MyFavMirrors/minio
1
0
Fork 0
mirror of https://github.com/minio/minio.git synced 2025-11-07 12:52:58 -05:00
Code Issues Packages Projects Releases Wiki Activity

fix: more regressions listing policy mappings (#18060)

Browse Source 
also relax ListServiceAccounts() returning error if
no service accounts exist.
This commit is contained in:
Harshavardhana
2023-09-19 15:22:25 -07:00
parent fcfadb0e51
commit 9081346c40
5 changed files with 104 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files

75
cmd/iam-store.go
View File

@@ -958,13 +958,12 @@ func (store *IAMStoreSys) PolicyDBUpdate(ctx context.Context, name string, isGro
var mp MappedPolicy
if !isGroup {
if userType == stsUser {
var ok bool
mp, ok = cache.iamSTSPolicyMap[name]
if !ok {
// Attempt to load parent user mapping for STS accounts
store.loadMappedPolicy(context.TODO(), name, stsUser, false, cache.iamSTSPolicyMap)
mp = cache.iamSTSPolicyMap[name]
}
stsMap := map[string]MappedPolicy{}
// Attempt to load parent user mapping for STS accounts
store.loadMappedPolicy(context.TODO(), name, stsUser, false, stsMap)
mp = stsMap[name]
} else {
mp = cache.iamUserPolicyMap[name]
}
@@ -1888,6 +1887,25 @@ func (store *IAMStoreSys) listUserPolicyMappings(cache *iamCache, users []string
})
}
stsMap := map[string]MappedPolicy{}
for _, user := range users {
// Attempt to load parent user mapping for STS accounts
store.loadMappedPolicy(context.TODO(), user, stsUser, false, stsMap)
}
for user, mappedPolicy := range stsMap {
if userPredicate != nil && !userPredicate(user) {
continue
}
ps := mappedPolicy.toSlice()
sort.Strings(ps)
r = append(r, madmin.UserPolicyEntities{
User: user,
Policies: ps,
})
}
sort.Slice(r, func(i, j int) bool {
return r[i].User < r[j].User
})
@@ -1952,6 +1970,32 @@ func (store *IAMStoreSys) listPolicyMappings(cache *iamCache, policies []string,
}
}
if iamOS, ok := store.IAMStorageAPI.(*IAMObjectStore); ok {
for item := range listIAMConfigItems(context.Background(), iamOS.objAPI, iamConfigPrefix+SlashSeparator+policyDBSTSUsersListKey) {
user := strings.TrimSuffix(item.Item, ".json")
if userPredicate != nil && !userPredicate(user) {
continue
}
var mappedPolicy MappedPolicy
store.loadIAMConfig(context.Background(), &mappedPolicy, getMappedPolicyPath(user, stsUser, false))
commonPolicySet := mappedPolicy.policySet()
if !queryPolSet.IsEmpty() {
commonPolicySet = commonPolicySet.Intersection(queryPolSet)
}
for _, policy := range commonPolicySet.ToSlice() {
s, ok := policyToUsersMap[policy]
if !ok {
policyToUsersMap[policy] = set.CreateStringSet(user)
} else {
s.Add(user)
policyToUsersMap[policy] = s
}
}
}
}
policyToGroupsMap := make(map[string]set.StringSet)
for group, mappedPolicy := range cache.iamGroupPolicyMap {
if groupPredicate != nil && !groupPredicate(group) {
@@ -2243,19 +2287,10 @@ func (store *IAMStoreSys) ListServiceAccounts(ctx context.Context, accessKey str
cache := store.rlock()
defer store.runlock()
userExists := false
var serviceAccounts []auth.Credentials
for _, u := range cache.iamUsersMap {
isDerived := false
v := u.Credentials
if v.IsServiceAccount() || v.IsTemp() {
isDerived = true
}
if !isDerived && v.AccessKey == accessKey {
userExists = true
} else if isDerived && v.ParentUser == accessKey {
userExists = true
if accessKey != "" && v.ParentUser == accessKey {
if v.IsServiceAccount() {
// Hide secret key & session key here
v.SecretKey = ""
@@ -2265,12 +2300,6 @@ func (store *IAMStoreSys) ListServiceAccounts(ctx context.Context, accessKey str
}
}
// If root user has no STS/Service Accounts, userExists would be false here,
// so we handle this exception.
if !userExists && globalActiveCred.AccessKey != accessKey {
return nil, errNoSuchUser
}
return serviceAccounts, nil
}