MyFavMirrors/minio
1
0
Fork 0
mirror of https://github.com/minio/minio.git synced 2025-01-11 23:13:23 -05:00
Code Issues Packages Projects Releases Wiki Activity

fix: site-repl should heal STS with virtual parent (#16792)

Browse Source
This commit is contained in:
Aditya Manthramurthy 2023-03-10 16:21:51 -08:00 committed by GitHub
parent d85da9236e
commit 6305b206e1
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 12 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
cmd/site-replication.go
View File

@ -4728,11 +4728,20 @@ func (c *SiteReplicationSys) healUsers(ctx context.Context, objAPI ObjectLayer,
continue continue
} }
if creds.IsTemp() && !creds.IsExpired() { if creds.IsTemp() && !creds.IsExpired() {
var parentPolicy string
u, err := globalIAMSys.GetUserInfo(ctx, creds.ParentUser) u, err := globalIAMSys.GetUserInfo(ctx, creds.ParentUser)
if err != nil { if err != nil {
// Parent may be "virtual" (for ldap, oidc, client tls auth,
// custom auth plugin), so in such cases we apply no parent
// policy. The session token will contain info about policy to
// be applied.
if !errors.Is(err, errNoSuchUser) {
logger.LogIf(ctx, fmt.Errorf("Unable to heal temporary credentials %s from peer site %s -> %s : %w", user, latestPeerName, peerName, err)) logger.LogIf(ctx, fmt.Errorf("Unable to heal temporary credentials %s from peer site %s -> %s : %w", user, latestPeerName, peerName, err))
continue continue
} }
} else {
parentPolicy = u.PolicyName
}
// Call hook for site replication. // Call hook for site replication.
if err := c.IAMChangeHook(ctx, madmin.SRIAMItem{ if err := c.IAMChangeHook(ctx, madmin.SRIAMItem{
Type: madmin.SRIAMItemSTSAcc, Type: madmin.SRIAMItemSTSAcc,
@ -4741,7 +4750,7 @@ func (c *SiteReplicationSys) healUsers(ctx context.Context, objAPI ObjectLayer,
SecretKey: creds.SecretKey, SecretKey: creds.SecretKey,
SessionToken: creds.SessionToken, SessionToken: creds.SessionToken,
ParentUser: creds.ParentUser, ParentUser: creds.ParentUser,
ParentPolicyMapping: u.PolicyName, ParentPolicyMapping: parentPolicy,
}, },
UpdatedAt: lastUpdate, UpdatedAt: lastUpdate,
}); err != nil { }); err != nil {