mirror of
https://github.com/pgsty/minio.git
synced 2026-10-17 07:05:59 +03:00
Feng Ruohang
2616d43fbc
Honor self-service authorization denials, prevent session-limited credential delegation and updates, and protect root credential mutations under built-in IAM. Preserve empty-policy inheritance and damaged-account cleanup, normalize new service policy claims at issuance, and add signed Admin API and LDAP regressions. Signed-off-by: Feng Ruohang <rh@vonng.com>
508 lines
27 KiB
Go
508 lines
27 KiB
Go
// Copyright (c) 2026 PGSTY
|
|
// SPDX-License-Identifier: AGPL-3.0-or-later
|
|
|
|
package cmd
|
|
|
|
import (
|
|
"bytes"
|
|
"context"
|
|
"encoding/base64"
|
|
"encoding/json"
|
|
"io"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"sync/atomic"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/minio/madmin-go/v3"
|
|
"github.com/minio/minio/internal/auth"
|
|
polplugin "github.com/minio/minio/internal/config/policy/plugin"
|
|
"github.com/minio/mux"
|
|
xnet "github.com/pgsty/silo-pkg/v3/net"
|
|
"github.com/pgsty/silo-pkg/v3/policy"
|
|
)
|
|
|
|
func iamAdminFixture(t *testing.T) (context.Context, *IAMSys) {
|
|
t.Helper()
|
|
ctx, sys, obj := prepareIAMRevisionFixture(t)
|
|
globalObjLayerMutex.Lock()
|
|
globalObjectAPI = obj
|
|
globalObjLayerMutex.Unlock()
|
|
return ctx, sys
|
|
}
|
|
|
|
func iamAdminUser(ctx context.Context, t *testing.T, sys *IAMSys, name, policyName string) auth.Credentials {
|
|
t.Helper()
|
|
cred := auth.Credentials{AccessKey: name, SecretKey: "review-user-valid-secret"}
|
|
_, err := sys.CreateUser(ctx, name, madmin.AddOrUpdateUserReq{SecretKey: cred.SecretKey, Status: madmin.AccountEnabled})
|
|
mustIAM(t, err)
|
|
if policyName != "" {
|
|
_, err = sys.PolicyDBSet(ctx, name, policyName, regUser, false)
|
|
mustIAM(t, err)
|
|
}
|
|
return cred
|
|
}
|
|
|
|
func iamAdminServiceAccount(ctx context.Context, t *testing.T, sys *IAMSys, parent, key, document string) auth.Credentials {
|
|
t.Helper()
|
|
var sp *policy.Policy
|
|
var err error
|
|
if document != "" {
|
|
sp, err = policy.ParseConfig(strings.NewReader(document))
|
|
mustIAM(t, err)
|
|
}
|
|
cred, _, err := sys.NewServiceAccount(ctx, parent, nil, newServiceAccountOpts{accessKey: key, secretKey: "review-service-valid-secret", sessionPolicy: sp})
|
|
mustIAM(t, err)
|
|
return cred
|
|
}
|
|
|
|
func iamAdminRequest(t *testing.T, cred auth.Credentials, method, target string, payload any) *http.Request {
|
|
t.Helper()
|
|
var body []byte
|
|
if payload != nil {
|
|
raw, err := json.Marshal(payload)
|
|
mustIAM(t, err)
|
|
body, err = madmin.EncryptData(cred.SecretKey, raw)
|
|
mustIAM(t, err)
|
|
}
|
|
headers := map[string]string{}
|
|
if cred.IsTemp() && !cred.IsServiceAccount() {
|
|
headers["X-Amz-Security-Token"] = cred.SessionToken
|
|
}
|
|
req, err := newTestSignedRequestV4(method, "http://localhost"+target, int64(len(body)), bytes.NewReader(body), cred.AccessKey, cred.SecretKey, headers)
|
|
mustIAM(t, err)
|
|
mustIAM(t, req.ParseForm())
|
|
return req
|
|
}
|
|
|
|
func iamAdminCall(t *testing.T, cred auth.Credentials, method, target string, payload any, vars map[string]string, handler http.HandlerFunc) *httptest.ResponseRecorder {
|
|
t.Helper()
|
|
req := iamAdminRequest(t, cred, method, target, payload)
|
|
req = mux.SetURLVars(req, vars)
|
|
rec := httptest.NewRecorder()
|
|
req = req.WithContext(newContext(req, rec, "IAMAdminAuthorization"))
|
|
handler(rec, req)
|
|
