From 799691eded03fab300209fbef0f737dfcf483a0e Mon Sep 17 00:00:00 2001 From: Harshavardhana Date: Fri, 23 Apr 2021 15:11:01 -0700 Subject: [PATCH] fix: reload LDAP users properly with latest mapping (#12137) peer nodes would not update if policy is unset on a user, until policies reload every 5minutes. Make sure to reload the policies properly, if no policy is found make sure to delete such users and groups fixes #12074 Signed-off-by: Harshavardhana --- cmd/iam.go | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) diff --git a/cmd/iam.go b/cmd/iam.go index edbab64a6..47aeadc67 100644 --- a/cmd/iam.go +++ b/cmd/iam.go @@ -355,12 +355,24 @@ func (sys *IAMSys) LoadPolicyMapping(objAPI ObjectLayer, userOrGroup string, isG if globalEtcdClient == nil { var err error - if isGroup { - err = sys.store.loadMappedPolicy(context.Background(), userOrGroup, regularUser, isGroup, sys.iamGroupPolicyMap) - } else { - err = sys.store.loadMappedPolicy(context.Background(), userOrGroup, regularUser, isGroup, sys.iamUserPolicyMap) + userType := regularUser + if sys.usersSysType == LDAPUsersSysType { + userType = stsUser } + if isGroup { + err = sys.store.loadMappedPolicy(context.Background(), userOrGroup, userType, isGroup, sys.iamGroupPolicyMap) + } else { + err = sys.store.loadMappedPolicy(context.Background(), userOrGroup, userType, isGroup, sys.iamUserPolicyMap) + } + + if err == errNoSuchPolicy { + if isGroup { + delete(sys.iamGroupPolicyMap, userOrGroup) + } else { + delete(sys.iamUserPolicyMap, userOrGroup) + } + } // Ignore policy not mapped error if err != nil && err != errNoSuchPolicy { return err