MyFavMirrors/minio
1
0
Fork 0
mirror of https://github.com/minio/minio.git synced 2025-11-07 21:02:58 -05:00
Code Issues Packages Projects Releases Wiki Activity

fix: send valid claims in AuditLogs for browser requests (#9713)

Browse Source 
Additionally also fix STS logs to filter out LDAP
password to be sent out in audit logs.

Bonus fix handle the reload of users properly by
making sure to preserve the newer users during the
reload to be not invalidated.

Fixes #9707
Fixes #9644
Fixes #9651
This commit is contained in:
Harshavardhana
2020-05-27 12:38:44 -07:00
committed by GitHub
parent e5ecd20d44
commit 7cedc5369d
5 changed files with 106 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
cmd/sts-handlers.go
View File

@@ -173,7 +173,7 @@ func (sts *stsAPIHandlers) AssumeRole(w http.ResponseWriter, r *http.Request) {
}
ctx = newContext(r, w, action)
defer logger.AuditLog(w, r, action, nil)
defer stsAuditLog(w, r, action)
sessionPolicyStr := r.Form.Get(stsPolicy)
// https://docs.aws.amazon.com/STS/latest/APIReference/API_AssumeRole.html
@@ -258,6 +258,15 @@ func (sts *stsAPIHandlers) AssumeRole(w http.ResponseWriter, r *http.Request) {
writeSuccessResponseXML(w, encodeResponse(assumeRoleResponse))
}
func stsAuditLog(w http.ResponseWriter, r *http.Request, action string) {
for _, k := range []string{
stsLDAPPassword, // cleanup any passwords before sending to audit logs.
} {
r.URL.Query().Del(k)
}
logger.AuditLog(w, r, action, nil)
}
func (sts *stsAPIHandlers) AssumeRoleWithJWT(w http.ResponseWriter, r *http.Request) {
ctx := newContext(r, w, "AssumeRoleJWTCommon")
@@ -281,7 +290,7 @@ func (sts *stsAPIHandlers) AssumeRoleWithJWT(w http.ResponseWriter, r *http.Requ
}
ctx = newContext(r, w, action)
defer logger.AuditLog(w, r, action, nil)
defer stsAuditLog(w, r, action)
if globalOpenIDValidators == nil {
writeSTSErrorResponse(ctx, w, true, ErrSTSNotInitialized, errServerNotInitialized)
@@ -448,7 +457,7 @@ func (sts *stsAPIHandlers) AssumeRoleWithLDAPIdentity(w http.ResponseWriter, r *
}
ctx = newContext(r, w, action)
defer logger.AuditLog(w, r, action, nil)
defer stsAuditLog(w, r, action)
ldapUsername := r.Form.Get(stsLDAPUsername)
ldapPassword := r.Form.Get(stsLDAPPassword)