return rec
|
|
}
|
|
|
|
func assertIAMAdminStatus(t *testing.T, operation string, rec *httptest.ResponseRecorder, want int) {
|
|
t.Helper()
|
|
if rec.Code != want {
|
|
t.Errorf("%s status=%d want=%d body=%s", operation, rec.Code, want, rec.Body.String())
|
|
return
|
|
}
|
|
if want == http.StatusForbidden || want == http.StatusNotFound {
|
|
var response APIErrorResponse
|
|
mustIAM(t, json.Unmarshal(rec.Body.Bytes(), &response))
|
|
wantCode := errorCodes.ToAPIErr(ErrAccessDenied).Code
|
|
if want == http.StatusNotFound {
|
|
wantCode = errorCodes.ToAPIErr(ErrAdminServiceAccountNotFound).Code
|
|
}
|
|
if response.Code != wantCode {
|
|
t.Errorf("%s error code=%s want=%s", operation, response.Code, wantCode)
|
|
}
|
|
}
|
|
}
|
|
|
|
func iamAdminPlugin(t *testing.T, allow bool) {
|
|
t.Helper()
|
|
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
_ = json.NewEncoder(w).Encode(map[string]bool{"result": allow})
|
|
}))
|
|
t.Cleanup(server.Close)
|
|
u, err := xnet.ParseHTTPURL(server.URL)
|
|
mustIAM(t, err)
|
|
previous := newGlobalAuthZPluginFn()
|
|
setGlobalAuthZPlugin(polplugin.New(polplugin.Args{URL: u, CloseRespFn: func(r io.ReadCloser) { r.Close() }}))
|
|
t.Cleanup(func() { setGlobalAuthZPlugin(previous) })
|
|
}
|
|
|
|
func TestIAMAdminRootEmptyPolicy(t *testing.T) {
|
|
for _, doc := range []string{"", "null", "{}", `{"Statement":null}`} {
|
|
t.Run("policy="+doc, func(t *testing.T) {
|
|
ctx, sys := iamAdminFixture(t)
|
|
caller := iamAdminServiceAccount(ctx, t, sys, globalActiveCred.AccessKey, "review-root-empty", doc)
|
|
sibling := iamAdminServiceAccount(ctx, t, sys, globalActiveCred.AccessKey, "review-root-sibling", "")
|
|
req := iamAdminRequest(t, caller, "GET", "/minio/admin/v3/list-service-accounts", nil)
|
|
checked, owner, code := checkKeyValid(req, caller.AccessKey)
|
|
if code != ErrNone {
|
|
t.Fatalf("checkKeyValid: %v", code)
|
|
}
|
|
active, _ := isAllowedBySessionPolicyForServiceAccount(policy.Args{Claims: checked.Claims})
|
|
t.Logf("owner=%v parsed_active_session_policy=%v", owner, active)
|
|
api := adminAPIHandlers{}
|
|
assertIAMAdminStatus(t, "create", iamAdminCall(t, caller, "PUT", "/minio/admin/v3/add-service-account", madmin.AddServiceAccountReq{AccessKey: "review-root-new", SecretKey: "review-service-valid-secret"}, nil, api.AddServiceAccount), 200)
|
|
assertIAMAdminStatus(t, "update", iamAdminCall(t, caller, "POST", "/minio/admin/v3/update-service-account?accessKey="+sibling.AccessKey, madmin.UpdateServiceAccountReq{NewName: "review"}, map[string]string{"accessKey": sibling.AccessKey}, api.UpdateServiceAccount), 204)
|
|
assertIAMAdminStatus(t, "delete", iamAdminCall(t, caller, "DELETE", "/minio/admin/v3/delete-service-account?accessKey="+sibling.AccessKey, nil, map[string]string{"accessKey": sibling.AccessKey}, api.DeleteServiceAccount), 204)
|
|
assertIAMAdminStatus(t, "revoke", iamAdminCall(t, caller, "POST", "/minio/admin/v3/revoke-tokens/builtin?fullRevoke=true", nil, map[string]string{"userProvider": madmin.BuiltinProvider}, api.RevokeTokens), 204)
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestIAMAdminEmptyPolicyDelegation(t *testing.T) {
|
|
for _, parentType := range []string{"root", "user"} {
|
|
for _, document := range []string{"null", "{}", `{"Statement":null}`} {
|
|
t.Run(parentType+"/"+document, func(t *testing.T) {
|
|
ctx, sys := iamAdminFixture(t)
|
|
parent := globalActiveCred
|
|
if parentType == "user" {
