gsadmin/rustfs
1
0
Fork 0
mirror of https://github.com/rustfs/rustfs.git synced 2026-08-10 15:16:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(sts): align AssumeRole authorization (#5281)

Browse Source 
* fix(sts): align AssumeRole authorization with MinIO

* test(sts): cover AssumeRole OPA contract

* fix(iam): fail closed on unresolved policies

* fix(iam): fail closed while OPA initializes

---------

Co-authored-by: cxymds <cxymds@gmail.com>
Co-authored-by: Zhengchao An <anzhengchao@gmail.com>
This commit is contained in:
GatewayJ
2026-08-01 11:48:58 +08:00
committed by GitHub
parent 2b31bda6d1
commit 3d4f4bb86d
7 changed files with 733 additions and 136 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/policy/src/policy/opa.rs
+10 -1
View File
@@ -30,6 +30,10 @@ impl Args {
}
}
pub fn is_configured() -> bool {
env::var_os(ENV_POLICY_PLUGIN_OPA_URL).is_some_and(|url| !url.is_empty())
}
#[derive(Debug, Clone)]
pub struct AuthZPlugin {
client: OpaHttpClient,
@@ -88,7 +92,12 @@ async fn validate(config: &Args) -> Result<(), OpaConfigError> {
.build()
.map_err(OpaConfigError::Connection)?;
match client.post(&config.url).send().await {
let mut request = client.post(&config.url);
if !config.auth_token.is_empty() {
request = request.header("Authorization", format!("Bearer {}", config.auth_token));
}
match request.send().await {
Ok(resp) => {
match resp.status() {
reqwest::StatusCode::OK => {