This repository was archived by the owner on Apr 25, 2026. It is now read-only.
fix: when claim-based OIDC is configured, treat unknown roleArn as claim-based auth - #21512
#21512Merged
harshavardhana merged 1 commit intoAug 8, 2025
minio:masterminio/minio:masterfrom
ianroberts:fix/treat-invalid-role-as-noneianroberts/minio:fix/treat-invalid-role-as-noneCopy head branch name to clipboard
Merged
fix: when claim-based OIDC is configured, treat unknown roleArn as claim-based auth#21512harshavardhana merged 1 commit intominio:masterminio/minio:masterfrom ianroberts:fix/treat-invalid-role-as-noneianroberts/minio:fix/treat-invalid-role-as-noneCopy head branch name to clipboard
harshavardhana merged 1 commit into
minio:masterminio/minio:masterfrom
ianroberts:fix/treat-invalid-role-as-noneianroberts/minio:fix/treat-invalid-role-as-noneCopy head branch name to clipboard
Conversation
…aim-based auth RoleARN is a required parameter in AssumeRoleWithWebIdentity, according to the standard AWS implementation, and the official AWS SDKs and CLI will not allow you to assume a role from a JWT without also specifying a RoleARN. This meant that it was not possible to use the official SDKs for claim-based OIDC with Minio (minio#21421), since Minio required you to _omit_ the RoleARN in this case. minio#21468 attempted to fix this by disabling the validation of the RoleARN when a claim-based provider was configured, but this had the side effect of making it impossible to have a mixture of claim-based and role-based OIDC providers configured at the same time - every authentication would be treated as claim-based, ignoring the RoleARN entirely. This is an alternative fix, whereby: - _if_ the `RoleARN` is one that Minio knows about, then use the associated role policy - if the `RoleARN` is not recognised, but there is a claim-based provider configured, then ignore the role ARN and attempt authentication with the claim-based provider - if the `RoleARN` is not recognised, and there is _no_ claim-based provider, then return an error.
8 tasks
harshavardhana
approved these changes
Aug 8, 2025
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Community Contribution License
All community contributions in this pull request are licensed to the project maintainers
under the terms of the Apache 2 license.
By creating this pull request I represent that I have the right to license the
contributions to the project maintainers under the Apache 2 license.
Description
RoleARN is a required parameter in AssumeRoleWithWebIdentity, according to the standard AWS implementation, and the official AWS SDKs and CLI will not allow you to assume a role from a JWT without also specifying a RoleARN. This meant that it was not possible to use the official SDKs for claim-based OIDC with Minio (#21421), since Minio required you to omit the RoleARN in this case.
#21468 attempted to fix this by disabling the validation of the RoleARN when a claim-based provider was configured, but this had the side effect of making it impossible to have a mixture of claim-based and role-based OIDC providers configured at the same time - every authentication would be treated as claim-based, ignoring the RoleARN entirely.
This is an alternative fix, whereby:
RoleARNis one that Minio knows about, then use the associated role policyRoleARNis not recognised, but there is a claim-based provider configured, then ignore the role ARN and attempt authentication with the claim-based providerRoleARNis not recognised, and there is no claim-based provider, then return an error.Motivation and Context
Necessary to allow claim-based and role-based OIDC providers to co-exist in the same minio instance.
How to test this PR?
Types of changes
Checklist:
commit-idorPR #here) fix: claim based oidc for official aws libraries #21468