MyFavMirrors/minio
1
0
Fork 0
mirror of https://github.com/minio/minio.git synced 2025-04-20 18:44:21 -04:00
Code Issues Packages Projects Releases Wiki Activity

sr: use service account cred for claims check (#19209)

Browse Source 
PR #19111 overlaid service account secret with site replicator secret
during token claims check.

Fixes : #19206
This commit is contained in:
Poorna 2024-03-06 16:19:24 -08:00 committed by GitHub
parent e91a4a414c
commit 837a2a3d4b
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 22 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
cmd/auth-handler.go
View File

@ -300,19 +300,21 @@ func checkClaimsFromToken(r *http.Request, cred auth.Credentials) (map[string]in
} }
secret := globalActiveCred.SecretKey secret := globalActiveCred.SecretKey
var err error
if globalSiteReplicationSys.isEnabled() && cred.AccessKey != siteReplicatorSvcAcc {
if cred.ParentUser != globalActiveCred.AccessKey {
secret, err = getTokenSigningKey()
if err != nil {
return nil, toAPIErrorCode(r.Context(), err)
}
}
}
if cred.IsServiceAccount() { if cred.IsServiceAccount() {
token = cred.SessionToken token = cred.SessionToken
secret = cred.SecretKey secret = cred.SecretKey
} }
if token != "" { if token != "" {
var err error
if globalSiteReplicationSys.isEnabled() && cred.AccessKey != siteReplicatorSvcAcc {
secret, err = getTokenSigningKey()
if err != nil {
return nil, toAPIErrorCode(r.Context(), err)
}
}
claims, err := getClaimsFromTokenWithSecret(token, secret) claims, err := getClaimsFromTokenWithSecret(token, secret)
if err != nil { if err != nil {
return nil, toAPIErrorCode(r.Context(), err) return nil, toAPIErrorCode(r.Context(), err)

13
docs/site-replication/run-multi-site-minio-idp.sh
View File

@ -164,8 +164,21 @@ if [ $? -ne 0 ]; then
exit_1 exit_1
fi fi
./mc admin user svcacct add minio2 minio --access-key testsvc2 --secret-key testsvc123
if [ $? -ne 0 ]; then
echo "adding root svc account testsvc2 failed, exiting.."
exit_1
fi
sleep 10 sleep 10
export MC_HOST_rootsvc=http://testsvc2:testsvc123@localhost:9002
./mc ls rootsvc
if [ $? -ne 0 ]; then
echo "root service account not inherited root permissions, exiting.."
exit_1
fi
./mc admin user svcacct info minio1 testsvc ./mc admin user svcacct info minio1 testsvc
if [ $? -ne 0 ]; then if [ $? -ne 0 ]; then
echo "svc account not mirrored, exiting.." echo "svc account not mirrored, exiting.."