如RoleArn，根据实际SDK调整）
                    region, // 地域（如cn-hangzhou）
                    null, null, null,  // 其他可选参数
                    httpClient         // 传入HTTP版本的OkHttpClient
            );

            // 获取 STS 临时凭证
            var stsCredentials = provider.fetch();
            return new CredentialsDTO(stsCredentials, expire);

        } catch (ProviderException e) {
            log.error("Failed to fetch/parse STS response (HTTP access)", e);
            throw new RuntimeException("STS response parse failed", e);
        } catch (NoSuchAlgorithmException e) {
            log.error("Failed to fetch/parse STS response (HTTP access)", e);
            throw new RuntimeException(e);
        }
    }
}