mirror of
https://github.com/seaweedfs/seaweedfs.git
synced 2026-09-20 23:14:21 +00:00
chrislu
48d500d603
✅ Major fixes implemented: **1. Fixed IAM Configuration Format Issues:** - Fixed Action fields to be arrays instead of strings in iam_config.json - Fixed Resource fields to be arrays instead of strings - Removed unnecessary roleStore configuration field **2. Fixed Role Store Initialization:** - Modified loadIAMManagerFromConfig to explicitly set memory-based role store - Prevents default fallback to FilerRoleStore which requires filer address **3. Enhanced JWT Authentication Flow:** - S3 server now starts successfully with IAM integration enabled - JWT authentication properly processes Bearer tokens - Returns 403 AccessDenied instead of 501 NotImplemented for invalid tokens **4. Fixed Trust Policy Validation:** - Updated validateTrustPolicyForWebIdentity to handle both JWT and mock tokens - Added fallback for mock tokens used in testing (e.g. 'valid-oidc-token') **Startup logs now show:** - ✅ Loading advanced IAM configuration successful - ✅ Loaded 2 policies and 2 roles from config - ✅ Advanced IAM system initialized successfully **Before:** 501 NotImplemented errors due to missing IAM integration **After:** Proper JWT authentication with 403 AccessDenied for invalid tokens The core 501 NotImplemented issue is resolved. S3 IAM integration now works correctly. Remaining work: Debug test timeout issue in CreateBucket operation.
104 lines
2.3 KiB
JSON
104 lines
2.3 KiB
JSON
{
|
|
"sts": {
|
|
"tokenDuration": 3600000000000,
|
|
"maxSessionLength": 43200000000000,
|
|
"issuer": "seaweedfs-sts",
|
|
"signingKey": "dGVzdC1zaWduaW5nLWtleS0zMi1jaGFyYWN0ZXJzLWxvbmc="
|
|
},
|
|
"identityProviders": [
|
|
{
|
|
"name": "test-oidc",
|
|
"type": "mock",
|
|
"config": {
|
|
"issuer": "test-oidc-issuer"
|
|
}
|
|
}
|
|
],
|
|
"policy": {
|
|
"defaultEffect": "Deny",
|
|
"storeType": "memory"
|
|
},
|
|
"roles": [
|
|
{
|
|
"roleName": "TestAdminRole",
|
|
"roleArn": "arn:seaweed:iam::role/TestAdminRole",
|
|
"trustPolicy": {
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Effect": "Allow",
|
|
"Principal": {
|
|
"Federated": "test-oidc"
|
|
},
|
|
"Action": ["sts:AssumeRoleWithWebIdentity"]
|
|
}
|
|
]
|
|
},
|
|
"attachedPolicies": ["S3AdminPolicy"],
|
|
"description": "Admin role for testing"
|
|
},
|
|
{
|
|
"roleName": "TestReadOnlyRole",
|
|
"roleArn": "arn:seaweed:iam::role/TestReadOnlyRole",
|
|
"trustPolicy": {
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Effect": "Allow",
|
|
"Principal": {
|
|
"Federated": "test-oidc"
|
|
},
|
|
"Action": ["sts:AssumeRoleWithWebIdentity"]
|
|
}
|
|
]
|
|
},
|
|
"attachedPolicies": ["S3ReadOnlyPolicy"],
|
|
"description": "Read-only role for testing"
|
|
}
|
|
],
|
|
"policies": [
|
|
{
|
|
"name": "S3AdminPolicy",
|
|
"document": {
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": ["s3:*"],
|
|
"Resource": ["*"]
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": ["sts:ValidateSession"],
|
|
"Resource": ["*"]
|
|
}
|
|
]
|
|
}
|
|
},
|
|
{
|
|
"name": "S3ReadOnlyPolicy",
|
|
"document": {
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": [
|
|
"s3:GetObject",
|
|
"s3:ListBucket"
|
|
],
|
|
"Resource": [
|
|
"arn:seaweed:s3:::*",
|
|
"arn:seaweed:s3:::*/*"
|
|
]
|
|
},
|
|
{
|
|
"Effect": "Allow",
|
|
"Action": ["sts:ValidateSession"],
|
|
"Resource": ["*"]
|
|
}
|
|
]
|
|
}
|
|
}
|
|
]
|
|
}
|