Bug 1855944

Description of problem:

- We need to mention that the sts key (rgw_sts_key) should be at least 16 characters;
https://access.redhat.com/documentation/en-us/red_hat_ceph_storage/4/html/developer_guide/ceph-object-gateway-and-the-s3-api#secure-token-service_dev

- At the "AssumeRole" example , the correct policy_document statement should be as below. The current one at the example gives syntax error. 

policy_document = "{\"Version\":\"2012-10-17\",\"Statement\":{\"Effect\":\"Allow\",\"Principal\":{\"AWS\":[\"arn:aws:iam:::user/TESTER1\"]},\"Action\":[\"sts:AssumeRole\"]}}"

- creating role and role policy outside of script and reading them instead of creating inside of script would be a better example, otherwise script gives an error after 2nd run because role and rolepolicy was already defined.

https://access.redhat.com/documentation/en-us/red_hat_ceph_storage/4/html-single/developer_guide/index#examples-using-the-secure-token-service-apis_dev

- instead of just giving the usernames such as  "TESTER" and "TESTER1", it might be also better to give the user names which defines the purpose of these users (maybe a suffix can be added to the end of TESTER username).

https://access.redhat.com/documentation/en-us/red_hat_ceph_storage/4/html-single/developer_guide/index#examples-using-the-secure-token-service-apis_dev
 
- An example script of sending a policy from the client and some examples which explains how role policy and policy sent by the client interacts to provide the final permissions would be very helpful for system administrators who are not expert on S3 policies.  Example script excerpt where the client sends policy:

policyfromclient="{\"Version\":\"2012-10-17\",\"Statement\":{\"Effect\":\"Allow\",\"Action\":\"s3:*\",\"Resource\":\"arn:aws:s3:::*\"}}"

response = sts_client.assume_role_with_web_identity(
RoleArn='arn:aws:iam:::role/identityrole',
RoleSessionName='Bob',
DurationSeconds=3600,
Policy=policyfromclient,
WebIdentityToken="eyJhbGciOiJSUzI1NiIsInR...7dfQmg_S0iF588MBlg"

)


- We need to add "How to obtain thumbprint of an OpenID Connect Provider IDP" and https://docs.ceph.com/docs/master/radosgw/oidc/ sections to the downstream documents.

- We need to mention to add proper CAPS to the related user at the downstream documents, ex:
radosgw-admin caps add --uid="TESTER1" --caps="roles=*"


- For AssumeRolewithWebIdentity, we need to mention that CA certificate of IDP should be trusted by the RGWs or "rgw verify ssl" needs to set to "false"

- At the condition statement while creating the role we should mention that the string should match with the "aud" attribute at the JWT token

- We can note that the x5c is the  mandatory field in the GET request for validation

Version-Release number of selected component (if applicable):
4.1