|
|
parent = iamAdminUser(ctx, t, sys, "empty-policy-parent", "readwrite")
|
|
}
|
|
sp, err := policy.ParseConfig(strings.NewReader(document))
|
|
mustIAM(t, err)
|
|
caller, _, err := sys.NewServiceAccount(ctx, parent.AccessKey, nil, newServiceAccountOpts{
|
|
accessKey: "empty-policy-caller", secretKey: "empty-policy-caller-secret", sessionPolicy: sp,
|
|
claims: map[string]any{"identity-attribute": "preserved"},
|
|
})
|
|
mustIAM(t, err)
|
|
const limitedPolicy = `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["admin:ListServiceAccounts"]}]}`
|
|
for _, tc := range []struct {
|
|
policy string
|
|
listStatus int
|
|
allowObject bool
|
|
}{
|
|
{"", http.StatusOK, true},
|
|
{"null", http.StatusOK, true},
|
|
{"{}", http.StatusOK, true},
|
|
{`{"Statement":null}`, http.StatusOK, true},
|
|
{limitedPolicy, http.StatusOK, false},
|
|
{`{"Version":"2012-10-17"}`, http.StatusForbidden, false},
|
|
{`{"Statement":[]}`, http.StatusForbidden, false},
|
|
} {
|
|
expires := UTCNow().Add(time.Hour)
|
|
req := madmin.AddServiceAccountReq{Expiration: &expires}
|
|
if tc.policy != "" {
|
|
req.Policy = json.RawMessage(tc.policy)
|
|
}
|
|
api := adminAPIHandlers{}
|
|
rec := iamAdminCall(t, caller, "PUT", "/minio/admin/v3/add-service-account", req, nil, api.AddServiceAccount)
|
|
assertIAMAdminStatus(t, "create expiring child", rec, http.StatusOK)
|
|
data, err := madmin.DecryptData(caller.SecretKey, rec.Body)
|
|
mustIAM(t, err)
|
|
var response madmin.AddServiceAccountResp
|
|
mustIAM(t, json.Unmarshal(data, &response))
|
|
child, ok := sys.store.GetUser(response.Credentials.AccessKey)
|
|
if !ok {
|
|
t.Fatal("new service account missing")
|
|
}
|
|
// Exercise the issued key through authentication and authorization.
|
|
assertIAMAdminStatus(t, "use expiring child policy="+tc.policy, iamAdminCall(t, child.Credentials, "GET", "/minio/admin/v3/list-service-accounts", nil, nil, api.ListServiceAccounts), tc.listStatus)
|
|
signed := iamAdminRequest(t, child.Credentials, "GET", "/example/object", nil)
|
|
checked, owner, code := checkKeyValid(signed, child.Credentials.AccessKey)
|
|
if code != ErrNone {
|
|
t.Fatalf("child authentication: %v", code)
|
|
}
|
|
if checked.Claims["identity-attribute"] != "preserved" {
|
|
t.Fatal("creation lost the caller's identity context")
|
|
}
|
|
allowed := sys.IsAllowed(policy.Args{AccountName: checked.AccessKey, Claims: checked.Claims, IsOwner: owner, Action: policy.GetObjectAction, BucketName: "example", ObjectName: "object"})
|
|
if allowed != tc.allowObject {
|
|
t.Errorf("GetObject allowed=%v with requested policy=%s", allowed, tc.policy)
|
|
}
|
|
}
|
|
})
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestIAMAdminCorruptServiceCleanup(t *testing.T) {
|
|
for _, status := range []string{auth.AccountOn, auth.AccountOff, "expired"} {
|
|
t.Run(status, func(t *testing.T) {
|
|
ctx, sys := iamAdminFixture(t)
|
|
caller := iamAdminUser(ctx, t, sys, "review-admin", "consoleAdmin")
|
|
parent := iamAdminUser(ctx, t, sys, "review-parent", "readwrite")
|
|
svc := iamAdminServiceAccount(ctx, t, sys, parent.AccessKey, "rv-corrupt", "")
|
|
if status == auth.AccountOff {
|
|
_, err := sys.UpdateServiceAccount(ctx, svc.AccessKey, updateServiceAccountOpts{status: status})
|
|
mustIAM(t, err)
|
|
}
|
|
cache := sys.store.lock()
|
|
u := cache.iamUsersMap[svc.AccessKey]
|
|
u.Credentials.SessionToken = "broken-session-token"
|
|
if status == "expired" {
|
|
u.Credentials.Expiration = UTCNow().Add(-time.Minute)
|
|
}
|
|
cache.iamUsersMap[svc.AccessKey] = u
|
|
sys.store.unlock()
|
|
_, _, err := sys.GetServiceAccount(ctx, svc.AccessKey)
|
|
if err == nil {
|
|
t.Fatal("fault injection failed")
|
|
}
|
|
raw, exists := sys.store.GetUser(svc.AccessKey)
|
|
_, loginOK := sys.GetUser(ctx, svc.AccessKey)
|
|
t.Logf("metadata_exists=%v parent_known=%v GetUser_ok=%v", exists, raw.Credentials.ParentUser == parent.AccessKey, loginOK)
|
|
api := adminAPIHandlers{}
|
|
outsider := iamAdminUser(ctx, t, sys, "cleanup-outsider", "readwrite")
|
|
assertIAMAdminStatus(t, "unauthorized cleanup", iamAdminCall(t, outsider, "DELETE", "/minio/admin/v3/delete-service-account?accessKey="+svc.AccessKey, nil, map[string]string{"accessKey": svc.AccessKey}, api.DeleteServiceAccount), 404)
|
|
assertIAMAdminStatus(t, "admin cleanup", iamAdminCall(t, caller, "DELETE", "/minio/admin/v3/delete-service-account?accessKey="+svc.AccessKey, nil, map[string]string{"accessKey": svc.AccessKey}, api.DeleteServiceAccount), 204)
|
|
if _, ok := sys.store.GetUser(svc.AccessKey); ok {
|
|
t.Fatal("deleted service account remains in the IAM cache")
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestIAMAdminPolicylessSelf(t *testing.T) {
|
|
ctx, sys := iamAdminFixture(t)
|
|
caller := iamAdminUser(ctx, t, sys, "review-policyless", "")
|
|
svc := iamAdminServiceAccount(ctx, t, sys, caller.AccessKey, "rv-policyless-child", "")
|
|
api := adminAPIHandlers{}
|
|
assertIAMAdminStatus(t, "list", iamAdminCall(t, caller, "GET", "/minio/admin/v3/list-service-accounts", nil, nil, api.ListServiceAccounts), 200)
|
|
assertIAMAdminStatus(t, "info service", iamAdminCall(t, caller, "GET", "/minio/admin/v3/info-service-account?accessKey="+svc.AccessKey, nil, map[string]string{"accessKey": svc.AccessKey}, api.InfoServiceAccount), 200)
|
|
assertIAMAdminStatus(t, "info access key", iamAdminCall(t, caller, "GET", "/minio/admin/v3/info-access-key?accessKey="+svc.AccessKey, nil, map[string]string{"accessKey": svc.AccessKey}, api.InfoAccessKey), 200)
|
|
assertIAMAdminStatus(t, "delete", iamAdminCall(t, caller, "DELETE", "/minio/admin/v3/delete-service-account?accessKey="+svc.AccessKey, nil, map[string]string{"accessKey": svc.AccessKey}, api.DeleteServiceAccount), 204)
|
|
assertIAMAdminStatus(t, "revoke", iamAdminCall(t, caller, "POST", "/minio/admin/v3/revoke-tokens/builtin?fullRevoke=true", nil, map[string]string{"userProvider": madmin.BuiltinProvider}, api.RevokeTokens), 204)
|
|
assertIAMAdminStatus(t, "list another user", iamAdminCall(t, caller, "GET", "/minio/admin/v3/list-service-accounts?user="+globalActiveCred.AccessKey, nil, nil, api.ListServiceAccounts), 403)
|
|
assertIAMAdminStatus(t, "revoke another user", iamAdminCall(t, caller, "POST", "/minio/admin/v3/revoke-tokens/builtin?fullRevoke=true&user="+globalActiveCred.AccessKey, nil, map[string]string{"userProvider": madmin.BuiltinProvider}, api.RevokeTokens), 403)
|
|
}
|
|
|
|
func TestIAMAdminExpiringInheritedPolicy(t *testing.T) {
|
|
ctx, sys := iamAdminFixture(t)
|
|
parent := iamAdminUser(ctx, t, sys, "review-legacy-parent", "consoleAdmin")
|
|
document := `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["admin:CreateServiceAccount","admin:UpdateServiceAccount"]}]}`
|
|
// Model a credential persisted by the old handler: it copied its caller's
|
|
// policy claims but set the newly created service's type to inherited.
