MyFavMirrors/minio
1
0
Fork 0
mirror of https://github.com/minio/minio.git synced 2025-04-23 11:55:47 -04:00
Code Issues Packages Projects Releases Wiki Activity

fix: allow accountInfo with creds with parentUsers (#11568)

Browse Source
This commit is contained in:
Harshavardhana 2021-02-17 20:57:17 -08:00 committed by GitHub
parent 55037e6e54
commit 95e0acbb26
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 20 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
cmd/admin-handlers-users.go
View File

@ -725,10 +725,6 @@ func (a adminAPIHandlers) AccountInfoHandler(w http.ResponseWriter, r *http.Requ
} }
accountName := cred.AccessKey accountName := cred.AccessKey
if cred.ParentUser != "" {
accountName = cred.ParentUser
}
policies, err := globalIAMSys.PolicyDBGet(accountName, false) policies, err := globalIAMSys.PolicyDBGet(accountName, false)
if err != nil { if err != nil {
logger.LogIf(ctx, err) logger.LogIf(ctx, err)

26
cmd/iam.go
View File

@ -1703,27 +1703,41 @@ func (sys *IAMSys) PolicyDBGet(name string, isGroup bool) ([]string, error) {
// This call assumes that caller has the sys.RLock() // This call assumes that caller has the sys.RLock()
func (sys *IAMSys) policyDBGet(name string, isGroup bool) ([]string, error) { func (sys *IAMSys) policyDBGet(name string, isGroup bool) ([]string, error) {
if isGroup { if isGroup {
if _, ok := sys.iamGroupsMap[name]; !ok { g, ok := sys.iamGroupsMap[name]
if !ok {
return nil, errNoSuchGroup return nil, errNoSuchGroup
} }
// Group is disabled, so we return no policy - this
// ensures the request is denied.
if g.Status == statusDisabled {
return nil, nil
}
mp := sys.iamGroupPolicyMap[name] mp := sys.iamGroupPolicyMap[name]
return mp.toSlice(), nil return mp.toSlice(), nil
} }
// When looking for a user's policies, we also check if the // When looking for a user's policies, we also check if the
// user and the groups they are member of are enabled. // user and the groups they are member of are enabled.
if u, ok := sys.iamUsersMap[name]; !ok { u, ok := sys.iamUsersMap[name]
if !ok {
return nil, errNoSuchUser return nil, errNoSuchUser
} else if u.Status == statusDisabled { }
// User is disabled, so we return no policy - this
// ensures the request is denied. if !u.IsValid() {
return nil, nil return nil, nil
} }
var policies []string var policies []string
mp := sys.iamUserPolicyMap[name] mp, ok := sys.iamUserPolicyMap[name]
if !ok {
if u.ParentUser != "" {
mp = sys.iamUserPolicyMap[u.ParentUser]
}
}
// returned policy could be empty // returned policy could be empty
policies = append(policies, mp.toSlice()...) policies = append(policies, mp.toSlice()...)