feat: Allow at most one claim based OpenID IDP

[donatello]

Description

This change allows adding upto one JWT Claim based OpenID provider alongside zero or more Role Policy based OpenID providers.

Previously we only supported exactly one of:

• a single JWT Claim based OpenID provider, or
• one or more Role Policy based OpenID providers

Motivation and Context

We do not support multiple JWT claim based openid providers as there is currently no defined way to specify which IDP is intended in the STS request. For role policy based openid providers, the RoleARN is always present, and we are always able to tell which IDP was intended.

In this change, we allow at most one claim based openid provider, alongside other role policy based providers. When the STS request comes without a RoleARN, we assume the user intends to use the claim based openid provider to login.

How to test this PR?

Using the dex IDP setup at https://github.com/minio/minio-iam-testing, use the following environment for MinIO:

export MINIO_IDENTITY_OPENID_DISPLAY_NAME="CLAIM BASED IDP"
export MINIO_IDENTITY_OPENID_CLAIM_NAME="groups"
export MINIO_IDENTITY_OPENID_CLIENT_ID="minio-client-app"
export MINIO_IDENTITY_OPENID_CLIENT_SECRET="minio-client-app-secret"
export MINIO_IDENTITY_OPENID_CONFIG_URL="http://localhost:5556/dex/.well-known/openid-configuration"
export MINIO_IDENTITY_OPENID_REDIRECT_URI="http://127.0.0.1:10000/oauth_callback"
export MINIO_IDENTITY_OPENID_SCOPES="groups,openid,profile,email"

export MINIO_IDENTITY_OPENID_CLIENT_ID_2="minio-client-app-2"
export MINIO_IDENTITY_OPENID_CLIENT_SECRET_2="minio-client-app-secret-2"
export MINIO_IDENTITY_OPENID_CONFIG_URL_2="http://localhost:5557/dex/.well-known/openid-configuration"
export MINIO_IDENTITY_OPENID_DISPLAY_NAME_2="ROLE POLICY BASED IDP"
export MINIO_IDENTITY_OPENID_REDIRECT_URI_2="http://127.0.0.1:10000/oauth_callback"
export MINIO_IDENTITY_OPENID_ROLE_POLICY_2="readonly"
export MINIO_IDENTITY_OPENID_SCOPES_2="groups,openid,profile,email"

Login via console and it should work.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Optimization (provides speedup with no functional changes)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

• Fixes a regression (If yes, please add commit-id or PR # here)
• Unit tests added/updated
• Internal documentation updated
• Create a documentation update request here

[minio-trusted]

Mint Automation

Test	Result
mint-large-bucket.sh	✔️
mint-fs.sh	✔️
mint-erasure.sh	✔️
mint-dist-erasure.sh	✔️
mint-compress-encrypt-dist-erasure.sh	✔️
mint-pools.sh	✔️
Deleting image on docker hub
Deleting image locally