does not allow sso

[Iceforestik]

NOTE

If this case is urgent, please subscribe to Subnet so that our 24/7 support team may help you faster.

does not allow sso

Expected Behavior

there should be an entry into the minio console

Current Behavior

I type in my username and password after clicking on the Login with SSO button, I get back to the Login with SSO page and after that the login does not request any more, since it has filled out, but the console does not log in.

Your Environment

• Version used (minio --version): minio version RELEASE.2022-10-05T14-58-27Z (commit-id=4bdf41a6c70ff5809c3db5c427f3cbee1a725b79) Runtime: go1.18.7 linux/amd64 License: GNU AGPLv3 https://www.gnu.org/licenses/agpl-3.0.html Copyright: 2015-2022 MinIO, Inc.
• Operating System and version (uname -a): Linux iceforest 5.4.0-128-generic #144~18.04.1-Ubuntu SMP Thu Sep 22 11:08:41 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux

my openid config: keycloak config: minio users: minio policy: additional information if you remove scopes from the settings if you put OpenID in scope, then we get a 401 error

tell me, please, how can I determine why they are not allowed? it does not give out any errors. but as if he is missing something

[bpedersen2]

Looking at the policy I think you are not granting enough rights for the console, see https://github.com/minio/minio/issues/14099

[ravindk89]

just checking - your policy claim for that user has readwriteuserjwt as the value - but that policy does not appear to exist on MinIO. Can you change that value to consoleAdmin to start?

Once you confirm you can log in with the admin credentials, then it makes more sense to try restricting access based on S3 Resource and such.

[Iceforestik]

just checking - your policy claim for that user has readwriteuserjwt as the value - but that policy does not appear to exist on MinIO. Can you change that value to consoleAdmin to start?

Once you confirm you can log in with the admin credentials, then it makes more sense to try restricting access based on S3 Resource and such.

Looking at the policy I think you are not granting enough rights for the console, see #14099

I put the policy=consoleAdmin attribute in keycloak, but the error remained, I really already broke my whole head how to configure it

[donatello]

Could you do a server trace in a terminal with a command like:

mc admin trace -v -a --funcname 'sts.*' myminio

and then do a login attempt and show the results here?

So far I am not able to tell if the IDP is granting access and issuing a JWT.

[Iceforestik]

i dont know what is it, but now it works. thx