8f11222a63
feat(admin): add MinIO-compatible IAM and IDP endpoints ( #4334 )
...
feat(admin): add MinIO-compatible IAM/IDP admin endpoints
Register and implement MinIO admin API compatibility for IAM/IDP:
- PUT /v3/import-iam-v2 and POST /v3/revoke-tokens/{userProvider}
- generic /v3/idp-config/{type}[/{name}] CRUD mapped onto existing config
- LDAP/OpenID service-account, policy-entities, and list-access-keys flows
Adds IamSys::delete_temp_account primitive to back STS token revocation.
revoke-tokens requires the broader ListUsers admin capability for
cross-user revocation (self-revocation only needs RemoveServiceAccount),
mirroring the cross-user guard used by the service-account handlers.
Registers admin route-policy inventory entries for every new route.
Unsupported LDAP/OpenID backends return honest compatibility errors.
Refs rustfs/backlog#609 #610 #616
2026-07-07 05:12:30 +08:00
70a2441407
refactor: route notify dispatch through app context ( #3789 )
...
* refactor: route notify dispatch through app context
* refactor: route admin IAM globals through app context (#3791 )
* refactor: centralize IAM root credential access (#3792 )
2026-06-23 20:05:28 +08:00
d3796d6c10
refactor: remove external owner compat bridges ( #3741 )
2026-06-22 18:28:35 +08:00
cca9e83a8b
refactor: use relative standalone compat consumers ( #3734 )
2026-06-22 15:07:58 +08:00
cc6909b08b
fix(iam): verify sts temp-user persistence ( #3722 )
2026-06-22 13:54:57 +08:00
b14e49e84e
refactor: narrow IAM and Swift compatibility surfaces ( #3587 )
...
* refactor: narrow IAM and Swift compatibility surfaces
* refactor: narrow heal and scanner compatibility surfaces (#3588 )
* refactor: narrow RustFS runtime compatibility surfaces (#3591 )
2026-06-19 03:06:57 +08:00
c098184c49
refactor: clean runtime and test storage boundaries ( #3573 )
...
* refactor: clean runtime observability select boundaries
* refactor: clean test harness fuzz storage boundaries
2026-06-18 18:09:25 +08:00
d094d91925
fix(site-replication): harden service account sync ( #3500 )
2026-06-16 21:20:13 +08:00
528c3278b7
fix(iam): allow colons and dots in STS claim policy names ( #3164 )
...
`is_safe_claim_policy_name` rejected any character other than
`[a-zA-Z0-9_-]`, silently dropping policy names containing colons.
This breaks Kubernetes workload identity where `claim_name=sub`
resolves to `system:serviceaccount:<namespace>:<sa-name>` — a valid
policy name that can be created via the admin API but is then
unreachable during STS session authorization.
Add `:` and `.` to the allowed character set. These characters are:
- Used in K8s service account `sub` claims (colons)
- Used in Java/DNS-style group names from OIDC providers (dots)
- Already accepted by the `add-canned-policy` admin API endpoint
Require at least one alphanumeric character to prevent meaningless
names (`.`, `..`, `-`, `_`, `:`, etc.) from resolving.
Still rejected: `/`, `\`, whitespace, `$`, `;`, `{`, `}` and other
chars that could enable path traversal or injection.
Signed-off-by: Alexander Kharkevich <alex@mara.com >
Co-authored-by: houseme <housemecn@gmail.com >
Co-authored-by: 安正超 <anzhengchao@gmail.com >
Co-authored-by: loverustfs <hello@rustfs.com >
Co-authored-by: GatewayJ <835269233@qq.com >
2026-06-04 03:39:50 +00:00
c257043b63
fix(iam): serialize IAM cache writes ( #3105 )
...
* fix(iam): serialize IAM cache writes
* fix(iam): timestamp rebuilt group memberships
* fix(iam): publish cache updates atomically
* fix(iam): reuse policy cache snapshots
* fix(iam): commit missing user notification cache updates atomically
* fix(iam): remove unused cache membership rebuild wrapper
---------
Co-authored-by: 季宏伟 <jihongwei@jihongweis-MacBook-Pro.local >
Co-authored-by: houseme <housemecn@gmail.com >
2026-05-29 08:02:42 +00:00
8a501846f4
test(iam): cover mixed STS claim policy names ( #2932 )
2026-05-12 10:39:53 +00:00
b2ba2e5bb3
iam: handle sts claim policy names ( #2902 )
...
Co-authored-by: cxymds <Cxymds@qq.com >
2026-05-12 07:10:42 +00:00
03045ff2e6
fix(iam): keep error state on initial load failure ( #2846 )
...
Signed-off-by: houseme <housemecn@gmail.com >
Co-authored-by: houseme <housemecn@gmail.com >
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com >
Co-authored-by: loverustfs <hello@rustfs.com >
Co-authored-by: 安正超 <anzhengchao@gmail.com >
2026-05-08 08:26:01 +00:00
a995ec0315
fix(iam): preserve portable IAM storage and derived auth ( #2713 )
2026-04-28 05:57:10 +00:00
cfbd094bc4
fix(iam): propagate cache miss load failures ( #2692 )
...
Co-authored-by: GatewayJ <8352692332qq.com>
Co-authored-by: loverustfs <hello@rustfs.com >
Co-authored-by: houseme <housemecn@gmail.com >
2026-04-27 09:21:22 +00:00
59f41eb86a
feat(obs): improve metrics coverage and dashboard performance ( #2682 )
2026-04-25 18:51:29 +00:00
f255b8a9f1
fix(admin): align accountinfo policy with IAM prepare_auth for OIDC console ( #2568 )
...
