9cf211930d
fix(iam): expand OIDC auth diagnostics ( #4281 )
...
* fix(iam): expand OIDC auth diagnostics
* fix(iam): accept RFC3339 OIDC timestamps
* chore(iam): log OIDC policy mapping diagnostics
* chore(iam): log OIDC claim and policy details
* chore(iam): lower OIDC diagnostic log verbosity
* fix(iam): gate OIDC diagnostics behind debug
* chore: update yanked num-bigint lockfile
2026-07-05 18:05:23 +08:00
b1582b3391
fix(iam): improve OIDC token exchange diagnostics ( #4232 )
2026-07-03 14:15:58 +08:00
5c60f0cae9
refactor: centralize owner server config reads ( #3793 )
2026-06-23 21:27:30 +08:00
583a23bdf2
fix(ecstore): replace panic-driven pool and set stubs ( #3753 )
...
* fix(ecstore): replace panic-driven pool and set stubs
* test(runtime): tolerate restricted local bind checks
* fix(ecstore): remove remaining trait stub placeholders
* fix(ecstore): tighten trait stub follow-up semantics
* chore: ignore local worktrees
* chore: update layer dependency baseline for resolve_* context entries
Add 7 accepted infra->app dependency entries introduced by recent
refactoring PRs (#3770 , #3771 , #3772 ) that route global state lookups
through app::context::resolve_* functions.
Co-Authored-By: heihutu <heihutu@gmail.com >
---------
Co-authored-by: heihutu <heihutu@gmail.com >
2026-06-23 12:31:17 +08:00
5b36ef5556
fix(decommission): persist progress adaptively ( #3497 )
...
Persist decommission progress after either the existing time interval or a migrated-item threshold, and flush progress baselines after bucket and terminal-state saves.
Also stabilize the OIDC discovery mock used by the pre-commit gate.
2026-06-17 08:17:59 +08:00
d094d91925
fix(site-replication): harden service account sync ( #3500 )
2026-06-16 21:20:13 +08:00
e8012bd1ba
refactor(logging): normalize admin telemetry and error messages ( #3430 )
2026-06-14 13:27:10 +08:00
b4524033e3
refactor(config): move global config accessors ( #3360 )
2026-06-11 19:16:02 +08:00
ca58d7f0ec
refactor(config): migrate server config consumers ( #3353 )
2026-06-11 17:04:50 +08:00
a73c90c811
security: redact IAM and target debug secrets ( #3306 )
2026-06-10 09:03:50 +08:00
ce6fcf39b1
feat(oidc): add HIDE_FROM_UI option to exclude providers from console login ( #3162 )
...
Add `RUSTFS_IDENTITY_OPENID_HIDE_FROM_UI[_<SUFFIX>]` setting that
removes a provider from the login page while keeping it fully
functional for STS AssumeRoleWithWebIdentity and site-replication.
Changes:
- Add `hide_from_ui: bool` to `OidcProviderConfig`
- Add `list_visible_providers()` that filters hidden providers
(used by console login and /v3/oidc/providers endpoint)
- Keep `list_providers()` unfiltered for site-replication/admin config
- Extract `normalize_provider_config(config) -> config` to deduplicate
field normalization (accepts the struct directly, not 18 parameters)
- Add `parse_enable_state()` helper for consistent EnableState parsing
- Plumb through admin API request structs (`#[serde(default)]`)
- Expose in `OidcConfigView` for admin GET config round-trip
- Persist via `upsert_persisted_provider_config()`
Note: adding `hide_from_ui` to the public `OidcProviderConfig` struct
is a source-level change for code constructing it with struct literals.
This is acceptable for the current pre-1.0 release cycle.
Signed-off-by: Alexander Kharkevich <alex@mara.com >
Co-authored-by: GatewayJ <835269233@qq.com >
2026-06-03 13:37:44 +00:00
159ddd5bac
fix: honor bucket-scoped ListBucket policies with s3:prefix ( #2707 )
...
Co-authored-by: houseme <housemecn@gmail.com >
2026-04-27 14:13:22 +00:00
59f41eb86a
feat(obs): improve metrics coverage and dashboard performance ( #2682 )
2026-04-25 18:51:29 +00:00
8d4caeacad
fix(oidc): add federated logout flow ( #2667 )
...
Co-authored-by: GatewayJ <835269233@qq.com >
2026-04-24 06:51:31 +00:00
989827e3b5
feat: add OTHER_AUDIENCES config ( #2605 )
...
Co-authored-by: GatewayJ <835269233@qq.com >
2026-04-21 03:48:13 +00:00
28edfd6190
fix(storage): harden offline drive fail-fast paths ( #2564 )
...
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com >
Co-authored-by: houseme <4829346+houseme@users.noreply.github.com >
2026-04-16 09:21:45 +00:00
16b9189e9b
feat(oidc): add roles_claim and jwt:roles policy support ( #2509 )
...
Co-authored-by: GatewayJ <8352692332qq.com>
Co-authored-by: houseme <housemecn@gmail.com >
Co-authored-by: loverustfs <hello@rustfs.com >
2026-04-15 09:30:24 +08:00
67863630b2
fix(auth): reject ambiguous case-insensitive claim matches ( #2386 )
2026-04-04 08:36:14 +08:00
2d91e2f580
fix(oidc): support case-insensitive claim name matching ( #2362 )
...
Co-authored-by: loverustfs <hello@rustfs.com >
Co-authored-by: 安正超 <anzhengchao@gmail.com >
2026-04-03 21:45:56 +08:00
c244943313
feat(iam): retry OIDC discovery with issuer URL slash variants ( #2360 )
...
Co-authored-by: GatewayJ <8352692332qq.com>
Co-authored-by: 安正超 <anzhengchao@gmail.com >
2026-04-03 21:10:27 +08:00
75e6902f46
feat(admin): add persisted OIDC config APIs ( #2267 )
...
Co-authored-by: heihutu <heihutu@gmail.com >
2026-03-24 12:13:41 +08:00
e1a278aaf8
fix(iam): preserve trailing slash in OIDC issuer URL ( #2228 )
2026-03-19 13:52:59 +08:00
a6090b98dc
fix(iam): remove incorrect trailing slash from OIDC issuer URL ( #2050 )
2026-03-02 19:48:12 +08:00
40692f18ed
fix(iam): address PR 1875 review issues for OIDC STS flows ( #1969 )
2026-02-26 14:38:57 +08:00
c35ef84a8c
feat(iam): add OpenID Connect SSO with claim-based policy resolution ( #1875 )
...
Signed-off-by: houseme <housemecn@gmail.com >
Co-authored-by: houseme <housemecn@gmail.com >
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com >
Co-authored-by: heihutu <30542132+heihutu@users.noreply.github.com >
Co-authored-by: loverustfs <hello@rustfs.com >
Co-authored-by: 安正超 <anzhengchao@gmail.com >
2026-02-26 14:03:17 +08:00
GatewayJ