fix(iam): propagate cache miss load failures (#2692)

Co-authored-by: GatewayJ <8352692332qq.com>
Co-authored-by: loverustfs <hello@rustfs.com>
Co-authored-by: houseme <housemecn@gmail.com>

rustfs/src/auth.rs

@@ -175,6 +175,7 @@ impl S3Auth for IAMAuth {
                 }
                 Err(e) => {
                     warn!("get_secret_key failed: check_key error, access_key: {access_key}, error: {e:?}");
+                    return Err(iam_lookup_error_to_s3_error(&e));
                 }
             }
         } else {
@@ -188,6 +189,10 @@ impl S3Auth for IAMAuth {
     }
 }
 
+fn iam_lookup_error_to_s3_error(_err: &IamError) -> S3Error {
+    s3_error!(InternalError, "IAM user lookup failed")
+}
+
 // check_key_valid checks the key is valid or not. return the user's credentials and if the user is the owner.
 pub async fn check_key_valid(session_token: &str, access_key: &str) -> S3Result<(Credentials, bool)> {
     // KEYSTONE INTEGRATION: Check if Keystone credentials are present in task-local storage
@@ -968,6 +973,14 @@ mod tests {
         assert!(error.message().unwrap_or("").contains("Your account is not signed up"));
     }
 
+    #[test]
+    fn test_iam_lookup_error_maps_to_internal_error() {
+        let result = iam_lookup_error_to_s3_error(&IamError::Io(std::io::Error::other("load user failed")));
+
+        assert_eq!(result.code(), &S3ErrorCode::InternalError);
+        assert_eq!(result.message(), Some("IAM user lookup failed"));
+    }
+
     #[test]
     fn test_check_claims_from_token_empty_token_and_access_key() {
         let mut cred = create_test_credentials();