MyFavMirrors/minio
1
0
Fork 0
mirror of https://github.com/minio/minio.git synced 2025-03-31 09:43:43 -04:00
Code Issues Packages Projects Releases Wiki Activity

fix: openID cleanup all creds associated with OIDC user (#12758)

Browse Source
This commit is contained in:
Aditya Manthramurthy 2021-07-20 17:42:10 -07:00 committed by GitHub
parent d0963974a5
commit e7a4967726
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
cmd/iam.go
View File

@ -1527,20 +1527,20 @@ func (sys *IAMSys) loadUserFromStore(accessKey string) {
// by checking remote IDP if the relevant users are still active and present. // by checking remote IDP if the relevant users are still active and present.
func (sys *IAMSys) purgeExpiredCredentialsForExternalSSO(ctx context.Context) { func (sys *IAMSys) purgeExpiredCredentialsForExternalSSO(ctx context.Context) {
sys.store.lock() sys.store.lock()
parentUsersMap := make(map[string]auth.Credentials, len(sys.iamUsersMap)) parentUsersMap := make(map[string][]auth.Credentials, len(sys.iamUsersMap))
for _, cred := range sys.iamUsersMap { for _, cred := range sys.iamUsersMap {
if cred.IsServiceAccount() || cred.IsTemp() { if cred.IsServiceAccount() || cred.IsTemp() {
userid, err := parseOpenIDParentUser(cred.ParentUser) userid, err := parseOpenIDParentUser(cred.ParentUser)
if err == errSkipFile { if err == errSkipFile {
continue continue
} }
parentUsersMap[userid] = cred parentUsersMap[userid] = append(parentUsersMap[userid], cred)
} }
} }
sys.store.unlock() sys.store.unlock()
expiredUsers := make([]auth.Credentials, 0, len(parentUsersMap)) expiredUsers := make([]auth.Credentials, 0, len(parentUsersMap))
for userid, cred := range parentUsersMap { for userid, creds := range parentUsersMap {
u, err := globalOpenIDConfig.LookupUser(userid) u, err := globalOpenIDConfig.LookupUser(userid)
if err != nil { if err != nil {
logger.LogIf(GlobalContext, err) logger.LogIf(GlobalContext, err)
@ -1548,7 +1548,7 @@ func (sys *IAMSys) purgeExpiredCredentialsForExternalSSO(ctx context.Context) {
} }
// Disabled parentUser purge the entries locally // Disabled parentUser purge the entries locally
if !u.Enabled { if !u.Enabled {
expiredUsers = append(expiredUsers, cred) expiredUsers = append(expiredUsers, creds...)
} }
} }