On setting up the plugin, the MinIO server prints the Role ARN to its log. The Role ARN is generated by default based on the given plugin URL. To avoid this and use a configurable value set a unique role ID via `MINIO_IDENTITY_PLUGIN_ROLE_ID`.

## REST API call to plugin

				Columns: []clause.Column{{Name: "role"}},
				Having:  []clause.Expression{clause.Eq{"role", "admin"}},
			}},
			"SELECT * FROM `users` GROUP BY `role` HAVING `role` = ?",
			[]interface{}{"admin"},
		},
		{
			[]clause.Interface{clause.Select{}, clause.From{}, clause.GroupBy{
				Columns: []clause.Column{{Name: "role"}},
				Having:  []clause.Expression{clause.Eq{"role", "admin"}},
			}, clause.GroupBy{

    protected String getActionRole() {
        return ROLE;
    }

    // ===================================================================================
    //                                                                      Search Execute
    //                                                                      ==============
    @Execute
    @Secured({ ROLE, ROLE + VIEW })
    public HtmlResponse index() {

    "SignerType": 1
  }
}
```

> NOTE: You can use the `-cscopes` parameter to restrict the requested scopes, for example to `"openid,policy_role_attribute"`, being `policy_role_attribute` a client_scope / client_mapper that maps a role attribute called policy to a `policy` claim returned by Keycloak.

These credentials can now be used to perform MinIO API operations.

### Using MinIO Console

  <developers>
    <developer>
      <id>morgand</id>
      <name>Morgan Delagrange</name>
      <email>morgand at apache dot org</email>
      <organization>Apache</organization>
      <roles>
        <role>Java Developer</role>
      </roles>
    </developer>
    <developer>
      <id>rwaldhoff</id>
      <name>Rodney Waldhoff</name>
      <email>rwaldhoff at apache org</email>

After configuring the plugin, use the generated Role ARN with `AssumeRoleWithCustomToken` to get temporary credentials to access object storage.

## API Request

To make an STS API request with this method, send a POST request to the MinIO endpoint with following query parameters:

 * attributes for business methods.
 * <p>
 * For example:
 *
 * <pre>
 * &#064;Secured({ &quot;ROLE_USER&quot; })
 * public void create(Contact contact);
 *
 * &#064;Secured({ &quot;ROLE_USER&quot;, &quot;ROLE_ADMIN&quot; })
 * public void update(Contact contact);
 *
 * &#064;Secured({ &quot;ROLE_ADMIN&quot; })
 * public void delete(Contact contact);
 * </pre>
 * @author Mark St.Godard
 */

    public static final String ROLE = "admin-log";

    @Override
    protected void setupHtmlData(final ActionRuntime runtime) {
        super.setupHtmlData(runtime);
        runtime.registerData("helpLink", systemHelper.getHelpLink(fessConfig.getOnlineHelpNameLog()));
    }

    @Override
    protected String getActionRole() {
        return ROLE;
    }

    @Execute

    @Override
    protected String getActionRole() {
        return ROLE;
    }

    // ===================================================================================
    //                                                                              Index
    //                                                                      ==============
    @Execute
    @Secured({ ROLE })
    public HtmlResponse index() {

    page = context.new_page()
    page.goto("http://localhost:8000/docs")
    page.get_by_text("GET/items/Read Items").click()
    page.get_by_role("button", name="Try it out").click()
    page.get_by_role("button", name="Execute").click()
    page.screenshot(
        path="docs/en/docs/img/tutorial/separate-openapi-schemas/image02.png"
    )

    # ---------------------
    context.close()