From a0d69a7ede2634b3ea2c95fc9c0294da3f6b15ca Mon Sep 17 00:00:00 2001
From: Chris Lu <chrislusf@users.noreply.github.com>
Date: Fri, 13 Nov 2026 03:19:01 -0800
Subject: [PATCH] s3api: take a session's aws:userid from its signed parent
 user

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 weed/s3api/auth_signature_v4.go | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/weed/s3api/auth_signature_v4.go b/weed/s3api/auth_signature_v4.go
index 3c1c51b811..eeaf912441 100644
--- a/weed/s3api/auth_signature_v4.go
+++ b/weed/s3api/auth_signature_v4.go
@@ -539,6 +539,11 @@ func (iam *IdentityAccessManagement) validateSTSSessionToken(r *http.Request, se
 	} else {
 		delete(claims, "aws:username")
 	}
+	if sessionInfo.ParentUser != "" {
+		claims["aws:userid"] = sessionInfo.ParentUser
+	} else {
+		delete(claims, "aws:userid")
+	}
 
 	// Key the principal on the OIDC subject so a session resolves to the same
 	// identity on the SigV4 and JWT paths (see s3_iam_middleware.go); fall back to