From c7f7e67a100ce35af559e3f49a2ed0b67deaa919 Mon Sep 17 00:00:00 2001 From: Harshavardhana Date: Mon, 13 Mar 2023 12:46:17 -0700 Subject: [PATCH] Do not allow adding root user to IAM subsystem (#16803) --- cmd/admin-handlers-users.go | 4 ++-- cmd/sts-handlers_test.go | 5 +++++ 2 files changed, 7 insertions(+), 2 deletions(-) diff --git a/cmd/admin-handlers-users.go b/cmd/admin-handlers-users.go index 05044b301..a8d75c094 100644 --- a/cmd/admin-handlers-users.go +++ b/cmd/admin-handlers-users.go @@ -431,7 +431,7 @@ func (a adminAPIHandlers) AddUser(w http.ResponseWriter, r *http.Request) { } // Not allowed to add a user with same access key as root credential - if owner && accessKey == cred.AccessKey { + if accessKey == globalActiveCred.AccessKey { writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrAddUserInvalidArgument), r.URL) return } @@ -2297,7 +2297,7 @@ func (a adminAPIHandlers) ImportIAM(w http.ResponseWriter, r *http.Request) { } for accessKey, ureq := range userAccts { // Not allowed to add a user with same access key as root credential - if owner && accessKey == cred.AccessKey { + if accessKey == globalActiveCred.AccessKey { writeErrorResponseJSON(ctx, w, importErrorWithAPIErr(ctx, ErrAddUserInvalidArgument, err, allUsersFile, accessKey), r.URL) return } diff --git a/cmd/sts-handlers_test.go b/cmd/sts-handlers_test.go index 77306ac48..afb905813 100644 --- a/cmd/sts-handlers_test.go +++ b/cmd/sts-handlers_test.go @@ -627,6 +627,11 @@ func (s *TestSuiteIAM) TestSTSForRoot(c *check) { if !gotBuckets.Equals(shouldHaveBuckets) { c.Fatalf("root user should have access to all buckets") } + + // This must fail. + if err := userAdmClient.AddUser(ctx, globalActiveCred.AccessKey, globalActiveCred.SecretKey); err == nil { + c.Fatal("AddUser() for root credential must fail via root STS creds") + } } // SetUpLDAP - expects to setup an LDAP test server using the test LDAP