OIDC: document jtiReplayProtectionEnabled (managed-provider flag included)

Kubernetes-ServiceAccount-Authentication.md

@@ -288,6 +288,7 @@ Scope on `oidc:sub` to pin a role to a specific ServiceAccount, or `StringLike`
 | **Audience matches none of the configured client IDs** | The projected token `audience` must equal the provider `clientId` (or be in `clientIds`). |
 | **Trust policy denies web identity assumption** | `oidc:sub` in the trust policy must match `system:serviceaccount:<ns>:<sa>` exactly; for a namespace use `StringLike`. |
 | **Credentials expire mid-run** | Use the SDK web-identity provider (Option A) which auto-refreshes; if calling STS manually, re-assume before `Expiration`. |
+| **Token accepted once, then `AssumeRoleWithWebIdentity` fails on reuse** | Since 4.50, `jti` replay protection accepts each web-identity token once; several pods sharing one projected token trip it. Set `"jtiReplayProtectionEnabled": false` in the provider `config` (Part 2) — or `jti_replay_protection_enabled` on a managed provider — for providers fronting Kubernetes workload identity |
 | **SDK still hits real AWS STS** | The STS endpoint override didn't take effect; set `AWS_ENDPOINT_URL_STS` or configure the STS client endpoint in code. |
 
 ## See also

OIDC-Integration.md

@@ -114,6 +114,7 @@ The IAM configuration file has these main sections:
 | `jwksCacheTTLSeconds` | No | integer | How long to cache JWKS before refresh in seconds (default: `3600`) |
 | `roleMapping` | No | object | Configuration for mapping OIDC claims to SeaweedFS roles (see below) |
 | `claimsMapping` | No | object | Map OIDC claims to identity attributes |
+| `jtiReplayProtectionEnabled` | No | boolean | Web-identity token replay protection via `jti` tracking (default: `true`). Set `false` for providers whose clients legitimately reuse one token across multiple `AssumeRoleWithWebIdentity` calls — e.g. Kubernetes projected service-account tokens shared by several pods |
 
 
 ### Policies