iam: Do not create service accounts for non existant IAM users (#12236)

When running MinIO server without LDAP/OpenID, we should error out when
the code tries to create a service account for a non existant regular
user.

Bonus: refactor the check code to be show all cases more clearly

Signed-off-by: Anis Elleuch <anis@min.io>

Co-authored-by: Anis Elleuch <anis@min.io>

cmd/iam.go

@@ -1114,31 +1114,35 @@ func (sys *IAMSys) NewServiceAccount(ctx context.Context, parentUser string, gro
 	sys.store.lock()
 	defer sys.store.unlock()
 
-	cr, ok := sys.iamUsersMap[parentUser]
+	cr, found := sys.iamUsersMap[parentUser]
-	if !ok {
+	switch {
-		// For LDAP/OpenID users we would need this fallback
+	// User found
-		if sys.usersSysType != MinIOUsersSysType && parentUser != globalActiveCred.ParentUser {
+	case found:
-			_, ok = sys.iamUserPolicyMap[parentUser]
+		// Disallow service accounts to further create more service accounts.
-			if !ok {
+		if cr.IsServiceAccount() {
-				var found bool
+			return auth.Credentials{}, errIAMActionNotAllowed
-				for _, group := range groups {
+		}
-					_, ok = sys.iamGroupPolicyMap[group]
+	// Allow creating service accounts for root user
-					if !ok {
+	case parentUser == globalActiveCred.AccessKey:
-						continue
+	// For LDAP/OpenID users we would need this fallback
-					}
+	case sys.usersSysType != MinIOUsersSysType:
-					found = true
+		_, ok := sys.iamUserPolicyMap[parentUser]
-					break
+		if !ok {
-				}
+			var groupHasPolicy bool
-				if !found {
+			for _, group := range groups {
-					return auth.Credentials{}, errNoSuchUser
+				_, ok = sys.iamGroupPolicyMap[group]
+				if !ok {
+					continue
 				}
+				groupHasPolicy = true
+				break
+			}
+			if !groupHasPolicy {
+				return auth.Credentials{}, errNoSuchUser
 			}
 		}
-	}
+	default:
-
+		return auth.Credentials{}, errNoSuchUser
-	// Disallow service accounts to further create more service accounts.
-	if cr.IsServiceAccount() {
-		return auth.Credentials{}, errIAMActionNotAllowed
 	}
 
 	m := make(map[string]interface{})