mirror of
https://github.com/minio/minio.git
synced 2024-12-28 08:05:55 -05:00
3212d0c8cd
Existing IAM import logic for LDAP creates new mappings when the normalized form of the mapping key differs from the existing mapping key in storage. This change effectively replaces the existing mapping key by first deleting it and then recreating with the normalized form of the mapping key. For e.g. if an older deployment had a policy mapped to a user DN - `UID=alice1,OU=people,OU=hwengg,DC=min,DC=io` instead of adding a mapping for the normalized form - `uid=alice1,ou=people,ou=hwengg,dc=min,dc=io` we should replace the existing mapping. This ensures that duplicates mappings won't remain after the import. Some additional cleanup cases are also covered. If there are multiple mappings for the name normalized key such as: `UID=alice1,OU=people,OU=hwengg,DC=min,DC=io` `uid=alice1,ou=people,ou=hwengg,DC=min,DC=io` `uid=alice1,ou=people,ou=hwengg,dc=min,dc=io` we check if the list of policies mapped to all these keys are exactly the same, and if so remove all of them and create a single mapping with the normalized key. However, if the policies mapped to such keys differ, the import operation returns an error as the server cannot automatically pick the "right" list of policies to map.
129 lines
4.2 KiB
YAML
129 lines
4.2 KiB
YAML
name: IAM integration
|
|
|
|
on:
|
|
pull_request:
|
|
branches:
|
|
- master
|
|
- next
|
|
|
|
# This ensures that previous jobs for the PR are canceled when the PR is
|
|
# updated.
|
|
concurrency:
|
|
group: ${{ github.workflow }}-${{ github.head_ref }}
|
|
cancel-in-progress: true
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
jobs:
|
|
iam-matrix-test:
|
|
name: "[Go=${{ matrix.go-version }}|ldap=${{ matrix.ldap }}|etcd=${{ matrix.etcd }}|openid=${{ matrix.openid }}]"
|
|
runs-on: ubuntu-latest
|
|
|
|
services:
|
|
openldap:
|
|
image: quay.io/minio/openldap
|
|
ports:
|
|
- "389:389"
|
|
- "636:636"
|
|
env:
|
|
LDAP_ORGANIZATION: "MinIO Inc"
|
|
LDAP_DOMAIN: "min.io"
|
|
LDAP_ADMIN_PASSWORD: "admin"
|
|
etcd:
|
|
image: "quay.io/coreos/etcd:v3.5.1"
|
|
env:
|
|
ETCD_LISTEN_CLIENT_URLS: "http://0.0.0.0:2379"
|
|
ETCD_ADVERTISE_CLIENT_URLS: "http://0.0.0.0:2379"
|
|
ports:
|
|
- "2379:2379"
|
|
options: >-
|
|
--health-cmd "etcdctl endpoint health"
|
|
--health-interval 10s
|
|
--health-timeout 5s
|
|
--health-retries 5
|
|
openid:
|
|
image: quay.io/minio/dex
|
|
ports:
|
|
- "5556:5556"
|
|
env:
|
|
DEX_LDAP_SERVER: "openldap:389"
|
|
openid2:
|
|
image: quay.io/minio/dex
|
|
ports:
|
|
- "5557:5557"
|
|
env:
|
|
DEX_LDAP_SERVER: "openldap:389"
|
|
DEX_ISSUER: "http://127.0.0.1:5557/dex"
|
|
DEX_WEB_HTTP: "0.0.0.0:5557"
|
|
|
|
strategy:
|
|
# When ldap, etcd or openid vars are empty below, those external servers
|
|
# are turned off - i.e. if ldap="", then ldap server is not enabled for
|
|
# the tests.
|
|
matrix:
|
|
go-version: [1.21.x]
|
|
ldap: ["", "localhost:389"]
|
|
etcd: ["", "http://localhost:2379"]
|
|
openid: ["", "http://127.0.0.1:5556/dex"]
|
|
exclude:
|
|
# exclude combos where all are empty.
|
|
- ldap: ""
|
|
etcd: ""
|
|
openid: ""
|
|
# exclude combos where both ldap and openid IDPs are specified.
|
|
- ldap: "localhost:389"
|
|
openid: "http://127.0.0.1:5556/dex"
|
|
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: actions/setup-go@v5
|
|
with:
|
|
go-version: ${{ matrix.go-version }}
|
|
check-latest: true
|
|
- name: Test LDAP/OpenID/Etcd combo
|
|
env:
|
|
_MINIO_LDAP_TEST_SERVER: ${{ matrix.ldap }}
|
|
_MINIO_ETCD_TEST_SERVER: ${{ matrix.etcd }}
|
|
_MINIO_OPENID_TEST_SERVER: ${{ matrix.openid }}
|
|
run: |
|
|
sudo sysctl net.ipv6.conf.all.disable_ipv6=0
|
|
sudo sysctl net.ipv6.conf.default.disable_ipv6=0
|
|
make test-iam
|
|
- name: Test with multiple OpenID providers
|
|
if: matrix.openid == 'http://127.0.0.1:5556/dex'
|
|
env:
|
|
_MINIO_LDAP_TEST_SERVER: ${{ matrix.ldap }}
|
|
_MINIO_ETCD_TEST_SERVER: ${{ matrix.etcd }}
|
|
_MINIO_OPENID_TEST_SERVER: ${{ matrix.openid }}
|
|
_MINIO_OPENID_TEST_SERVER_2: "http://127.0.0.1:5557/dex"
|
|
run: |
|
|
sudo sysctl net.ipv6.conf.all.disable_ipv6=0
|
|
sudo sysctl net.ipv6.conf.default.disable_ipv6=0
|
|
make test-iam
|
|
- name: Test with Access Management Plugin enabled
|
|
env:
|
|
_MINIO_LDAP_TEST_SERVER: ${{ matrix.ldap }}
|
|
_MINIO_ETCD_TEST_SERVER: ${{ matrix.etcd }}
|
|
_MINIO_OPENID_TEST_SERVER: ${{ matrix.openid }}
|
|
_MINIO_POLICY_PLUGIN_TEST_ENDPOINT: "http://127.0.0.1:8080"
|
|
run: |
|
|
sudo sysctl net.ipv6.conf.all.disable_ipv6=0
|
|
sudo sysctl net.ipv6.conf.default.disable_ipv6=0
|
|
go run docs/iam/access-manager-plugin.go &
|
|
make test-iam
|
|
- name: Test MinIO Old Version data to IAM import current version
|
|
if: matrix.ldap == 'ldaphost:389'
|
|
env:
|
|
_MINIO_LDAP_TEST_SERVER: ${{ matrix.ldap }}
|
|
run: |
|
|
make test-iam-ldap-upgrade-import
|
|
- name: Test LDAP for automatic site replication
|
|
if: matrix.ldap == 'localhost:389'
|
|
run: |
|
|
make test-site-replication-ldap
|
|
- name: Test OIDC for automatic site replication
|
|
if: matrix.openid == 'http://127.0.0.1:5556/dex'
|
|
run: |
|
|
make test-site-replication-oidc
|