|
|
expires := UTCNow().Add(time.Hour)
|
|
caller, _, err := sys.NewServiceAccount(ctx, parent.AccessKey, nil, newServiceAccountOpts{
|
|
accessKey: "rv-exp-inherited", secretKey: "review-service-valid-secret", expiration: &expires,
|
|
claims: map[string]any{policy.SessionPolicyName: base64.StdEncoding.EncodeToString([]byte(document))},
|
|
})
|
|
mustIAM(t, err)
|
|
req := iamAdminRequest(t, caller, "GET", "/minio/admin/v3/list-service-accounts", nil)
|
|
checked, owner, code := checkKeyValid(req, caller.AccessKey)
|
|
if code != ErrNone {
|
|
t.Fatalf("checkKeyValid: %v", code)
|
|
}
|
|
args := policy.Args{AccountName: caller.AccessKey, Claims: checked.Claims, IsOwner: owner, Action: policy.CreateServiceAccountAdminAction, DenyOnly: true}
|
|
if !sys.IsAllowed(args) {
|
|
t.Fatal("fixture cannot create")
|
|
}
|
|
args.Action = policy.CreateUserAdminAction
|
|
args.DenyOnly = false
|
|
if sys.IsAllowed(args) {
|
|
t.Fatal("fixture not constrained")
|
|
}
|
|
t.Logf("service=%v temp=%v inherited=%v; create allowed, create-user denied", checked.IsServiceAccount(), checked.IsTemp(), checked.Claims[iamPolicyClaimNameSA()] == inheritedPolicyType)
|
|
api := adminAPIHandlers{}
|
|
rec := iamAdminCall(t, caller, "PUT", "/minio/admin/v3/add-service-account", madmin.AddServiceAccountReq{AccessKey: "review-escaped", SecretKey: "review-service-valid-secret"}, nil, api.AddServiceAccount)
|
|
if rec.Code == 200 {
|
|
child, ok := sys.GetUser(ctx, "review-escaped")
|
|
if !ok {
|
|
t.Fatal("new key missing")
|
|
}
|
|
childReq := iamAdminRequest(t, child.Credentials, "GET", "/minio/admin/v3/list-service-accounts", nil)
|
|
childChecked, childOwner, childCode := checkKeyValid(childReq, child.Credentials.AccessKey)
|
|
if childCode != ErrNone {
|
|
t.Fatalf("child auth=%v", childCode)
|
|
}
|
|
allowed := sys.IsAllowed(policy.Args{AccountName: childChecked.AccessKey, Claims: childChecked.Claims, IsOwner: childOwner, Action: policy.CreateUserAdminAction})
|
|
t.Errorf("constrained inherited service created a new key; new key CreateUser allowed=%v", allowed)
|
|
} else {
|
|
assertIAMAdminStatus(t, "reject derived creation", rec, 403)
|
|
}
|
|
updated := iamAdminCall(t, caller, "POST", "/minio/admin/v3/update-service-account?accessKey="+caller.AccessKey, madmin.UpdateServiceAccountReq{NewName: "metadata-only"}, map[string]string{"accessKey": caller.AccessKey}, api.UpdateServiceAccount)
|
|
if updated.Code == 204 {
|
|
after, ok := sys.GetUser(ctx, caller.AccessKey)
|
|
if !ok {
|
|
t.Fatal("updated key missing")
|
|
}
|
|
afterReq := iamAdminRequest(t, after.Credentials, "GET", "/minio/admin/v3/list-service-accounts", nil)
|
|
afterChecked, afterOwner, afterCode := checkKeyValid(afterReq, caller.AccessKey)
|
|
if afterCode != ErrNone {
|
|
t.Fatalf("updated auth=%v", afterCode)
|
|
}
|
|
allowed := sys.IsAllowed(policy.Args{AccountName: caller.AccessKey, Claims: afterChecked.Claims, IsOwner: afterOwner, Action: policy.CreateUserAdminAction})
|
|
t.Errorf("constrained inherited service updated itself; CreateUser allowed after update=%v", allowed)
|
|
} else {
|
|
assertIAMAdminStatus(t, "reject inherited self update", updated, 403)
|
|
}
|
|
}
|
|
|
|
