fix: STS AssumeRole returns empty credentials when endpoint has no path (#205) - #247
fix: STS AssumeRole returns empty credentials when endpoint has no path (#205)#247jiuker wants to merge 3 commits into
Conversation
…th (minio#205) Fixes issue minio#205: temporary credentials (access_key / secret_key / session_token) returned by AssumeRoleProvider are empty. Root cause: when the STS endpoint has no path (e.g. http://host:9000), the SigV4 signature is computed with an empty CanonicalURI, while the actual request is sent to '/', causing signature verification to fail and leaving credentials empty. Also aligns all STS provider request parameters with the minio-go reference implementation and fixes the XML root node paths used for credentials parsing. Bug fix (issue minio#205): - AssumeRoleProvider constructor: normalize an empty endpoint path to '/', keeping the signed CanonicalURI consistent with the actual request URI (conditional assignment only - does not override user-defined paths such as /minio/sts) - Add an AssumeRoleProvider() regression test: success path asserts all three temporary credential fields are non-empty; failure path asserts the error is diagnosable via creds.err Align STS provider parameters with minio-go: - Add token_revoke_type to every provider (AssumeRoleProvider, WebIdentityClientGrantsProvider/ClientGrantsProvider/WebIdentityProvider, LdapIdentityProvider, CertificateIdentityProvider), added to the request body only when non-empty - LdapIdentityProvider additionally gains policy, duration_seconds, and config_name - Jwt struct gains access_token / refresh_token; the WebIdentity flow now sends WebIdentityAccessToken / WebIdentityRefreshToken - All new parameters are appended at the end with defaults, backward compatible XML parsing fix: - All STS response parsing now uses the full root path with the Response prefix (e.g. AssumeRoleResponse/AssumeRoleResult), avoiding parse failures Files changed: include/miniocpp/providers.h, src/providers.cc, tests/tests.cc
|
Warning Review limit reached
Next review available in: 44 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
💤 Files with no reviewable changes (1)
📝 WalkthroughWalkthroughProvider constructors now accept token-revocation settings and expanded LDAP options. Web identity providers forward JWT access and refresh tokens. STS response parsing uses qualified paths. An AssumeRole test validates temporary credentials. ChangesProvider authentication updates
Estimated code review effort: 3 (Moderate) | ~25 minutes Sequence Diagram(s)sequenceDiagram
participant Client
participant AssumeRoleProvider
participant WebIdentityProvider
participant STSEndpoint
participant XMLParser
Client->>AssumeRoleProvider: Request temporary credentials
AssumeRoleProvider->>STSEndpoint: Send AssumeRole with TokenRevokeType
Client->>WebIdentityProvider: Request web identity credentials
WebIdentityProvider->>STSEndpoint: Send JWT access and refresh tokens
STSEndpoint-->>XMLParser: Return qualified STS response XML
XMLParser-->>AssumeRoleProvider: Parse temporary credentials
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@tests/tests.cc`:
- Line 1571: Remove the redundant “Success path” comment immediately preceding
the temporary-credentials condition in the test, leaving the condition and
surrounding test logic unchanged.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro Plus
Run ID: 13f6a380-f180-40a3-a5ed-23846969d7fe
📒 Files selected for processing (3)
include/miniocpp/providers.hsrc/providers.cctests/tests.cc
1 participant
Fixes issue #205: temporary credentials (access_key / secret_key / session_token) returned by AssumeRoleProvider are empty. Root cause: when the STS endpoint has no path (e.g. http://host:9000), the SigV4 signature is computed with an empty CanonicalURI, while the actual request is sent to '/', causing signature verification to fail and leaving credentials empty.
Also aligns all STS provider request parameters with the minio-go reference implementation and fixes the XML root node paths used for credentials parsing.
Bug fix (issue #205):
Align STS provider parameters with minio-go:
XML parsing fix:
Files changed: include/miniocpp/providers.h, src/providers.cc, tests/tests.cc
Summary by CodeRabbit
New Features
Bug Fixes