Repository: minio/minio (language: go)

Issue:
Infinite Policies, Access Keys and Identity loading
## Expected Behavior
<!--- If you're describing a bug, tell us what should happen -->
<!--- If you're suggesting a change/improvement, tell us how it should work -->
Using `MinIO Console`, I should be able to edit `Access Keys`, `Policies` and `Identity` categories.

## Current Behavior
<!--- If describing a bug, tell us what happens instead of the expected behavior -->
<!--- If suggesting a change/improvement, explain the difference from current behavior -->
- `Identity/Users` shows a long loader, then an `Error 504.`
- `Identity/Groups` behaviour is the same
- `Policies` behaviour is the same
- `Access Keys` shows a long loader, then assumes that no access keys are present. Upon creation of a key, clicking `Create` does nothing

## Possible Solution
<!--- Not obligatory, but suggest a fix/reason for the bug, -->
<!--- or ideas how to implement the addition or change -->
Remove any MinIO config files and allow it to recreate them.

## Steps to Reproduce (for bugs)
<!--- Provide a link to a live example, or an unambiguous set of steps to -->
<!--- reproduce this bug. Include code to reproduce, if relevant -->
<!--- and make sure you have followed https://github.com/minio/minio/tree/release/docs/debugging to capture relevant logs -->

1. Start a new MinIO server container using all the `Quick Start` guide parameters.
2. Login as a root user with default credentials, create a policy, a group and a bucket.
3. Logged as the created user, upload some files to the bucket.
4. Remove the MinIO server container, not removing the Docker volume that was created previously (with already uploaded files).
5. Start a new MinIO server container, changing the `MINIO_ROOT_USER` and `MINIO_ROOT_PASSWORD` envs and using previously created volume for `/data`.
6. Login as a root user, not being able to change anything.

## Context
<!--- How has this issue affected you? What are you trying to accomplish? -->
<!--- Providing context helps us come up with a solution that is most useful in the real world -->
I was trying to rebuild a Docker image with different root user credentials, keeping the volume with my files. Seems like the volume still has an old config, that I want to rebuild anew. Only thing that I can do now is to remove everything completely and spend another night uploading everything again.

## Regression
<!-- Is this issue a regression? (Yes / No) -->
<!-- If Yes, optionally please include minio version or commit id or PR# that caused this regression, if you have these details. -->
No

## Your Environment
<!--- Include as many relevant details about the environment you experienced the bug in -->
* Version used (`minio --version`): 
```
minio version RELEASE.2023-03-13T19-46-17Z (commit-id=c7f7e67a100ce35af559e3f49a2ed0b67deaa919)
Runtime: go1.19.7 linux/amd64
License: GNU AGPLv3 <https://www.gnu.org/licenses/agpl-3.0.html>
Copyright: 2015-2023 MinIO, Inc.
```
* Server setup and configuration:
Home server with an FX-4300 CPU
Docker with Portainer, everything up to date
* Operating System and version (`uname -a`):
`Linux nas 5.10.0-19-amd64 #1 SMP Debian 5.10.149-2 (2022-10-21) x86_64 GNU/Linux`


Discussion / hints:
This is actually a bug, we shouldn't be relying on changing root credentials. Looks like some  credential logic code is relying on the admin secret key.
Forgot to provide a log output:
```
API: SYSTEM()
Time: 18:38:12 UTC 03/14/2023
DeploymentID: 9e92bc03-7fe6-42cf-be2b-09191416ca4b
Error: Failure in periodic refresh for IAM (took 0.01s): signature is invalid (*errors.errorString)
       2: internal/logger/logger.go:258:logger.LogIf()
       1: cmd/iam.go:466:cmd.(*IAMSys).watch()
```
yeah, I reproduced it @milkywayfarer this is actually wrong and unexpected. Possibly a regression. 
This is because of service accounts supporting expiration #16430 - regression from this PR.

Fix patch:
diff --git a/cmd/auth-handler.go b/cmd/auth-handler.go
index 7214ed645a517..addf5a7b79a2e 100644
--- a/cmd/auth-handler.go
+++ b/cmd/auth-handler.go
@@ -207,7 +207,7 @@ func getClaimsFromTokenWithSecret(token, secret string) (map[string]interface{},
 	// that clients cannot decode the token using the temp
 	// secret keys and generate an entirely new claim by essentially
 	// hijacking the policies. We need to make sure that this is
-	// based an admin credential such that token cannot be decoded
+	// based on admin credential such that token cannot be decoded
 	// on the client side and is treated like an opaque value.
 	claims, err := auth.ExtractClaims(token, secret)
 	if err != nil {
diff --git a/cmd/iam-etcd-store.go b/cmd/iam-etcd-store.go
index 52d4bc56efdf5..e688f7c36d0ec 100644
--- a/cmd/iam-etcd-store.go
+++ b/cmd/iam-etcd-store.go
@@ -248,6 +248,13 @@ func (ies *IAMEtcdStore) addUser(ctx context.Context, user string, userType IAMU
 	if u.Credentials.SessionToken != "" {
 		jwtClaims, err := extractJWTClaims(u)
 		if err != nil {
+			if u.Credentials.IsTemp() {
+				// We should delete such that the client can re-request
+				// for the expiring credentials.
+				deleteKeyEtcd(ctx, ies.client, getUserIdentityPath(user, userType))
+				deleteKeyEtcd(ctx, ies.client, getMappedPolicyPath(user, userType, false))
+				return nil
+			}
 			return err
 		}
 		u.Credentials.Claims = jwtClaims.Map()
diff --git a/cmd/iam-object-store.go b/cmd/iam-object-store.go
index e61450eb71bce..fc2ad9b40c33d 100644
--- a/cmd/iam-object-store.go
+++ b/cmd/iam-object-store.go
@@ -187,7 +187,15 @@ func (iamOS *IAMObjectStore) loadUser(ctx context.Context, user string, userType
 	if u.Credentials.SessionToken != "" {
 		jwtClaims, err := extractJWTClaims(u)
 		if err != nil {
+			if u.Credentials.IsTemp() {
+				// We should delete such that the client can re-request
+				// for the expiring credentials.
+				iamOS.deleteIAMConfig(ctx, getUserIdentityPath(user, userType))
+				iamOS.deleteIAMConfig(ctx, getMappedPolicyPath(user, userType, false))
+				return nil
+			}
 			return err
+
 		}
 		u.Credentials.Claims = jwtClaims.Map()
 	}


Test patch: