gsadmin/rustfs
1
0
Fork 0
mirror of https://github.com/rustfs/rustfs.git synced 2026-08-31 09:18:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(iam): improve OIDC token exchange diagnostics (#4232)

Browse Source
This commit is contained in:
GatewayJ
2026-07-03 14:15:58 +08:00
committed by GitHub
parent 6fd642253a
commit b1582b3391
1 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/iam/src/oidc.rs
+10 -2
View File
@@ -22,7 +22,8 @@ use crate::oidc_state::{OidcAuthSession, OidcLogoutSession, OidcStateStore};
use openidconnect::core::{CoreAuthenticationFlow, CoreClient, CoreIdToken}; use openidconnect::core::{CoreAuthenticationFlow, CoreClient, CoreIdToken};
use openidconnect::{ use openidconnect::{
AsyncHttpClient, Audience, AuthType, AuthorizationCode, ClientId, ClientSecret, CsrfToken, IssuerUrl, LogoutRequest, Nonce, AsyncHttpClient, Audience, AuthType, AuthorizationCode, ClientId, ClientSecret, CsrfToken, IssuerUrl, LogoutRequest, Nonce,
PkceCodeChallenge, PkceCodeVerifier, PostLogoutRedirectUrl, ProviderMetadataWithLogout, RedirectUrl, Scope, PkceCodeChallenge, PkceCodeVerifier, PostLogoutRedirectUrl, ProviderMetadataWithLogout, RedirectUrl, RequestTokenError,
Scope,
}; };
use reqwest::Client; use reqwest::Client;
use rustfs_config::oidc::*; use rustfs_config::oidc::*;
@@ -569,7 +570,14 @@ impl OidcSys {
.set_redirect_uri(Cow::Owned(redirect)) .set_redirect_uri(Cow::Owned(redirect))
.request_async(&self.http_client) .request_async(&self.http_client)
.await .await
.map_err(|e| format!("token exchange failed: {e}"))?; .map_err(|e| match &e {
RequestTokenError::Parse(parse_err, body) => format!(
"token exchange failed: {e}: parse_error_path={}, response_body_len={}",
parse_err.path(),
body.len()
),
_ => format!("token exchange failed: {e}"),
})?;
// Verify the ID token (signature, issuer, audience, expiry, nonce) // Verify the ID token (signature, issuer, audience, expiry, nonce)
let id_token = token_response let id_token = token_response