MyFavMirrors/minio
1
0
Fork 0
mirror of https://github.com/minio/minio.git synced 2025-01-13 16:03:21 -05:00
Code Issues Packages Projects Releases Wiki Activity

support LDAP service accounts via SFTP, FTP logins (#18599)

Browse Source
This commit is contained in:
Harshavardhana 2023-12-06 04:31:35 -08:00 committed by GitHub
parent e99a597899
commit 4bc5ed6c76
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 150 additions and 104 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
cmd/ftp-server-driver.go
View File

@ -248,6 +248,11 @@ func (driver *ftpDriver) CheckPasswd(c *ftp.Context, username, password string)
defer stopFn(err) defer stopFn(err)
if globalIAMSys.LDAPConfig.Enabled() { if globalIAMSys.LDAPConfig.Enabled() {
sa, _, err := globalIAMSys.getServiceAccount(context.Background(), username)
if err != nil && !errors.Is(err, errNoSuchServiceAccount) {
return false, err
}
if errors.Is(err, errNoSuchServiceAccount) {
ldapUserDN, groupDistNames, err := globalIAMSys.LDAPConfig.Bind(username, password) ldapUserDN, groupDistNames, err := globalIAMSys.LDAPConfig.Bind(username, password)
if err != nil { if err != nil {
return false, err return false, err
@ -255,6 +260,8 @@ func (driver *ftpDriver) CheckPasswd(c *ftp.Context, username, password string)
ldapPolicies, _ := globalIAMSys.PolicyDBGet(ldapUserDN, groupDistNames...) ldapPolicies, _ := globalIAMSys.PolicyDBGet(ldapUserDN, groupDistNames...)
return len(ldapPolicies) > 0, nil return len(ldapPolicies) > 0, nil
} }
return subtle.ConstantTimeCompare([]byte(sa.Credentials.SecretKey), []byte(password)) == 1, nil
}
ui, ok := globalIAMSys.GetUser(context.Background(), username) ui, ok := globalIAMSys.GetUser(context.Background(), username)
if !ok { if !ok {
@ -269,6 +276,13 @@ func (driver *ftpDriver) getMinIOClient(ctx *ftp.Context) (*minio.Client, error)
return nil, errNoSuchUser return nil, errNoSuchUser
} }
if !ok && globalIAMSys.LDAPConfig.Enabled() { if !ok && globalIAMSys.LDAPConfig.Enabled() {
sa, _, err := globalIAMSys.getServiceAccount(context.Background(), ctx.Sess.LoginUser())
if err != nil && !errors.Is(err, errNoSuchServiceAccount) {
return nil, err
}
var mcreds *credentials.Credentials
if errors.Is(err, errNoSuchServiceAccount) {
targetUser, targetGroups, err := globalIAMSys.LDAPConfig.LookupUserDN(ctx.Sess.LoginUser()) targetUser, targetGroups, err := globalIAMSys.LDAPConfig.LookupUserDN(ctx.Sess.LoginUser())
if err != nil { if err != nil {
return nil, err return nil, err
@ -319,8 +333,13 @@ func (driver *ftpDriver) getMinIOClient(ctx *ftp.Context) (*minio.Client, error)
UpdatedAt: updatedAt, UpdatedAt: updatedAt,
})) }))
mcreds = credentials.NewStaticV4(cred.AccessKey, cred.SecretKey, cred.SessionToken)
} else {
mcreds = credentials.NewStaticV4(sa.Credentials.AccessKey, sa.Credentials.SecretKey, "")
}
return minio.New(driver.endpoint, &minio.Options{ return minio.New(driver.endpoint, &minio.Options{
Creds: credentials.NewStaticV4(cred.AccessKey, cred.SecretKey, cred.SessionToken), Creds: mcreds,
Secure: globalIsTLS, Secure: globalIsTLS,
Transport: globalRemoteFTPClientTransport, Transport: globalRemoteFTPClientTransport,
}) })

13
cmd/sftp-server-driver.go
View File

@ -93,6 +93,12 @@ func (f *sftpDriver) getMinIOClient() (*minio.Client, error) {
return nil, errNoSuchUser return nil, errNoSuchUser
} }
if !ok && globalIAMSys.LDAPConfig.Enabled() { if !ok && globalIAMSys.LDAPConfig.Enabled() {
sa, _, err := globalIAMSys.getServiceAccount(context.Background(), f.AccessKey())
if err != nil && !errors.Is(err, errNoSuchServiceAccount) {
return nil, err
}
var mcreds *credentials.Credentials
if errors.Is(err, errNoSuchServiceAccount) {
targetUser, targetGroups, err := globalIAMSys.LDAPConfig.LookupUserDN(f.AccessKey()) targetUser, targetGroups, err := globalIAMSys.LDAPConfig.LookupUserDN(f.AccessKey())
if err != nil { if err != nil {
return nil, err return nil, err
@ -140,8 +146,13 @@ func (f *sftpDriver) getMinIOClient() (*minio.Client, error) {
UpdatedAt: updatedAt, UpdatedAt: updatedAt,
})) }))
mcreds = credentials.NewStaticV4(cred.AccessKey, cred.SecretKey, cred.SessionToken)
} else {
mcreds = credentials.NewStaticV4(sa.Credentials.AccessKey, sa.Credentials.SecretKey, "")
}
return minio.New(f.endpoint, &minio.Options{ return minio.New(f.endpoint, &minio.Options{
Creds: credentials.NewStaticV4(cred.AccessKey, cred.SecretKey, cred.SessionToken), Creds: mcreds,
Secure: globalIsTLS, Secure: globalIsTLS,
Transport: globalRemoteFTPClientTransport, Transport: globalRemoteFTPClientTransport,
}) })

16
cmd/sftp-server.go
View File

@ -20,6 +20,7 @@ package cmd
import ( import (
"context" "context"
"crypto/subtle" "crypto/subtle"
"errors"
"fmt" "fmt"
"net" "net"
"os" "os"
@ -110,6 +111,11 @@ func startSFTPServer(c *cli.Context) {
sshConfig := &ssh.ServerConfig{ sshConfig := &ssh.ServerConfig{
PasswordCallback: func(c ssh.ConnMetadata, pass []byte) (*ssh.Permissions, error) { PasswordCallback: func(c ssh.ConnMetadata, pass []byte) (*ssh.Permissions, error) {
if globalIAMSys.LDAPConfig.Enabled() { if globalIAMSys.LDAPConfig.Enabled() {
sa, _, err := globalIAMSys.getServiceAccount(context.Background(), c.User())
if err != nil && !errors.Is(err, errNoSuchServiceAccount) {
return nil, err
}
if errors.Is(err, errNoSuchServiceAccount) {
targetUser, targetGroups, err := globalIAMSys.LDAPConfig.Bind(c.User(), string(pass)) targetUser, targetGroups, err := globalIAMSys.LDAPConfig.Bind(c.User(), string(pass))
if err != nil { if err != nil {
return nil, err return nil, err
@ -126,6 +132,16 @@ func startSFTPServer(c *cli.Context) {
Extensions: make(map[string]string), Extensions: make(map[string]string),
}, nil }, nil
} }
if subtle.ConstantTimeCompare([]byte(sa.Credentials.SecretKey), pass) == 1 {
return &ssh.Permissions{
CriticalOptions: map[string]string{
"accessKey": c.User(),
},
Extensions: make(map[string]string),
}, nil
}
return nil, errAuthentication
}
ui, ok := globalIAMSys.GetUser(context.Background(), c.User()) ui, ok := globalIAMSys.GetUser(context.Background(), c.User())
if !ok { if !ok {