2 Commits

Include renames

Author	SHA1	Message	Date
Chris Lu	f40687b34e	s3: tighten STS session token handling (#11383) ... * s3api: test that a session token must not reveal its credential * sts: derive secret access key with HMAC keyed on the signing key * s3api: stop accepting STS session tokens as bearer credentials * security: reject STS session tokens on filer and admin gRPC auth * test: sign s3/iam framework requests with the session credential * s3api: exercise the real auth pipeline in the end-to-end harness	2026-09-17 23:50:16 -07:00
Chris Lu	65f2f1488a	iam: test that groups and roles claims reach request-time policy evaluation ... Drives the full path: AssumeRoleWithWebIdentity embeds the claims in the session JWT, AuthenticateJWT restores them, and AuthorizeAction evaluates ForAnyValue:StringEquals on jwt:groups / jwt:roles per bucket. The mock OIDC provider now carries token claims through and surfaces roles, matching the real provider.	2026-07-08 01:53:37 -07:00