MyFavMirrors/minio
1
0
Fork 0
mirror of https://github.com/minio/minio.git synced 2025-04-12 23:42:22 -04:00
Code Issues Packages Projects Releases Wiki Activity

Change behavior of service account empty policies (#18346)

Browse Source 
* Fix embedded/implied policy behavior

* assume implied policy if pased to empty

* fix for all

* Fix failing tests

---------

Co-authored-by: Prakash Senthil Vel <23444145+prakashsvmx@users.noreply.github.com>
This commit is contained in:
Taran Pelkey 2023-10-31 15:30:36 -04:00 committed by GitHub
parent a1792ca0d1
commit 33322e6638
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
cmd/admin-handlers-users.go
View File

@ -781,6 +781,9 @@ func (a adminAPIHandlers) AddServiceAccount(w http.ResponseWriter, r *http.Reque
writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL) writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
return return
} }
if sp.Version == "" && len(sp.Statements) == 0 {
sp = nil
}
} }
opts.sessionPolicy = sp opts.sessionPolicy = sp
@ -911,6 +914,9 @@ func (a adminAPIHandlers) UpdateServiceAccount(w http.ResponseWriter, r *http.Re
writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL) writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
return return
} }
if sp.Version == "" && len(sp.Statements) == 0 {
sp = nil
}
} }
opts := updateServiceAccountOpts{ opts := updateServiceAccountOpts{
secretKey: updateReq.NewSecretKey, secretKey: updateReq.NewSecretKey,
@ -996,9 +1002,12 @@ func (a adminAPIHandlers) InfoServiceAccount(w http.ResponseWriter, r *http.Requ
} }
} }
// if session policy is nil or empty, then it is implied policy
impliedPolicy := sessionPolicy == nil || (sessionPolicy.Version == "" && len(sessionPolicy.Statements) == 0)
var svcAccountPolicy policy.Policy var svcAccountPolicy policy.Policy
if sessionPolicy != nil { if !impliedPolicy {
svcAccountPolicy = *sessionPolicy svcAccountPolicy = *sessionPolicy
} else { } else {
policiesNames, err := globalIAMSys.PolicyDBGet(svcAccount.ParentUser, false) policiesNames, err := globalIAMSys.PolicyDBGet(svcAccount.ParentUser, false)
@ -1025,7 +1034,7 @@ func (a adminAPIHandlers) InfoServiceAccount(w http.ResponseWriter, r *http.Requ
Name: svcAccount.Name, Name: svcAccount.Name,
Description: svcAccount.Description, Description: svcAccount.Description,
AccountStatus: svcAccount.Status, AccountStatus: svcAccount.Status,
ImpliedPolicy: sessionPolicy == nil, ImpliedPolicy: impliedPolicy,
Policy: string(policyJSON), Policy: string(policyJSON),
Expiration: expiration, Expiration: expiration,
} }