}
  ]
}
```

If the user is authenticating using an STS credential which was authorized from OpenID connect we allow all `jwt:*` variables specified in the JWT specification, custom `jwt:*` or extensions are not supported. List of policy variables for OpenID based STS.

- `jwt:sub`
- `jwt:iss`
- `jwt:aud`
- `jwt:jti`
- `jwt:upn`
- `jwt:name`
- `jwt:groups`
- `jwt:given_name`

export MINIO_IDENTITY_OPENID_CLIENT_ID="843351d4-1080-11ea-aa20-271ecba3924a"
minio server /mnt/data
```

#### Casdoor

```
export MINIO_ROOT_USER=minio
export MINIO_ROOT_PASSWORD=minio123
export MINIO_IDENTITY_OPENID_CONFIG_URL=http://CASDOOR_ENDPOINT/.well-known/openid-configuration

- kubeadm: removed preflight check for nsenter on Linux nodes
  kubeadm: added preflight check for `losetup` on Linux nodes. It's required by kubelet for keeping a block device opened. ([#129450](https://github.com/kubernetes/kubernetes/pull/129450), [@carlory](https://github.com/carlory)) [SIG Cluster Lifecycle]

                        DefaultJvm(JvmVersion.JAVA_11, JvmVendor.OPENJDK),
                        DefaultJvm(JvmVersion.JAVA_17, JvmVendor.OPENJDK),
                        DefaultJvm(JvmVersion.JAVA_21, JvmVendor.OPENJDK),
                        DefaultJvm(JvmVersion.JAVA_25, JvmVendor.OPENJDK),
                    )
            }.joinToString(",") { javaHome(it, this, arch) }
        return listOf(

pkg runtime (netbsd-arm-cgo), const GOOS = "netbsd"
pkg runtime (openbsd-386), const GOARCH = "386"
pkg runtime (openbsd-386), const GOOS = "openbsd"
pkg runtime (openbsd-386-cgo), const GOARCH = "386"
pkg runtime (openbsd-386-cgo), const GOOS = "openbsd"
pkg runtime (openbsd-amd64), const GOARCH = "amd64"
pkg runtime (openbsd-amd64), const GOOS = "openbsd"
pkg runtime (openbsd-amd64-cgo), const GOARCH = "amd64"

	EnvTestOpenIDServer2 = "_MINIO_OPENID_TEST_SERVER_2"
)

// SetUpOpenIDs - sets up one or more OpenID test servers using the test OpenID
// container and canned data from https://github.com/minio/minio-ldap-testing
//
// Each set of client app params corresponds to a separate openid server, and
// the i-th server in this will be applied the i-th policy in `rolePolicies`. If

| JVM default      | Java 9+ | Java 11+     | [OpenJDK]       |                                                              |
| Android default  | ✅      | Android 10+  | [BoringSSL]     |                                                              |
| [GraalVM]        | ✅      |              | [OpenJDK]       | Only actively tested with JDK 11, not with 8 target          |

// along with this program.  If not, see <http://www.gnu.org/licenses/>.

package openid

import (
	"context"
	"encoding/json"
	"errors"
	"fmt"
	"net/http"

	"github.com/minio/minio/internal/arn"
	"github.com/minio/minio/internal/config"
	"github.com/minio/minio/internal/config/identity/openid/provider"
	xhttp "github.com/minio/minio/internal/http"
	xnet "github.com/minio/pkg/v3/net"
)

pkg syscall (openbsd-386), const AF_KEY ideal-int
pkg syscall (openbsd-386), const AF_LAT ideal-int
pkg syscall (openbsd-386), const AF_LINK ideal-int
pkg syscall (openbsd-386), const AF_LOCAL ideal-int
pkg syscall (openbsd-386), const AF_MAX ideal-int
pkg syscall (openbsd-386), const AF_MPLS ideal-int
pkg syscall (openbsd-386), const AF_NATM ideal-int

        get() = JvmVendor.OPENJDK
}

object OpenJdk8 : Jvm {
    override val version: JvmVersion
        get() = JvmVersion.JAVA_8
    override val vendor: JvmVendor
        get() = JvmVendor.OPENJDK
}

object OpenJdk11 : Jvm {
    override val version: JvmVersion
        get() = JvmVersion.JAVA_11
    override val vendor: JvmVendor
        get() = JvmVendor.OPENJDK
}

object OpenJdk17 : Jvm {