Share a bucket with other OIDC users #21598

https://docs.min.io/community/minio-object-store/administration/identity-access-management/policy-based-access-control.html#openid-policy-variables

the page also contains example policy which substitutes the user name.

sharing = providing access via policy , so please figure out a way that works as per your needs using resource, username and policy actions.

e.g : create a group, assign the poilcy which allows actions against a resource and add all the users to the group. or assign all the required users with the same policy

Thanks for your reply @prakashsvmx

That's right, but it requires to be an admin in MinIO to create the group and the corresponding policy (i.e. run mc admin group add or mc admin policy create).

Instead, we would like to empower regular users to assign a custom access policy to their own buckets without admin intervention (i.e. mc anonymous set-json custom-policy.json <alias>/<bucket>). Sorry, I should have clarified that earlier.

Starting with the easiest policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:*"
      ],
      "Resource": [
        "arn:aws:s3:::shared-bucket/*",
        "arn:aws:s3:::shared-bucket"
      ]
    }
  ]
}

We don't know which Principal and/or Condition we need to add to restrict full access to a specific OIDC users.

According to the docs, the OIDC Policy Variables are not supported Condition keys, and a policy like the one below does not work:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": "*",
            "Action": [
                "s3:*"
            ],
            "Resource": [
                "arn:aws:s3:::shared-bucket/*",
                "arn:aws:s3:::shared-bucket"
            ],
            "Condition" : {
                "StringEquals" : { 
                    "jwt:preferred_username" : [
                        "userone",
                        "usertwo"
                    ]
                }
            }
        }
    ]
}