astelm/minio
1
0
Fork 0
mirror of https://github.com/pgsty/minio.git synced 2026-11-11 10:05:34 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(iam): normalize service policies and preserve imported state

Browse Source 
Keep omitted edit policies unchanged, reset valid empty policies to inheritance, and normalize nonempty policies without a version before storage. Preserve caller policy objects and exclude derived authorization claims from snapshots and new JWTs.

Restore imported service-account and group status, report the actual group error, and cover creation, editing, replication, import/export and raw JWT claims with focused server tests.

Refs #339, #345.

Signed-off-by: Feng Ruohang <rh@vonng.com>
(cherry picked from commit 86e4c09d47f48cb2f44fb2f63f02f222ac6ae102)
This commit is contained in:
Feng Ruohang
2026-11-11 11:01:50 +08:00
parent 14ecb222e7
commit 1d714834c5
7 changed files with 444 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/admin-handlers-users.go
+13 -3
View File
@@ -2618,8 +2618,17 @@ func (a adminAPIHandlers) importIAM(w http.ResponseWriter, r *http.Request, apiV
return
}
}
if _, gerr := globalIAMSys.AddUsersToGroup(ctx, group, grpInfo.Members); gerr != nil {
failed.Groups = append(failed.Groups, madmin.IAMErrEntity{Name: group, Error: err})
_, gerr := globalIAMSys.AddUsersToGroup(ctx, group, grpInfo.Members)
if gerr == nil {
switch grpInfo.Status {
case statusDisabled:
_, gerr = globalIAMSys.SetGroupStatus(ctx, group, false)
case statusEnabled:
_, gerr = globalIAMSys.SetGroupStatus(ctx, group, true)
}
}
if gerr != nil {
failed.Groups = append(failed.Groups, madmin.IAMErrEntity{Name: group, Error: gerr})
} else {
added.Groups = append(added.Groups, group)
}
@@ -2699,6 +2708,7 @@ func (a adminAPIHandlers) importIAM(w http.ResponseWriter, r *http.Request, apiV
opts := newServiceAccountOpts{
accessKey: user,
secretKey: svcAcctReq.SecretKey,
status: svcAcctReq.Status,
sessionPolicy: sp,
claims: svcAcctReq.Claims,
name: svcAcctReq.Name,
@@ -3055,7 +3065,7 @@ func commonAddServiceAccount(r *http.Request, ldap bool) (context.Context, auth.
}
// Empty service policies mean inheritance, including for expiring keys.
// Normalize the replication request as well as the local credential.
if sp.Version == "" && sp.Statements == nil && sp.ID == "" {
if sp.IsEmpty() {
sp = nil
createReq.Policy = nil
}