MyFavMirrors/minio
1
0
Fork 0
mirror of https://github.com/minio/minio.git synced 2025-11-09 13:39:46 -05:00
Code Issues Packages Projects Releases Wiki Activity

Fix policy setting error in LDAP setups (#9303)

Browse Source 
Fixes #8667

In addition to the above, if the user is mapped to a policy or 
belongs in a group, the user-info API returns this information, 
but otherwise, the API will now return a non-existent user error.
This commit is contained in:
Aditya Manthramurthy
2020-04-09 01:04:08 -07:00
committed by GitHub
parent e20e08d700
commit 6bb693488c
2 changed files with 11 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
cmd/iam.go
View File

@@ -682,9 +682,16 @@ func (sys *IAMSys) GetUserInfo(name string) (u madmin.UserInfo, err error) {
defer sys.store.runlock()
if sys.usersSysType != MinIOUsersSysType {
// If the user has a mapped policy or is a member of a group, we
// return that info. Otherwise we return error.
mappedPolicy, ok1 := sys.iamUserPolicyMap[name]
memberships, ok2 := sys.iamUserGroupMemberships[name]
if !ok1 && !ok2 {
return u, errNoSuchUser
}
return madmin.UserInfo{
PolicyName: sys.iamUserPolicyMap[name].Policy,
MemberOf: sys.iamUserGroupMemberships[name].ToSlice(),
PolicyName: mappedPolicy.Policy,
MemberOf: memberships.ToSlice(),
}, nil
}
@@ -1176,9 +1183,7 @@ func (sys *IAMSys) ListGroups() (r []string, err error) {
return r, nil
}
// PolicyDBSet - sets a policy for a user or group in the
// PolicyDB. This function applies only long-term users. For STS
// users, policy is set directly by called sys.policyDBSet().
// PolicyDBSet - sets a policy for a user or group in the PolicyDB.
func (sys *IAMSys) PolicyDBSet(name, policy string, isGroup bool) error {
objectAPI := newObjectLayerWithoutSafeModeFn()
if objectAPI == nil || sys == nil || sys.store == nil {
@@ -1188,8 +1193,6 @@ func (sys *IAMSys) PolicyDBSet(name, policy string, isGroup bool) error {
sys.store.lock()
defer sys.store.unlock()
// isSTS is always false when called via PolicyDBSet as policy
// is never set by an external API call for STS users.
return sys.policyDBSet(name, policy, regularUser, isGroup)
}