func TestIAMAdminSessionPolicyCannotDelegate(t *testing.T) {
|
|
for _, temp := range []bool{false, true} {
|
|
t.Run(map[bool]string{false: "service", true: "sts"}[temp], func(t *testing.T) {
|
|
ctx, sys := iamAdminFixture(t)
|
|
parent := iamAdminUser(ctx, t, sys, "rv-parent", "consoleAdmin")
|
|
doc := `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["admin:CreateServiceAccount","admin:UpdateServiceAccount"]}]}`
|
|
var caller auth.Credentials
|
|
if !temp {
|
|
caller = iamAdminServiceAccount(ctx, t, sys, parent.AccessKey, "review-restricted", doc)
|
|
} else {
|
|
var err error
|
|
caller, err = auth.GetNewCredentialsWithMetadata(map[string]any{parentClaim: parent.AccessKey, "exp": UTCNow().Add(time.Hour).Unix(), policy.SessionPolicyName: base64.StdEncoding.EncodeToString([]byte(doc))}, globalActiveCred.SecretKey)
|
|
mustIAM(t, err)
|
|
caller.ParentUser = parent.AccessKey
|
|
_, err = sys.SetTempUser(ctx, caller.AccessKey, caller, "")
|
|
mustIAM(t, err)
|
|
}
|
|
sibling := iamAdminServiceAccount(ctx, t, sys, parent.AccessKey, "rv-sibling", "")
|
|
api := adminAPIHandlers{}
|
|
assertIAMAdminStatus(t, "restrict create", iamAdminCall(t, caller, "PUT", "/minio/admin/v3/add-service-account", madmin.AddServiceAccountReq{AccessKey: "review-bad-new", SecretKey: "review-service-valid-secret"}, nil, api.AddServiceAccount), 403)
|
|
assertIAMAdminStatus(t, "restrict LDAP create", iamAdminCall(t, caller, "PUT", "/minio/admin/v3/idp/ldap/add-service-account", madmin.AddServiceAccountReq{AccessKey: "review-bad-new", SecretKey: "review-service-valid-secret"}, nil, api.AddServiceAccountLDAP), 403)
|
|
assertIAMAdminStatus(t, "restrict update", iamAdminCall(t, caller, "POST", "/minio/admin/v3/update-service-account?accessKey="+sibling.AccessKey, madmin.UpdateServiceAccountReq{NewSecretKey: "review-known-new-secret"}, map[string]string{"accessKey": sibling.AccessKey}, api.UpdateServiceAccount), 403)
|
|
if _, ok := sys.store.GetUser("review-bad-new"); ok {
|
|
t.Fatal("denied creation persisted a credential")
|
|
}
|
|
u, ok := sys.store.GetUser(sibling.AccessKey)
|
|
if !ok || u.Credentials.SecretKey != sibling.SecretKey {
|
|
t.Fatal("denied update changed the target credential")
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestIAMAdminSelfDenials(t *testing.T) {
|
|
for _, mode := range []string{"parent_deny", "group_deny", "session_implicit_deny", "session_explicit_deny", "plugin_deny"} {
|
|
t.Run(mode, func(t *testing.T) {
|
|
ctx, sys := iamAdminFixture(t)
|
|
parent := iamAdminUser(ctx, t, sys, "rv-self-parent", "readwrite")
|
|
target := iamAdminServiceAccount(ctx, t, sys, parent.AccessKey, "rv-self-target", "")
|
|
caller := parent
|
|
doc := `{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":["admin:ListServiceAccounts","admin:RemoveServiceAccount"]}]}`
|
|
switch mode {
|
|
case "parent_deny", "group_deny":
|
|
p, err := policy.ParseConfig(strings.NewReader(doc))
|
|
mustIAM(t, err)
|
|
_, err = sys.SetPolicy(ctx, "review-self-deny", *p)
|
|
mustIAM(t, err)
|
|
if mode == "group_deny" {
|
|
_, err = sys.AddUsersToGroup(ctx, "self-deny-group", []string{parent.AccessKey})
|
|
mustIAM(t, err)
|
|
_, err = sys.PolicyDBSet(ctx, "self-deny-group", "review-self-deny", regUser, true)
