MyFavMirrors/minio
1
0
Fork 0
mirror of https://github.com/minio/minio.git synced 2025-11-07 21:02:58 -05:00
Code Issues Packages Projects Releases Wiki Activity

allow JWT parsing on large session policy based tokens (#17167)

Browse Source
This commit is contained in:
Harshavardhana
2023-05-09 00:53:08 -07:00
committed by GitHub
parent 57acacd5a7
commit a7f266c907
6 changed files with 19 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
cmd/iam-store.go
View File

@@ -27,7 +27,6 @@ import (
"strings"
"time"
"github.com/dustin/go-humanize"
jsoniter "github.com/json-iterator/go"
"github.com/minio/madmin-go/v2"
"github.com/minio/minio-go/v7/pkg/set"
@@ -2221,13 +2220,13 @@ func (store *IAMStoreSys) UpdateServiceAccount(ctx context.Context, accessKey st
delete(m, sessionPolicyNameExtracted)
// sessionPolicy is nil and there is embedded policy attached we remove
// rembedded policy at that point.
// embedded policy at that point.
if _, ok := m[iampolicy.SessionPolicyName]; ok && opts.sessionPolicy == nil {
delete(m, iampolicy.SessionPolicyName)
m[iamPolicyClaimNameSA()] = inheritedPolicyType
}
if opts.sessionPolicy != nil {
if opts.sessionPolicy != nil { // session policies is being updated
if err := opts.sessionPolicy.Validate(); err != nil {
return updatedAt, err
}
@@ -2237,8 +2236,8 @@ func (store *IAMStoreSys) UpdateServiceAccount(ctx context.Context, accessKey st
return updatedAt, err
}
if len(policyBuf) > 16*humanize.KiByte {
return updatedAt, fmt.Errorf("Session policy should not exceed 16 KiB characters")
if len(policyBuf) > 2048 {
return updatedAt, errSessionPolicyTooLarge
}
// Overwrite session policy claims.