fix: STS AssumeRole returns empty credentials when endpoint has no path (#205)

[jiuker]

Fixes issue #205: temporary credentials (access_key / secret_key / session_token) returned by AssumeRoleProvider are empty. Root cause: when the STS endpoint has no path (e.g. http://host:9000), the SigV4 signature is computed with an empty CanonicalURI, while the actual request is sent to '/', causing signature verification to fail and leaving credentials empty.

Also aligns all STS provider request parameters with the minio-go reference implementation and fixes the XML root node paths used for credentials parsing.

Bug fix (issue #205):

• AssumeRoleProvider constructor: normalize an empty endpoint path to '/', keeping the signed CanonicalURI consistent with the actual request URI (conditional assignment only - does not override user-defined paths such as /minio/sts)
• Add an AssumeRoleProvider() regression test: success path asserts all three temporary credential fields are non-empty; failure path asserts the error is diagnosable via creds.err

Align STS provider parameters with minio-go:

• Add token_revoke_type to every provider (AssumeRoleProvider, WebIdentityClientGrantsProvider/ClientGrantsProvider/WebIdentityProvider, LdapIdentityProvider, CertificateIdentityProvider), added to the request body only when non-empty
• LdapIdentityProvider additionally gains policy, duration_seconds, and config_name
• Jwt struct gains access_token / refresh_token; the WebIdentity flow now sends WebIdentityAccessToken / WebIdentityRefreshToken
• All new parameters are appended at the end with defaults, backward compatible

XML parsing fix:

• All STS response parsing now uses the full root path with the Response prefix (e.g. AssumeRoleResponse/AssumeRoleResult), avoiding parse failures

Files changed: include/miniocpp/providers.h, src/providers.cc, tests/tests.cc

Summary by CodeRabbit

• New Features

  • Added custom-token authentication for obtaining temporary credentials.
  • Added access and refresh token support for web identity authentication.
  • Added token-revocation settings across supported authentication providers.
  • Expanded LDAP and certificate authentication options, including policy, duration, and configuration settings.
  • Forwarded additional authentication parameters in temporary credential requests.

• Bug Fixes

  • Improved parsing of temporary credential responses.
  • Standardized default STS endpoint paths.
  • Added validation to detect incomplete credential responses.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: a4dc8cc9-19aa-4ae8-a858-ea1787a8b8b7

📥 Commits

Reviewing files that changed from the base of the PR and between 0f731f5 and ae29c6d.

📒 Files selected for processing (3)

• include/miniocpp/providers.h
• src/providers.cc
• tests/tests.cc

---

📝 Walkthrough

Walkthrough

Provider constructors now accept token-revocation settings and expanded LDAP options. Web identity providers forward JWT access and refresh tokens. STS response parsing uses qualified paths. A custom-token provider now fetches temporary credentials. An AssumeRole test validates returned credentials.

Changes

Provider authentication updates

Layer / File(s)	Summary
Provider API contracts include/miniocpp/providers.h	Jwt exposes access and refresh tokens. Provider constructors accept token-revocation settings. LDAP accepts policy, duration, and configuration name values. CustomTokenIdentityProvider is now public.
STS and web identity request flow src/providers.cc, tests/tests.cc	STS requests include token-revocation settings. Web identity requests forward JWT tokens. Response parsing uses qualified paths. The AssumeRole test validates returned credentials.
LDAP and certificate request flow src/providers.cc	LDAP requests include configured policy, duration, token-revocation, and configuration values. Certificate requests include token-revocation settings. Both use qualified response paths.
Custom-token credential flow src/providers.cc	CustomTokenIdentityProvider validates its endpoint, sends AssumeRoleWithCustomToken, handles request errors, and parses temporary credentials.

Estimated code review effort: 3 (Moderate) | ~30 minutes

Mergeability Score: ⚪ Minimal · up to ae29c

The PR corrects STS request URI/signature alignment and expands provider parameter and XML parsing compatibility; the only noted cleanup is a redundant test comment with no runtime impact, so no actionable merge-blocking risk remains.

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant CustomTokenIdentityProvider
  participant STSEndpoint
  participant XMLParser
  Client->>CustomTokenIdentityProvider: Request temporary credentials
  CustomTokenIdentityProvider->>STSEndpoint: Send AssumeRoleWithCustomToken
  STSEndpoint-->>CustomTokenIdentityProvider: Return response or request error
  CustomTokenIdentityProvider->>XMLParser: Parse qualified credential XML
  XMLParser-->>CustomTokenIdentityProvider: Return temporary credentials

Loading

Poem

A rabbit sends a custom token,
To STS where paths are no longer broken.
JWTs and revoke types cross the gate,
LDAP and certificates add their state.
Qualified XML brings credentials near,
And AssumeRole tests make results clear.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the primary fix for empty credentials when the STS endpoint has no path.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/tests.cc`:
- Line 1571: Remove the redundant “Success path” comment immediately preceding
the temporary-credentials condition in the test, leaving the condition and
surrounding test logic unchanged.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 13f6a380-f180-40a3-a5ed-23846969d7fe

📥 Commits

Reviewing files that changed from the base of the PR and between e764b82 and be495d0.

📒 Files selected for processing (3)

• include/miniocpp/providers.h
• src/providers.cc
• tests/tests.cc