gsadmin/rustfs
1
0
Fork 0
mirror of https://github.com/rustfs/rustfs.git synced 2026-09-04 03:05:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(iam): add OpenID Connect SSO with claim-based policy resolution (#1875)

Browse Source 
Signed-off-by: houseme <housemecn@gmail.com>
Co-authored-by: houseme <housemecn@gmail.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: heihutu <30542132+heihutu@users.noreply.github.com>
Co-authored-by: loverustfs <hello@rustfs.com>
Co-authored-by: 安正超 <anzhengchao@gmail.com>
This commit is contained in:
Jeff Poegel
2026-02-25 22:03:17 -08:00
committed by GitHub
parent 0f8bc461d6
commit c35ef84a8c
22 changed files with 2584 additions and 139 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/iam/src/sys.rs
+23 -1
View File
@@ -767,11 +767,33 @@ impl<T: Store> IamSys<T> {
}
},
};
let Ok(p) = self.policy_db_get(parent_user, &effective_groups).await else { return false };
let p = self.policy_db_get(parent_user, &effective_groups).await.unwrap_or_default();
(effective_groups, groups_source, p)
};
if !is_owner && policies.is_empty() {
// For OIDC/STS users, policies may be specified in JWT claims rather than IAM DB.
// Resolve claim-based policy names against built-in default policies.
if let Some(claim_policies) = args.claims.get("policy").and_then(|v| v.as_str()) {
use rustfs_policy::policy::default::DEFAULT_POLICIES;
let mut resolved = Vec::new();
for policy_name in claim_policies.split(',').map(|s| s.trim()).filter(|s| !s.is_empty()) {
for (name, p) in DEFAULT_POLICIES.iter() {
if *name == policy_name {
resolved.push(p.clone());
break;
}
}
}
if !resolved.is_empty() {
let combined = Policy::merge_policies(resolved);
let (has_session_policy, is_allowed_sp) = is_allowed_by_session_policy(args);
if has_session_policy {
return is_allowed_sp && combined.is_allowed(args).await;
}
return combined.is_allowed(args).await;
}
}
return false;
}