You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Tree: ff4855dcbe

add-ec-vacuum

add_fasthttp_client

add_remote_storage

adding-message-queue-integration-tests

also-delete-parent-directory-if-empty

avoid_releasing_temp_file_on_write

changing-to-zap

collect-public-metrics

copilot/fix-helm-chart-installation

copilot/fix-s3-object-tagging-issue

copilot/sub-pr-7677

create-table-snapshot-api-design

data_query_pushdown

dependabot/maven/other/java/client/com.google.protobuf-protobuf-java-3.25.5

dependabot/maven/other/java/examples/org.apache.hadoop-hadoop-common-3.4.0

detect-and-plan-ec-tasks

do-not-retry-if-error-is-NotFound

ec-disk-type-support

enhance-erasure-coding

fasthttp

feature/tus-protocol

filer1_maintenance_branch

fix-GetObjectLockConfigurationHandler

fix-mount-http-parallelism

fix-mount-read-throughput-7504

fix-s3-object-tagging-issue-7589

fix-versioning-listing-only

ftp

gh-pages

improve-fuse-mount

improve-fuse-mount2

logrus

master

message_send

mount2

mq-subscribe

mq2

nfs-cookie-prefix-list-fixes

optimize-delete-lookups

original_weed_mount

periodic-metadata-sync

pr-7412

random_access_file

refactor-needle-read-operations

refactor-volume-write

remote_overlay

revert-5134-patch-1

revert-5819-patch-1

revert-6434-bugfix-missing-s3-audit

s3-select

sub

tcp_read

test-reverting-lock-table

test_udp

testing

testing-sdx-generation

tikv

track-mount-e2e

upgrade-versions-to-4.00

volume_buffered_writes

worker-execute-ec-tasks

0.72

0.72.release

0.73

0.74

0.75

0.76

0.77

0.90

0.91

0.92

0.93

0.94

0.95

0.96

0.97

0.98

0.99

1.00

1.01

1.02

1.03

1.04

1.05

1.06

1.07

1.08

1.09

1.10

1.11

1.12

1.14

1.15

1.16

1.17

1.18

1.19

1.20

1.21

1.22

1.23

1.24

1.25

1.26

1.27

1.28

1.29

1.30

1.31

1.32

1.33

1.34

1.35

1.36

1.37

1.38

1.40

1.41

1.42

1.43

1.44

1.45

1.46

1.47

1.48

1.49

1.50

1.51

1.52

1.53

1.54

1.55

1.56

1.57

1.58

1.59

1.60

1.61

1.61RC

1.62

1.63

1.64

1.65

1.66

1.67

1.68

1.69

1.70

1.71

1.72

1.73

1.74

1.75

1.76

1.77

1.78

1.79

1.80

1.81

1.82

1.83

1.84

1.85

1.86

1.87

1.88

1.90

1.91

1.92

1.93

1.94

1.95

1.96

1.97

1.98

1.99

1;70

2.00

2.01

2.02

2.03

2.04

2.05

2.06

2.07

2.08

2.09

2.10

2.11

2.12

2.13

2.14

2.15

2.16

2.17

2.18

2.19

2.20

2.21

2.22

2.23

2.24

2.25

2.26

2.27

2.28

2.29

2.30

2.31

2.32

2.33

2.34

2.35

2.36

2.37

2.38

2.39

2.40

2.41

2.42

2.43

2.47

2.48

2.49

2.50

2.51

2.52

2.53

2.54

2.55

2.56

2.57

2.58

2.59

2.60

2.61

2.62

2.63

2.64

2.65

2.66

2.67

2.68

2.69

2.70

2.71

2.72

2.73

2.74

2.75

2.76

2.77

2.78

2.79

2.80

2.81

2.82

2.83

2.84

2.85

2.86

2.87

2.88

2.89

2.90

2.91

2.92

2.93

2.94

2.95

2.96

2.97

2.98

2.99

3.00

3.01

3.02

3.03

3.04

3.05

3.06

3.07

3.08

3.09

3.10

3.11

3.12

3.13

3.14

3.15

3.16

3.18

3.19

3.20

3.21

3.22

3.23

3.24

3.25

3.26

3.27

3.28

3.29

3.30

3.31

3.32

3.33

3.34

3.35

3.36

3.37

3.38

3.39

3.40

3.41

3.42

3.43

3.44

3.45

3.46

3.47

3.48

3.50

3.51

3.52

3.53

3.54

3.55

3.56

3.57

3.58

3.59

3.60

3.61

3.62

3.63

3.64

3.65

3.66

3.67

3.68

3.69

3.71

3.72

3.73

3.74

3.75

3.76

3.77

3.78

3.79

3.80

3.81

3.82

3.83

3.84

3.85

3.86

3.87

3.88

3.89

3.90

3.91

3.92

3.93

3.94

3.95

3.96

3.97

3.98

3.99

4.00

4.01

4.02

dev

helm-3.65.1

v0.69

v0.70beta

v3.33

Branches Tags

${ item.name }

Create tag ${ searchTerm }

Create branch ${ searchTerm }

from 'ff4855dcbe'

