MyFavMirrors/minio
1
0
Fork 0
mirror of https://github.com/minio/minio.git synced 2025-01-25 21:53:16 -05:00
Code Issues Packages Projects Releases Wiki Activity

svc: Display the correct policy of a particular service account (#12064)

Browse Source 
For InfoServiceAccount API, calculating the policy before showing it to
the user was not correctly done (only UX issue, not a security issue)

This commit fixes it.
This commit is contained in:
Anis Elleuch 2021-04-15 22:47:58 +01:00 committed by GitHub
parent 39dd9b6483
commit b6f5785a6d
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 9 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
cmd/admin-handlers-users.go
View File

@ -727,14 +727,14 @@ func (a adminAPIHandlers) InfoServiceAccount(w http.ResponseWriter, r *http.Requ
// If policy is empty, check for policy of the parent user // If policy is empty, check for policy of the parent user
if !impliedPolicy { if !impliedPolicy {
svcAccountPolicy.Merge(*policy) svcAccountPolicy = svcAccountPolicy.Merge(*policy)
} else { } else {
policiesNames, err := globalIAMSys.PolicyDBGet(svcAccount.AccessKey, false) policiesNames, err := globalIAMSys.PolicyDBGet(svcAccount.AccessKey, false)
if err != nil { if err != nil {
writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL) writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL)
return return
} }
svcAccountPolicy.Merge(globalIAMSys.GetCombinedPolicy(policiesNames...)) svcAccountPolicy = svcAccountPolicy.Merge(globalIAMSys.GetCombinedPolicy(policiesNames...))
} }
policyJSON, err := json.Marshal(svcAccountPolicy) policyJSON, err := json.Marshal(svcAccountPolicy)

11
cmd/iam.go
View File

@ -1138,7 +1138,7 @@ func (sys *IAMSys) NewServiceAccount(ctx context.Context, parentUser string, gro
} }
cred.ParentUser = parentUser cred.ParentUser = parentUser
cred.Groups = groups cred.Groups = groups
cred.Status = string(madmin.AccountEnabled) cred.Status = string(auth.AccountOn)
u := newUserIdentity(cred) u := newUserIdentity(cred)
@ -1257,10 +1257,13 @@ func (sys *IAMSys) GetServiceAccount(ctx context.Context, accessKey string) (aut
pt, ptok := jwtClaims.Lookup(iamPolicyClaimNameSA()) pt, ptok := jwtClaims.Lookup(iamPolicyClaimNameSA())
sp, spok := jwtClaims.Lookup(iampolicy.SessionPolicyName) sp, spok := jwtClaims.Lookup(iampolicy.SessionPolicyName)
if ptok && spok && pt == "embedded-policy" { if ptok && spok && pt == "embedded-policy" {
p, err := iampolicy.ParseConfig(bytes.NewReader([]byte(sp))) policyBytes, err := base64.StdEncoding.DecodeString(sp)
if err == nil { if err == nil {
embeddedPolicy = &iampolicy.Policy{} p, err := iampolicy.ParseConfig(bytes.NewReader(policyBytes))
embeddedPolicy.Merge(*p) if err == nil {
policy := iampolicy.Policy{}.Merge(*p)
embeddedPolicy = &policy
}
} }
} }
} }