|
|
} else {
|
|
_, err = sys.PolicyDBSet(ctx, parent.AccessKey, "readwrite,review-self-deny", regUser, false)
|
|
}
|
|
mustIAM(t, err)
|
|
case "session_implicit_deny":
|
|
caller = iamAdminServiceAccount(ctx, t, sys, parent.AccessKey, "rv-self-caller", `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["s3:GetObject"],"Resource":["arn:aws:s3:::example/*"]}]}`)
|
|
case "session_explicit_deny":
|
|
caller = iamAdminServiceAccount(ctx, t, sys, parent.AccessKey, "rv-self-caller", doc)
|
|
case "plugin_deny":
|
|
iamAdminPlugin(t, false)
|
|
}
|
|
api := adminAPIHandlers{}
|
|
assertIAMAdminStatus(t, "list", iamAdminCall(t, caller, "GET", "/minio/admin/v3/list-service-accounts", nil, nil, api.ListServiceAccounts), 403)
|
|
assertIAMAdminStatus(t, "info service", iamAdminCall(t, caller, "GET", "/minio/admin/v3/info-service-account?accessKey="+target.AccessKey, nil, map[string]string{"accessKey": target.AccessKey}, api.InfoServiceAccount), 403)
|
|
assertIAMAdminStatus(t, "info access key", iamAdminCall(t, caller, "GET", "/minio/admin/v3/info-access-key?accessKey="+target.AccessKey, nil, map[string]string{"accessKey": target.AccessKey}, api.InfoAccessKey), 403)
|
|
assertIAMAdminStatus(t, "delete", iamAdminCall(t, caller, "DELETE", "/minio/admin/v3/delete-service-account?accessKey="+target.AccessKey, nil, map[string]string{"accessKey": target.AccessKey}, api.DeleteServiceAccount), 403)
|
|
assertIAMAdminStatus(t, "revoke", iamAdminCall(t, caller, "POST", "/minio/admin/v3/revoke-tokens/builtin?fullRevoke=true", nil, map[string]string{"userProvider": madmin.BuiltinProvider}, api.RevokeTokens), 403)
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestIAMAdminNonRootCannotManageRoot(t *testing.T) {
|
|
ctx, sys := iamAdminFixture(t)
|
|
caller := iamAdminUser(ctx, t, sys, "rv-console-admin", "consoleAdmin")
|
|
target := iamAdminServiceAccount(ctx, t, sys, globalActiveCred.AccessKey, "rv-root-target", "")
|
|
api := adminAPIHandlers{}
|
|
assertIAMAdminStatus(t, "create root", iamAdminCall(t, caller, "PUT", "/minio/admin/v3/add-service-account", madmin.AddServiceAccountReq{AccessKey: "rv-new-root", SecretKey: "review-service-valid-secret", TargetUser: globalActiveCred.AccessKey}, nil, api.AddServiceAccount), 403)
|
|
assertIAMAdminStatus(t, "update root", iamAdminCall(t, caller, "POST", "/minio/admin/v3/update-service-account?accessKey="+target.AccessKey, madmin.UpdateServiceAccountReq{NewSecretKey: "review-known-new-secret"}, map[string]string{"accessKey": target.AccessKey}, api.UpdateServiceAccount), 403)
|
|
assertIAMAdminStatus(t, "delete root", iamAdminCall(t, caller, "DELETE", "/minio/admin/v3/delete-service-account?accessKey="+target.AccessKey, nil, map[string]string{"accessKey": target.AccessKey}, api.DeleteServiceAccount), 404)
|
|
assertIAMAdminStatus(t, "revoke root", iamAdminCall(t, caller, "POST", "/minio/admin/v3/revoke-tokens/builtin?fullRevoke=true&user="+globalActiveCred.AccessKey, nil, map[string]string{"userProvider": madmin.BuiltinProvider}, api.RevokeTokens), 403)
|
|
// Restricted root-derived credentials and the site replicator are not root
|
|
// administrators, even when their effective policy allows these actions.
