policy claim missing from the JWT token

[jpchev]

I've configured my Keycloak as described here

but I get the error policy claim missing from the JWT token, credentials will not be generated in minio embedded console
after successfully authenticating on Keycloack

I've turn on the trace mode
with the command
mc admin trace minio-https
and I see the following token on the server

minio-0:9000/?Action=AssumeRoleWithWebIdentity&DurationSeconds=3600&Version=2011-06-15&WebIdentityToken=JWT_TOKEN

which correspond to the following JWT, where the policy claim is present

{
  "exp": 1642758354,
  "iat": 1642758054,
  "auth_time": 1642757429,
  "jti": "550f1965-b1a1-42aa-b3e6-6421493e2fa4",
  "iss": "https://mykeaycloack.com/auth/realms/test",
  "aud": "minio-console",
  "sub": "e6f1bb71-b663-46b0-8eff-924ee35312a7",
  "typ": "ID",
  "azp": "minio-console",
  "session_state": "91deb0e9-ce1c-4421-90c1-54686b068310",
  "at_hash": "Xd6ckMo81vRCmJKi9C1qHg",
  "acr": "0",
  "upn": "console",
  "email_verified": false,
  "address": {},
  "groups": [
    "offline_access",
    "uma_authorization"
  ],
  "preferred_username": "console",
  "policy": "readwrite_data,read_analytics,read_logs"
}

so how come I get the error?

[vadmeste]

@jpchev can you paste all openid related env variables or configuration that you are setting ?

[jpchev]

the following command
mc admin config get minio-https identity_openid

returns

identity_openid config_url=https://myurl.com/auth/realms/eds/.well-known/openid-configuration client_id=minio-console client_secret= claim_name=policy claim_userinfo= role_policy= claim_prefix=" " redirect_uri=https://myurl.com/oauth_callback redirect_uri_dynamic=off scopes=

thanks

[vadmeste]

$ mc admin config get play identity_openid
identity_openid config_url= client_id= client_secret= claim_name=policy claim_prefix= redirect_uri= scopes= claim_userinfo= claim_userinfo= role_policy= redirect_uri_dynamic=off

I wonder why you have this claim_prefix=" ", is that a space ? you need to set it to empty if that's the case.

[jpchev]

thanks, that fixes my problem