mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-07-20 15:02:27 +00:00
Chris Wydra
63db56ff7d
* iam: surface OIDC groups into STS session request context for resource-policy ABAC The groups claim was added to ExternalIdentity.Groups but excluded from Attributes (processedClaims), so it never reached the session RequestContext. As a result group membership was usable only in role trust policies (assume-time), not in resource/permission policies (request-time) - so a single role could not scope access by the caller's groups (aggregate ABAC). Surface Groups as a []string in the request context; the string-condition evaluator already handles multi-valued context keys, and the S3 middleware exposes it as jwt:groups. * iam: also surface OIDC roles into the STS request context (companion to groups) The 'roles' claim is excluded from the OIDC attributes by the same processedClaims set that excluded 'groups', so it never reached the session request context and was usable only via provider-configured role mapping - not a raw token roles claim. Add ExternalIdentity.Roles, populate it from the token's roles claim, and surface it as a []string in the request context so resource policies can gate on jwt:roles, exactly as the previous commit did for jwt:groups.