MyFavMirrors/minio
1
0
Fork 0
mirror of https://github.com/minio/minio.git synced 2025-04-04 11:50:36 -04:00
Code Issues Packages Projects Releases Wiki Activity

fix: AccountInfo API for LDAP users (#11874)

Browse Source 
Also, ensure admin APIs auth additionally validates groups
This commit is contained in:
Aditya Manthramurthy 2021-03-23 17:39:20 -07:00 committed by GitHub
parent d23485e571
commit 8adfeb0d84
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 11 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
cmd/admin-handlers-users.go
View File

@ -19,6 +19,7 @@ package cmd
import ( import (
"context" "context"
"encoding/json" "encoding/json"
"errors"
"io" "io"
"io/ioutil" "io/ioutil"
"net/http" "net/http"
@ -742,7 +743,15 @@ func (a adminAPIHandlers) AccountInfoHandler(w http.ResponseWriter, r *http.Requ
} }
accountName := cred.AccessKey accountName := cred.AccessKey
policies, err := globalIAMSys.PolicyDBGet(accountName, false) var policies []string
switch globalIAMSys.usersSysType {
case MinIOUsersSysType:
policies, err = globalIAMSys.PolicyDBGet(accountName, false)
case LDAPUsersSysType:
policies, err = globalIAMSys.PolicyDBGetLDAP(cred.ParentUser, cred.Groups...)
default:
err = errors.New("should not happen!")
}
if err != nil { if err != nil {
logger.LogIf(ctx, err) logger.LogIf(ctx, err)
writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL) writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)

1
cmd/auth-handler.go
View File

@ -162,6 +162,7 @@ func checkAdminRequestAuth(ctx context.Context, r *http.Request, action iampolic
} }
if globalIAMSys.IsAllowed(iampolicy.Args{ if globalIAMSys.IsAllowed(iampolicy.Args{
AccountName: cred.AccessKey, AccountName: cred.AccessKey,
Groups: cred.Groups,
Action: iampolicy.Action(action), Action: iampolicy.Action(action),
ConditionValues: getConditionValues(r, "", cred.AccessKey, claims), ConditionValues: getConditionValues(r, "", cred.AccessKey, claims),
IsOwner: owner, IsOwner: owner,