@PostMapping
    @Operation(summary = "Fetch temporary credentials from Amazon Security Token Service", parameters = {
        @Parameter(name = "duration", description = "Duration of the temporary credentials"),
        @Parameter(name = "tokenCode", description = "MFA token code"),
        @Parameter(name = "profile", description = "AWS profile name"),
        @Parameter(name = "serialNumber", description = "MFA serial number"),
        @Parameter(name = "roleArn", description = "Role ARN"),
        @Parameter(name = "requestBody", description = "Request body"),
        @Parameter(name = "request", description = "Request"),
        @Parameter(name = "response", description = "Response")
    })
    public ResponseEntity<String> fetchCredentials(@RequestParam(value = "token", required = false) final String tokenCode,
                                                   @RequestParam(required = false) final String profile,
                                                   @RequestParam(required = false) final String serialNumber,
                                                   @RequestParam(required = false) final String roleArn,
                                                   @RequestBody final MultiValueMap<String, String> requestBody,
                                                   final HttpServletRequest request,
                                                   final HttpServletResponse response) throws Throwable {

        var authenticationResult = (AuthenticationResult) null;
        try {
            authenticationResult = restAuthenticationService.getObject().authenticate(requestBody, request, response)
                .orElseThrow(AuthenticationException::new);
        } catch (final Exception e) {
            LoggingUtils.error(LOGGER, e);
            return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body("Authentication failed");
        }

        val amz = casProperties.getAmazonSts();
        val principal = authenticationResult.getAuthentication().getPrincipal();
        LOGGER.debug("Authenticated principal: [{}]", principal);
        val authz = authorizePrincipal(amz, principal);
        if (authz.isPresent()) {
            return authz.get();
        }

        val credentials = ChainingAWSCredentialsProvider.getInstance(amz.getCredentialAccessKey(),
            amz.getCredentialSecretKey(), amz.getProfilePath(), StringUtils.defaultIfBlank(profile, amz.getProfileName()));
        val builder = StsClient.builder();
        AmazonClientConfigurationBuilder.prepareSyncClientBuilder(builder, credentials, amz);
        val client = builder.build();
        
        val duration = StringUtils.defaultIfBlank(requestBody.getFirst("duration"), "PT15S");
        if (amz.isRbacEnabled()) {
            val attributeValues = principal.getAttributes().get(amz.getPrincipalAttributeName());
            LOGGER.debug("Found roles [{}]", attributeValues);

            if (attributeValues.size() > 1) {
                if (StringUtils.isBlank(roleArn)) {
                    return ResponseEntity.status(HttpStatus.UNAUTHORIZED)
                        .body("Found multiple roles and none is specified. Current roles: " + attributeValues);
                }
                if (attributeValues.stream().noneMatch(value -> RegexUtils.find(roleArn, value.toString()))) {
                    return ResponseEntity.status(HttpStatus.UNAUTHORIZED)
                        .body("Specified role is not allowed. Current roles:" + attributeValues);
                }
            }
            val role = StringUtils.defaultIfBlank(roleArn, attributeValues.getFirst().toString());
            LOGGER.debug("Using role [{}]", role);

            val roleRequest = AssumeRoleRequest.builder()
                .durationSeconds(Long.valueOf(Beans.newDuration(duration).toSeconds()).intValue())
                .roleArn(role)
                .roleSessionName(UUID.randomUUID().toString())
                .serialNumber(serialNumber)
                .tokenCode(tokenCode)
                .build();
            val sessionResult = client.assumeRole(roleRequest);
            val stsCredentials = sessionResult.credentials();
            return createOutputResponse(amz, stsCredentials);
        }

        val sessionTokenRequest = GetSessionTokenRequest.builder()
            .durationSeconds(Long.valueOf(Beans.newDuration(duration).toSeconds()).intValue())
            .serialNumber(serialNumber)
            .tokenCode(tokenCode)
            .build();
        val sessionResult = client.getSessionToken(sessionTokenRequest);
        val stsCredentials = sessionResult.credentials();
        return createOutputResponse(amz, stsCredentials);
    }
Fetch credentials.

@param tokenCode    the token code
@param profile      the profile
@param serialNumber the serial number
@param roleArn      the role arn
@param requestBody  the request body
@param request      the request
@param response     the response
@return the map
support/cas-server-support-aws/src/main/java/org/apereo/cas/aws/AmazonSecurityTokenServiceEndpoint.java