OIDC: allow ignoring unmapped groups (Synology SSO / Active Directory sends unmappable groups like "DOMAIN\Domain Users")

Request scope

• This is a feature request and does not ask for troubleshooting an unsupported remote or shared filesystem deployment.

Problem or use case

With Synology SSO Server as the OIDC provider (backed by Active Directory), the groups claim contains every AD group of the user in DOMAIN\group format, including the built-in group DOMAIN\Domain Users.

RustFS 1.0.0 rejects the whole login with OIDC policy mapping did not resolve to current policies as soon as any group in the token has no policy with exactly that name (see #8050, which was resolved by renaming a policy).

In an AD environment this cannot be solved by creating matching policies: every user is a member of EXAMPLE\Domain Users, and creating a policy named EXAMPLE\Domain Users fails because the Console rejects policy names containing spaces.

As a result, group-based OIDC authorization cannot work with Synology SSO / Active Directory, even when policies exist for the relevant groups (e.g. EXAMPLE\rustfs_admins and EXAMPLE\rustfs_users, both created and stored correctly).

How to reproduce: Configure Synology SSO Server (DSM 7.2, account type Domain/LDAP) as OIDC provider with the settings below. Create policies named after some of the user's groups (e.g. EXAMPLE\rustfs_admins). Trying to create a policy named EXAMPLE\Domain Users is rejected (space in name). Logging in via OIDC then returns InvalidRequest: OIDC policy mapping did not resolve to current policies.

RUSTFS_IDENTITY_OPENID_ENABLE=on
RUSTFS_IDENTITY_OPENID_CONFIG_URL=https://sso.example.com/webman/sso/.well-known/openid-configuration
RUSTFS_IDENTITY_OPENID_SCOPES=openid,email,groups
RUSTFS_IDENTITY_OPENID_USERNAME_CLAIM=username

Debug log (redacted):

"message":"oidc claims mapped to policies","result":"claims_policy_mapped","groups_claim":"groups","policy_count":8,"group_count":8,"groups":"[\"EXAMPLE\\\\Domain Users\", \"EXAMPLE\\\\rustfs_admins\", \"EXAMPLE\\\\rustfs_users\", ...]"
"err":"S3Error(Inner { code: InvalidRequest, message: Some(\"OIDC policy mapping did not resolve to current policies\") ... })"

Environment: RustFS 1.0.0 (Docker image rustfs/rustfs:1.0.0), Synology SSO Server on DSM 7.2, account type Domain/LDAP (Active Directory). Related: #8050.

Proposed solution

Groups without a matching policy should be ignored, and the login should succeed as long as at least one group resolves to an existing policy. This could be the default behavior or an opt-in option such as RUSTFS_IDENTITY_OPENID_IGNORE_UNMAPPED_GROUPS=on.

Alternatives considered

A filter for which claim values are mapped, e.g. RUSTFS_IDENTITY_OPENID_GROUPS_FILTER (prefix or regex), so that only relevant groups are considered.

Stripping a domain prefix before mapping, e.g. RUSTFS_IDENTITY_OPENID_GROUPS_STRIP_PREFIX="EXAMPLE\\".

Allowing spaces in policy names, so that built-in AD groups can at least be mapped to placeholder policies.

Current workaround: RUSTFS_IDENTITY_OPENID_ROLE_POLICY with one fixed policy. Login works, but every SSO user gets the same permissions, so group-based authorization is not possible.

Additional context

Synology SSO Server and Active Directory always include built-in groups such as DOMAIN\Domain Users in the groups claim, and there is no option on the IdP side to exclude them. Related: #8050 (same error, but resolved there by renaming a policy, which is not possible here).