Co-authored-by: GatewayJ <8352692332qq.com>
Co-authored-by: houseme <housemecn@gmail.com >
2026-04-17 05:38:18 +00:00
49366ee200
chore(lint): clippy rules redundant_clone ( #2554 )
2026-04-15 13:54:07 +00:00
8db55de72c
fix(iam): return policy JSON object from info_policy ( #2395 ) ( #2436 )
...
Co-authored-by: GatewayJ <8352692332qq.com>
Co-authored-by: 安正超 <anzhengchao@gmail.com >
2026-04-09 21:45:22 +08:00
898857d1c9
fix(iam): keep service account JWT expiry consistent ( #2410 )
2026-04-07 11:00:07 +08:00
740e4399af
fix: skip missing groups in policy_db_get instead of aborting ( #2393 )
...
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com >
Co-authored-by: 安正超 <anzhengchao@gmail.com >
2026-04-07 09:17:39 +08:00
3366bd2464
feat(iam,admin): prepared IAM auth, ExistingObjectTag, admin permission checks ( #2315 )
...
Signed-off-by: GatewayJ <835269233@qq.com >
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Co-authored-by: GatewayJ <8352692332qq.com>
2026-03-29 19:18:16 +08:00
19d3a23a13
fix(admin): console self password for STS sessions ( #1923 ) ( #2250 )
...
Co-authored-by: GatewayJ <8352692332qq.com>
2026-03-21 22:10:38 +08:00
b9b7d86ae4
feat: improve legacy metadata and admin compatibility ( #2202 )
2026-03-18 21:05:09 +08:00
9d03029959
fix(iam): sync user cache on load-user notifications ( #2104 )
2026-03-09 09:36:02 +08:00
40692f18ed
fix(iam): address PR 1875 review issues for OIDC STS flows ( #1969 )
2026-02-26 14:38:57 +08:00
c35ef84a8c
feat(iam): add OpenID Connect SSO with claim-based policy resolution ( #1875 )
...
Signed-off-by: houseme <housemecn@gmail.com >
Co-authored-by: houseme <housemecn@gmail.com >
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Co-authored-by: heihutu <30542132+heihutu@users.noreply.github.com >
Co-authored-by: loverustfs <hello@rustfs.com >
Co-authored-by: 安正超 <anzhengchao@gmail.com >
2026-02-26 14:03:17 +08:00
fb0267981d
fix(iam): STS parent groups fallback and session policy debug for #1423 ( #1804 )
...
Co-authored-by: 安正超 <anzhengchao@gmail.com >
2026-02-14 11:40:36 +08:00
1184806c3f
Fix/resolve pr 1710 ( #1743 )
2026-02-11 08:24:55 +08:00
8d7cd4cb1b
chore: upgrade dependencies and migrate to aws-lc-rs ( #1333 )
2026-01-02 00:02:34 +08:00
b8aa8214e2
Feat/ftps&sftp ( #1308 )
...
[feat] ftp / sftp
2025-12-31 09:01:15 +08:00
eb33e82b56
fix: Prevent panic in GetMetrics gRPC handler on invalid input ( #1291 )
...
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com >
Co-authored-by: houseme <4829346+houseme@users.noreply.github.com >
2025-12-29 03:10:23 +08:00
82a6e78845
Inject GlobalReadiness into HTTP server pipeline and gate traffic until FullReady ( #1255 )
2025-12-25 00:19:03 +08:00
8821fcc1e7
feat: Replace LRU cache with Moka async cache in policy variables ( #1166 )
...
Co-authored-by: houseme <housemecn@gmail.com >
2025-12-17 00:19:31 +08:00
76d25d9a20
Fix/issue #1001 dead node detection ( #1054 )
...
Co-authored-by: weisd <im@weisd.in >
Co-authored-by: Jitterx69 <mohit@example.com >
2025-12-08 12:29:46 +08:00
769778e565
fix iam ( #783 )
2025-11-03 17:39:51 +08:00
cd1e244c68
Refactor: Introduce content checksums and improve multipart/object metadata handling ( #671 )
...
* feat: adapt to s3s typed etag support
* refactor: move replication struct to rustfs_filemeta, fix filemeta transition bug
* add head_object checksum, filter object metadata output
* fix multipart checksum
* fix multipart checksum
* add content md5,sha256 check
* fix test
* fix cargo
---------
Co-authored-by: overtrue <anzhengchao@gmail.com >
2025-10-20 23:46:13 +08:00
46797dc815
fix(export): fix the policy and service account export ( #665 )
...
* fix(export): fix the policy export mechanism
* fix: correct service account check logic in IamSys
2025-10-20 19:40:54 +08:00
aae768f446
feat: Simple OPA support ( #644 )
...
* opa-feature
* Update crates/policy/src/policy/opa.rs
* add the content related to 'Copyright'
---------
Co-authored-by: root <root@debian.localdomain >
Co-authored-by: houseme <housemecn@gmail.com >
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
2025-10-16 10:35:26 +08:00
7622b37f7b
add iam notification ( #604 )
...
move tonic service to rustfs
2025-09-30 17:32:23 +08:00
823d4b6f79
Add typos github actions and fix typos ( #265 )
...
* Add typo github actions and fix typos
* cargo fmt
2025-07-19 22:08:50 +08:00
982cc66c74
fix: Refactor session policy handling and fix owner permission check ( #226 )
2025-07-16 16:40:51 +08:00
5826396cd0
refactor: Restructure project layout and clean up dependencies ( #30 )
...
This commit introduces a significant reorganization of the project structure to improve maintainability and clarity.
Key changes include:
- Adjusted the directory layout for a more logical module organization.
- Removed unused crate dependencies, reducing the overall project size and potentially speeding up build times.
- Updated import paths and configuration files to reflect the structural changes.
2025-07-02 19:33:12 +08:00
Zhengchao An