MyFavMirrors/minio
1
0
Fork 0
mirror of https://github.com/minio/minio.git synced 2025-01-25 13:43:17 -05:00
Code Issues Packages Projects Releases Wiki Activity

Validate if parent user exists for service acct (#16443)

Browse Source
This commit is contained in:
Poorna 2023-01-23 18:47:18 -08:00 committed by GitHub
parent 3683673fb0
commit 93fbb228bf
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 13 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
cmd/admin-handlers-users.go
View File

@ -21,6 +21,7 @@ import (
"bytes" "bytes"
"encoding/json" "encoding/json"
"errors" "errors"
"fmt"
"io" "io"
"net/http" "net/http"
"os" "os"
@ -680,6 +681,17 @@ func (a adminAPIHandlers) AddServiceAccount(w http.ResponseWriter, r *http.Reque
requestorIsDerivedCredential = true requestorIsDerivedCredential = true
} }
if globalIAMSys.GetUsersSysType() == MinIOUsersSysType && targetUser != cred.AccessKey {
// For internal IDP, ensure that the targetUser's parent account exists.
// It could be a regular user account or the root account.
_, isRegularUser := globalIAMSys.GetUser(ctx, targetUser)
if !isRegularUser && targetUser != globalActiveCred.AccessKey {
writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx,
fmt.Errorf("parent user %s does not exist. Cannot create service account", targetUser)), r.URL)
return
}
}
// Check if we are creating svc account for request sender. // Check if we are creating svc account for request sender.
isSvcAccForRequestor := false isSvcAccForRequestor := false
if targetUser == requestorUser || targetUser == requestorParentUser { if targetUser == requestorUser || targetUser == requestorParentUser {

2
cmd/admin-handlers-users_test.go
View File

@ -1136,7 +1136,7 @@ func (s *TestSuiteIAM) TestAccMgmtPlugin(c *check) {
c.assertSvcAccDeletion(ctx, s, userAdmClient, accessKey, bucket) c.assertSvcAccDeletion(ctx, s, userAdmClient, accessKey, bucket)
// 6. Check that service account **can** be created for some other user. // 6. Check that service account **can** be created for some other user.
// This is possible because of the policy enforced in the plugin. // This is possible because the policy enforced in the plugin.
c.mustCreateSvcAccount(ctx, globalActiveCred.AccessKey, userAdmClient) c.mustCreateSvcAccount(ctx, globalActiveCred.AccessKey, userAdmClient)
} }