${ noResults }

seaweedfs/weed

History

Chris Lu ff4855dcbe sts: limit session duration to incoming token's exp claim (#7670) * sts: limit session duration to incoming token's exp claim This fixes the issue where AssumeRoleWithWebIdentity would issue sessions that outlive the source identity token's expiration. For use cases like GitLab CI Jobs where the ID Token has an exp claim limited to the CI job's timeout, the STS session should not exceed that expiration. Changes: - Add TokenExpiration field to ExternalIdentity struct - Extract exp/iat/nbf claims in OIDC provider's ValidateToken - Pass token expiration from Authenticate to ExternalIdentity - Modify calculateSessionDuration to cap at source token's exp - Add comprehensive tests for the new behavior Fixes: https://github.com/seaweedfs/seaweedfs/discussions/7653 * refactor: reduce duplication in time claim extraction Use a loop over claim names instead of repeating the same extraction logic three times for exp, iat, and nbf claims. * address review: add defense-in-depth for expired tokens - Handle already-expired tokens defensively with 1 minute minimum duration - Enforce MaxSessionLength from config as additional cap - Fix potential nil dereference in test mock - Add test case for expired token scenario * remove issue reference from test * fix: remove early return to ensure MaxSessionLength is always checked		2 days ago
..
admin	fix: normalize Windows backslash paths in weed admin file uploads (#7636)	5 days ago
cluster	Support multiple filers for S3 and IAM servers with automatic failover (#7550)	2 weeks ago
command	Update notification.toml	2 days ago
credential	fix: Admin UI user creation fails before filer discovery (#7624) (#7625)	5 days ago
filer	mount: improve read throughput with parallel chunk fetching (#7627)	5 days ago
filer_client	Clean up logs and deprecated functions (#7339)	2 months ago
glog	Add Kafka Gateway (#7231)	2 months ago
iam	sts: limit session duration to incoming token's exp claim (#7670)	2 days ago
iamapi	Support multiple filers for S3 and IAM servers with automatic failover (#7550)	2 weeks ago
images	Migrates from disintegration/imaging c2019 to cognusion/imaging c2024. (#5533)	2 years ago
kms	S3 API: Add integration with KMS providers (#7152)	4 months ago
mount	mount: improve read throughput with parallel chunk fetching (#7569)	2 weeks ago
mq	mount: improve read throughput with parallel chunk fetching (#7569)	2 weeks ago
notification	Fix webhook duplicate deliveries and POST to GET conversion (#7668)	2 days ago
operation	fix: Use mime.FormatMediaType for RFC 6266 compliant Content-Disposition (#7635)	5 days ago
pb	Support separate volume server ID independent of RPC bind address (#7609)	1 week ago
query	mount: improve read throughput with parallel chunk fetching (#7569)	2 weeks ago
remote_storage	Filer: Fixed critical bugs in the Azure SDK migration (PR #7310) (#7401)	1 month ago
replication	Filer: Fixed critical bugs in the Azure SDK migration (PR #7310) (#7401)	1 month ago
s3api	s3: fix ListBuckets not showing buckets created by authenticated users (#7648)	2 days ago
security	remove spoof-able request header (#7103)	4 months ago
sequence	remove unused function	1 year ago
server	fix: restore volume mount when VolumeConfigure fails (#7669)	2 days ago
sftpd	SFTP: support reloading user store on HUP signal (#7651)	2 days ago
shell	Nit: have `ec.encode` exit immediately if no volumes are processed. (#7654)	2 days ago
static	Fix Broken Links (#5287)	2 years ago
stats	Metrics: Add Prometheus metrics for concurrent upload tracking (#7555)	2 weeks ago
storage	fix: normalize Windows backslash paths in weed admin file uploads (#7636)	5 days ago
telemetry	convert error fromating to %w everywhere (#6995)	5 months ago
topology	fix random volume ids in master.html (#7655)	2 days ago
util	4.02	2 days ago
wdclient	fix: ARM v7 alignment issue for 64-bit atomic operations (#7652)	2 days ago
worker	Add disk-aware EC rebalancing (#7597)	1 week ago
Makefile	Update README and weed/Makefile (#7571)	2 weeks ago
weed.go	set exit status	9 months ago