From 3da7c9cce3dea46c50b53bc9a5a93ede46741d92 Mon Sep 17 00:00:00 2001 From: Anis Eleuch Date: Mon, 14 Oct 2024 16:54:46 +0100 Subject: [PATCH] repl: Fix removal of replicator svc when keycloak is configured (#120) When Keycloak vendor is set, the code will start to clean up service accounts that parents do not exist anymore. However, the code will also look for the parent user of site-replicator-0, MINIO_ROOT_USER, which obviously does not exist in Keycloak. Therefore, the site-replicator-0 will be removed automatically. This commit will avoid cleaning up service accounts generated from the root user. --- cmd/iam-store.go | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/cmd/iam-store.go b/cmd/iam-store.go index 956a41bcb..943af171b 100644 --- a/cmd/iam-store.go +++ b/cmd/iam-store.go @@ -2009,7 +2009,8 @@ type ParentUserInfo struct { // GetAllParentUsers - returns all distinct "parent-users" associated with STS // or service credentials, mapped to all distinct roleARNs associated with the // parent user. The dummy role ARN is associated with parent users from -// policy-claim based OpenID providers. +// policy-claim based OpenID providers. The root credential as a parent +// user is not included in the result. func (store *IAMStoreSys) GetAllParentUsers() map[string]ParentUserInfo { cache := store.rlock() defer store.runlock() @@ -2048,7 +2049,7 @@ func (store *IAMStoreSys) getParentUsers(cache *iamCache) map[string]ParentUserI if err != nil { continue } - if cred.ParentUser == "" { + if cred.ParentUser == "" || cred.ParentUser == globalActiveCred.AccessKey { continue }