fix: LDAP authentication with groups only (#12283)

fixes #12282

cmd/admin-handlers-users.go

@@ -523,6 +523,7 @@ func (a adminAPIHandlers) AddServiceAccount(w http.ResponseWriter, r *http.Reque
 			return
 		}
 		// targerUser is set to bindDN at this point in time.
+		// targetGroups is set to the groups at this point in time.
 	} else {
 		if cred.IsServiceAccount() || cred.IsTemp() {
 			if cred.ParentUser == "" {
@@ -534,8 +535,11 @@ func (a adminAPIHandlers) AddServiceAccount(w http.ResponseWriter, r *http.Reque
 				targetUser = cred.ParentUser
 			}
 		}
+		// targetGroups not yet set, so set this to cred.Groups
+		if len(targetGroups) == 0 {
 			targetGroups = cred.Groups
 		}
+	}
 
 	var sp *iampolicy.Policy
 	if len(createReq.Policy) > 0 {

cmd/iam.go

@@ -1502,21 +1502,23 @@ func (sys *IAMSys) GetUser(accessKey string) (cred auth.Credentials, ok bool) {
 
 	if ok && cred.IsValid() {
 		if cred.IsServiceAccount() || cred.IsTemp() {
-			// temporary credentials or service accounts
+			policies, err := sys.policyDBGet(cred.ParentUser, false)
-			// must have their parent in UsersMap
+			if err != nil {
-			if cred.ParentUser == globalActiveCred.AccessKey {
+				// Reject if the policy map for user doesn't exist anymore.
-				// parent exists, so allow temporary and service accounts.
+				logger.LogIf(context.Background(), fmt.Errorf("'%s' user does not have a policy present", cred.ParentUser))
-				ok = true
+				return auth.Credentials{}, false
-			} else {
-				_, ok = sys.iamUserPolicyMap[cred.ParentUser]
 			}
+			for _, group := range cred.Groups {
+				ps, err := sys.policyDBGet(group, true)
+				if err != nil {
+					// Reject if the policy map for group doesn't exist anymore.
+					logger.LogIf(context.Background(), fmt.Errorf("'%s' group does not have a policy present", group))
+					return auth.Credentials{}, false
+				}
+				policies = append(policies, ps...)
+			}
+			ok = len(policies) > 0
 		}
-		// for LDAP service accounts with ParentUser set
-		// we have no way to validate, either because user
-		// doesn't need an explicit policy as it can come
-		// automatically from a group. We are safe to ignore
-		// this and continue as policies would fail eventually
-		// the policies are missing or not configured.
 	}
 	return cred, ok && cred.IsValid()
 }