MyFavMirrors/minio
1
0
Fork 0
mirror of https://github.com/minio/minio.git synced 2024-12-25 22:55:54 -05:00
Code Issues Packages Projects Releases Wiki Activity

Fix querying LDAP group/user policy (#11840)

Browse Source
This commit is contained in:
Aditya Manthramurthy 2021-03-20 02:37:52 -07:00 committed by GitHub
parent 98ff91b484
commit 94ff624242
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 24 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

38
cmd/iam.go
View File

@ -1602,6 +1602,10 @@ func (sys *IAMSys) PolicyDBSet(name, policy string, isGroup bool) error {
sys.store.lock() sys.store.lock()
defer sys.store.unlock() defer sys.store.unlock()
if sys.usersSysType == LDAPUsersSysType {
return sys.policyDBSet(name, policy, stsUser, isGroup)
}
return sys.policyDBSet(name, policy, regularUser, isGroup) return sys.policyDBSet(name, policy, regularUser, isGroup)
} }
@ -1678,15 +1682,17 @@ func (sys *IAMSys) PolicyDBGet(name string, isGroup bool) ([]string, error) {
// This call assumes that caller has the sys.RLock() // This call assumes that caller has the sys.RLock()
func (sys *IAMSys) policyDBGet(name string, isGroup bool) ([]string, error) { func (sys *IAMSys) policyDBGet(name string, isGroup bool) ([]string, error) {
if isGroup { if isGroup {
g, ok := sys.iamGroupsMap[name] if sys.usersSysType == MinIOUsersSysType {
if !ok { g, ok := sys.iamGroupsMap[name]
return nil, errNoSuchGroup if !ok {
} return nil, errNoSuchGroup
}
// Group is disabled, so we return no policy - this // Group is disabled, so we return no policy - this
// ensures the request is denied. // ensures the request is denied.
if g.Status == statusDisabled { if g.Status == statusDisabled {
return nil, nil return nil, nil
}
} }
mp := sys.iamGroupPolicyMap[name] mp := sys.iamGroupPolicyMap[name]
@ -1695,13 +1701,17 @@ func (sys *IAMSys) policyDBGet(name string, isGroup bool) ([]string, error) {
// When looking for a user's policies, we also check if the // When looking for a user's policies, we also check if the
// user and the groups they are member of are enabled. // user and the groups they are member of are enabled.
u, ok := sys.iamUsersMap[name]
if !ok {
return nil, errNoSuchUser
}
if !u.IsValid() { var u auth.Credentials
return nil, nil var ok bool
if sys.usersSysType == MinIOUsersSysType {
u, ok = sys.iamUsersMap[name]
if !ok {
return nil, errNoSuchUser
}
if !u.IsValid() {
return nil, nil
}
} }
var policies []string var policies []string