Canned policy not applied when using AssumeRoleWithClientGrants and JS SDK

Expected Behavior

When using the JS SDK to sign in a client with temp. credentials - token and policy provided by keycloak- the policy should be applied no matter if it is a default or a custom one.

Current Behavior

When using default policy e.g. readwrite everything is ok (I can list the buckets) but when I set the policy to restricted (a custom policy I created) I have a S3Error: Access Denied. message. Notice that the custom policy is correctly applied when using the OpenID button on the Minio browser.

Possible Solution

Steps to Reproduce (for bugs)

1. Create a user with a custom policy in Keycloak
2. Get the Token from Keycloak for the user
3. Use the AssumeRoleWithClientGrants to get temp credentials
4. Use the JS SDK the list the buckets => S3Error: Access Denied.

Context

Regression

Your Environment

• Version used (minio version): docker minio/minio:edge
• Environment name and version (e.g. nginx 1.9.1):
• Server type and version:
• Operating System and version (uname -a): windows
• Link to your project:

[harshavardhana]

My problem is not to retrieve AccessKeyID / SecretAccessKey / SessionToken but to Initialize a Minio client (with those key/secret/token) with the correct policy applied.

So what you mean from your previous reply ( #818 (comment) ) is by using the Go client API https://docs.min.io/docs/golang-client-api-reference I shouldn’t got the issue. Am I right ?

in minio-js that’s not allowed in minio-go it is allowed using the credential.Credentials structure look at the method minio.NewWithCredentials

[prakashsvmx]

@GuillaumeNachury please have a look at : https://github.com/minio/minio-js/pull/960