OIDC permissions "regression" from 1.0.0-beta.12 to 1.0.0

Author: davgiaCreated Sep 21, 2026Updated Sep 30, 2026

LabelsS-reproducing

Describe the bug I don't know if it's a regression or if I need to adapt my configuration. I have bumped to version 1.0.0. And the user reports that it does not see anything when logging to the web ui.

Before:

After:

Tenant:

yaml

apiVersion: rustfs.com/v1alpha1
kind: Tenant
metadata:
  name: development
  namespace: rustfs
spec:
  credsSecret:
    name: rustfs
  env:
  - name: RUSTFS_IDENTITY_OPENID_ENABLE_keycloak
    value: "true"
  - name: RUSTFS_IDENTITY_OPENID_CONFIG_URL_keycloak
    value: https://keycloak.example.com/realms/management/.well-known/openid-configuration
  - name: RUSTFS_IDENTITY_OPENID_SCOPES_keycloak
    value: openid,profile,email,groups
  - name: RUSTFS_IDENTITY_OPENID_GROUPS_CLAIM_keycloak
    value: groups
  - name: RUSTFS_IDENTITY_OPENID_USERNAME_CLAIM_keycloak
    value: preferred_username
  - name: RUSTFS_IDENTITY_OPENID_DISPLAY_NAME_keycloak
    value: Keycloak
  - name: RUSTFS_IDENTITY_OPENID_REDIRECT_URI_keycloak
    value: https://rustfs.example.com/rustfs/admin/v3/oidc/callback/keycloak
  - name: RUSTFS_IDENTITY_OPENID_CLIENT_ID_keycloak
    valueFrom:
      secretKeyRef:
        key: client-id
        name: rustfs-oidc
  - name: RUSTFS_IDENTITY_OPENID_CLIENT_SECRET_keycloak
    valueFrom:
      secretKeyRef:
        key: client-secret
        name: rustfs-oidc
  - name: RUSTFS_BROWSER_REDIRECT_URL
    value: https://rustfs.example.com
  - name: RUSTFS_OUTBOUND_ALLOW_ORIGINS
    value: https://keycloak.example.com
  image: docker.io/rustfs/rustfs:1.0.0
  mountPath: /data
  policies:
  - document:
      configMapKeyRef:
        key: policy-administrators.json
        name: rustfs-policies
    name: administrators
  - document:
      configMapKeyRef:
        key: policy-maintainers.json
        name: rustfs-policies
    name: maintainers
  - document:
      configMapKeyRef:
        key: policy-developers.json
        name: rustfs-policies
    name: developers
  pools:
  - name: primary
    persistence:
      volumeClaimTemplate:
        accessModes:
        - ReadWriteOnce
        resources:
          requests:
            storage: 64Gi
      volumesPerServer: 1
    servers: 1

Policies:

yaml

apiVersion: v1
data:
  policy-administrators.json: '{"Statement":[{"Action":["admin:*"],"Condition":{"ForAnyValue:StringEquals":{"jwt:groups":["administrators"[]}},"Effect":"Allow"},{"Action":["kms:*"],"Condition":{"ForAnyValue:StringEquals":{"jwt:groups":["administrators"[]}},"Effect":"Allow"},{"Action":["sts:AssumeRole"[],"Condition":{"ForAnyValue:StringEquals":{"jwt:groups":["administrators"[]}},"Effect":"Allow"},{"Action":["s3:*"],"Condition":{"ForAnyValue:StringEquals":{"jwt:groups":["administrators"]}},"Effect":"Allow","Resource":["arn:aws:s3:::*"]}],"Version":"2012-10-17"}'
  policy-developers.json: '{"Statement":[{"Action":["sts:AssumeRole"[],"Condition":{"ForAnyValue:StringEquals":{"jwt:groups":["development-developers"[]}},"Effect":"Allow"},{"Action":["s3:GetBucketLocation","s3:ListBucket","s3:GetObject","s3:PutObject"[],"Condition":{"ForAnyValue:StringEquals":{"jwt:groups":["development-developers"]}},"Effect":"Allow","Resource":["arn:aws:s3:::*"]}],"Version":"2012-10-17"}'
  policy-maintainers.json: '{"Statement":[{"Action":["sts:AssumeRole"[],"Condition":{"ForAnyValue:StringEquals":{"jwt:groups":["maintainers"[]}},"Effect":"Allow"},{"Action":["s3:*"],"Condition":{"ForAnyValue:StringEquals":{"jwt:groups":["maintainers"[]}},"Effect":"Allow","Resource":["arn:aws:s3:::*"]},{"Action":["s3:PutBucketPolicy","s3:PutBucketAcl","s3:PutObjectAcl","s3:DeleteObject","s3:DeleteObjectVersion","s3:DeleteBucket"[],"Condition":{"ForAnyValue:StringEquals":{"jwt:groups":["maintainers"]}},"Effect":"Deny","Resource":["arn:aws:s3:::*"]}],"Version":"2012-10-17"}'
kind: ConfigMap
metadata:
  labels:
    rustfs.tenant: development
  name: rustfs-policies
  namespace: rustfs

JWT claims

JWT claims (#0):

json

{
  "exp": 1789989968,
  "iat": 1789989668,
  "jti": "onrtna:[REDACTED]",
  "iss": "https://keycloak.example.com/realms/management",
  "aud": "rustfs",
  "typ": "Bearer",
  "azp": "rustfs",
  "sid": "[redacted]",
  "scope": "openid groups email profile",
  "email_verified": true,
  "name": "john doe",
  "groups": [
    "developers"
  ],
  "preferred_username": "john.doe",
  "given_name": "john",
  "family_name": "doe",
  "email": "[email protected]"
}

This gives access to the web ui but there are no buckets.

JWT claims (#1):

json

{
  "exp": 1789989968,
  "iat": 1789989668,
  "jti": "onrtna:[REDACTED]",
  "iss": "https://keycloak.example.com/realms/management",
  "aud": "rustfs",
  "typ": "Bearer",
  "azp": "rustfs",
  "sid": "[redacted]",
  "scope": "openid groups email profile",
  "email_verified": true,
  "name": "john doe",
  "groups": [
    "developers",
    "development-developers"
  ],
  "preferred_username": "john.doe",
  "given_name": "john",
  "family_name": "doe",
  "email": "[email protected]"
}

This gives an xml, like this:

xml

<Error>
<Code>InvalidRequest</Code>
<Message>OIDC policy mapping did not resolve to current policies</Message>
</Error>

JWT claims (#2):

json

{
  "exp": 1789989968,
  "iat": 1789989668,
  "jti": "onrtna:[REDACTED]",
  "iss": "https://keycloak.example.com/realms/management",
  "aud": "rustfs",
  "typ": "Bearer",
  "azp": "rustfs",
  "sid": "[redacted]",
  "scope": "openid groups email profile",
  "email_verified": true,
  "name": "john doe",
  "groups": [
    "developers",
    "development-developers",
    "maintainers"
  ],
  "preferred_username": "john.doe",
  "given_name": "john",
  "family_name": "doe",
  "email": "[email protected]"
}

This gives:

xml

<Error>
<Code>InvalidRequest</Code>
<Message>OIDC policy mapping did not resolve to current policies</Message>
</Error>

I think the problem is triggered when multiple groups are present in the token claims.

To Reproduce I use the rustfs-operator to deploy the tenant. I specify version 1.0.0. The configuration is presented above.

Expected behavior The OIDC policies should work in all scenarios.

Desktop (please complete the following information):

OS: Windows 11 (latest)
Browser: chrome (latest)
Version: rustfs: 1.0.0 / rustfs-operator: 0.0.5

Source: rustfs/rustfs

View original on GitHub View discussion on GitHub