MyFavMirrors/minio
1
0
Fork 0
mirror of https://github.com/minio/minio.git synced 2025-01-11 23:13:23 -05:00
Code Issues Packages Projects Releases Wiki Activity

restore rotating root credentials properly (#16812)

Browse Source
This commit is contained in:
Harshavardhana 2023-03-15 08:07:42 -07:00 committed by GitHub
parent 50dbd2cacc
commit de02eca467
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 16 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
cmd/auth-handler.go
View File

@ -207,7 +207,7 @@ func getClaimsFromTokenWithSecret(token, secret string) (map[string]interface{},
// that clients cannot decode the token using the temp // that clients cannot decode the token using the temp
// secret keys and generate an entirely new claim by essentially // secret keys and generate an entirely new claim by essentially
// hijacking the policies. We need to make sure that this is // hijacking the policies. We need to make sure that this is
// based an admin credential such that token cannot be decoded // based on admin credential such that token cannot be decoded
// on the client side and is treated like an opaque value. // on the client side and is treated like an opaque value.
claims, err := auth.ExtractClaims(token, secret) claims, err := auth.ExtractClaims(token, secret)
if err != nil { if err != nil {

7
cmd/iam-etcd-store.go
View File

@ -248,6 +248,13 @@ func (ies *IAMEtcdStore) addUser(ctx context.Context, user string, userType IAMU
if u.Credentials.SessionToken != "" { if u.Credentials.SessionToken != "" {
jwtClaims, err := extractJWTClaims(u) jwtClaims, err := extractJWTClaims(u)
if err != nil { if err != nil {
if u.Credentials.IsTemp() {
// We should delete such that the client can re-request
// for the expiring credentials.
deleteKeyEtcd(ctx, ies.client, getUserIdentityPath(user, userType))
deleteKeyEtcd(ctx, ies.client, getMappedPolicyPath(user, userType, false))
return nil
}
return err return err
} }
u.Credentials.Claims = jwtClaims.Map() u.Credentials.Claims = jwtClaims.Map()

8
cmd/iam-object-store.go
View File

@ -187,7 +187,15 @@ func (iamOS *IAMObjectStore) loadUser(ctx context.Context, user string, userType
if u.Credentials.SessionToken != "" { if u.Credentials.SessionToken != "" {
jwtClaims, err := extractJWTClaims(u) jwtClaims, err := extractJWTClaims(u)
if err != nil { if err != nil {
if u.Credentials.IsTemp() {
// We should delete such that the client can re-request
// for the expiring credentials.
iamOS.deleteIAMConfig(ctx, getUserIdentityPath(user, userType))
iamOS.deleteIAMConfig(ctx, getMappedPolicyPath(user, userType, false))
return nil
}
return err return err
} }
u.Credentials.Claims = jwtClaims.Map() u.Credentials.Claims = jwtClaims.Map()
} }