mirror of
https://github.com/minio/minio.git
synced 2024-12-24 06:05:55 -05:00
fix: STS creds without "aud" should be honored with STS checks (#8868)
Fixes #8865
This commit is contained in:
parent
55063906b5
commit
fe5d599802
@ -1367,8 +1367,13 @@ func (sys *IAMSys) IsAllowed(args iampolicy.Args) bool {
|
||||
return true
|
||||
}
|
||||
|
||||
// With claims set, we should do STS related checks and validation.
|
||||
if _, ok := args.Claims["aud"]; ok {
|
||||
// If the credential is temporary, perform STS related checks.
|
||||
ok, err := sys.IsTempUser(args.AccountName)
|
||||
if err != nil {
|
||||
logger.LogIf(context.Background(), err)
|
||||
return false
|
||||
}
|
||||
if ok {
|
||||
return sys.IsAllowedSTS(args)
|
||||
}
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user