From 3810ba21332471d4cefb5c8b0de255d7eb7f0c46 Mon Sep 17 00:00:00 2001
From: Chris Lu <chrislusf@users.noreply.github.com>
Date: Fri, 13 Nov 2026 02:56:59 -0800
Subject: [PATCH] s3api: keep token claims from asserting trusted issuers on
 STS sessions

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 weed/s3api/auth_signature_v4.go | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/weed/s3api/auth_signature_v4.go b/weed/s3api/auth_signature_v4.go
index 2bd018bdd1..3c1c51b811 100644
--- a/weed/s3api/auth_signature_v4.go
+++ b/weed/s3api/auth_signature_v4.go
@@ -530,6 +530,8 @@ func (iam *IdentityAccessManagement) validateSTSSessionToken(r *http.Request, se
 	for k, v := range sessionInfo.RequestContext {
 		claims[k] = v
 	}
+	// Token attributes reach the request context; only the bearer path asserts trusted issuers.
+	delete(claims, "seaweed:oidc-issuers")
 	// The session's user is the one it was issued to, never a claim the
 	// identity provider forwarded.
 	if sessionInfo.ExternalUserId != "" {