S3 inaccessible in the event of multiple SSO connections

[2FromField]

Hello,
With my collegues we are trying to deploy an Onyxia DataLab on our server. But we're encountering a few sticking points after configuration (v10) concerning S3 storage, in particular on the "My Files" tab.
It seems that this is only accessible to the first user to log on to the instance using SSO. The others see "access denied" in the log console. The same goes for projects .

The console looks like this when you try to access the tab in a project :
"Failed to load resource : the server responded with a status of 409 (and 404, 403)

AccessDenied
Access Denied.
project-test
/project-test/
JEDFN23JHB34 (not real)
hg12bhdfj234jnJ4n (not real)

And an other one like this "Uncaught (in promise) AccessDenied: Access Denied. at throwDefaultError$1 (url) at sync Object.listObjects (url)".

Has anyone ever encountered this kind of configuration problem ?
Best regards.

[fcomte]

can you look at the network request ? as everything is done from the browser to the S3 endpoint ? what kind of S3 storage do you use ?

[2FromField]

Regarding the network request, the openid-configuration is in 200 OK status, as is the token. The error is in the bucket name, in this case ‘project-test/’ with a status of 403 Forbidden. The Preview is similar to the console return as indicated in the previous message, as is the Response.
As far as the storage type is concerned, we're using MinIO, configured as in your official documentation.

Shouldn't a new ‘project’ scope be added to the Keycloak Client Scopes?

[olevitt]

project-test probably refers to a project instead of a user personal space. Can you confirm first that user's personal spaces are working fine ?
The fact that you get a 403 forbidden seems to point towards the fact that minIO is not aware that user X has access to project Y. You need to explicitly specify that to minIO on addition to the user X has access to bucket X policy that you already have.
Can you confirm and show which policies you have currently defined in minIO ?

[2FromField]

I can confirm that a user-X can access his bucket and upload files as shown in the image below:

However, it doesn't look perfect because the console displays GET (403 Conflict) and PUT (404 Not found) errors. The policies have been configured as described in the documentation via keycloak with a ‘Hardcoded claim’ mapper under the name ‘policy’. This returned in the console: ‘Referrer Policy: strict-origin-when-cross-origin’.
However, I've just noticed that in the ‘Preview’ it says :

<Error>
  <Code>NoSuchBucketPolicy</Code>
  <Message >The bucket policy does not exist</Message>
  <BucketName>user-x</BucketName>
  <Resource>/user-x/</Resource>
  <RequestId>18DE8EE (not real)</RequestId>
  <HostId>dd77dd9 (not real)</HostId>
</Error>

[olevitt]

The hardcoded claim policy should refer to an actual policy that you applied in minIO (our documentation creates a stsonly policy via the helm chart : https://github.com/InseeFrLab/onyxia-ops/blob/ac65631a3601fede58e1cbb3e16bab863bb40302/apps/minio/values.yaml#L46).
This policy contains the logic user X has access to bucket X for personal user spaces.
For group / project, you need to add additional logic to the policy for each group / project.
If you want, we can setup a visio meeting to review your current configuration and assist you in debugging your setup. Feel free to join the slack server for this : https://join.slack.com/t/3innovation/shared_invite/zt-2skhjkavr-xO~uTRLgoNOCm6ubLpKG7Q