|
|
limited := iamAdminServiceAccount(ctx, t, sys, globalActiveCred.AccessKey, "limited-root", `{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["admin:*"]}]}`)
|
|
assertIAMAdminStatus(t, "limited root delete", iamAdminCall(t, limited, "DELETE", "/minio/admin/v3/delete-service-account?accessKey="+target.AccessKey, nil, map[string]string{"accessKey": target.AccessKey}, api.DeleteServiceAccount), 404)
|
|
assertIAMAdminStatus(t, "limited root revoke", iamAdminCall(t, limited, "POST", "/minio/admin/v3/revoke-tokens/builtin?fullRevoke=true", nil, map[string]string{"userProvider": madmin.BuiltinProvider}, api.RevokeTokens), 403)
|
|
replicator, _, err := sys.NewServiceAccount(ctx, globalActiveCred.AccessKey, nil, newServiceAccountOpts{accessKey: siteReplicatorSvcAcc, secretKey: "replicator-valid-secret", allowSiteReplicatorAccount: true})
|
|
mustIAM(t, err)
|
|
assertIAMAdminStatus(t, "replicator create root", iamAdminCall(t, replicator, "PUT", "/minio/admin/v3/add-service-account", madmin.AddServiceAccountReq{}, nil, api.AddServiceAccount), 403)
|
|
|
|
// An external plugin remains authoritative, including for root targets.
|
|
iamAdminPlugin(t, true)
|
|
assertIAMAdminStatus(t, "plugin update root", iamAdminCall(t, limited, "POST", "/minio/admin/v3/update-service-account?accessKey="+target.AccessKey, madmin.UpdateServiceAccountReq{NewName: "plugin-authorized"}, map[string]string{"accessKey": target.AccessKey}, api.UpdateServiceAccount), 204)
|
|
assertIAMAdminStatus(t, "plugin create root", iamAdminCall(t, limited, "PUT", "/minio/admin/v3/add-service-account", madmin.AddServiceAccountReq{}, nil, api.AddServiceAccount), 200)
|
|
}
|
|
|
|
func TestIAMAdminDeleteCorruptServiceReplicates(t *testing.T) {
|
|
ctx, sys := iamAdminFixture(t)
|
|
caller := iamAdminUser(ctx, t, sys, "cleanup-admin", "consoleAdmin")
|
|
parent := iamAdminUser(ctx, t, sys, "cleanup-parent", "readwrite")
|
|
target := iamAdminServiceAccount(ctx, t, sys, parent.AccessKey, "cleanup-target", "")
|
|
cache := sys.store.lock()
|
|
u := cache.iamUsersMap[target.AccessKey]
|
|
u.Credentials.SessionToken = "broken-session-token"
|
|
u.Credentials.Status = auth.AccountOff
|
|
cache.iamUsersMap[target.AccessKey] = u
|
|
sys.store.unlock()
|
|
|
|
var deletions atomic.Int32
|
|
peer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
if r.URL.Path == "/minio/health/live" {
|
|
return
|
|
}
|
|
var batch iamRevisionBatch
|
|
if err := json.NewDecoder(r.Body).Decode(&batch); err != nil {
|
|
t.Error(err)
|
|
w.WriteHeader(http.StatusBadRequest)
|
|
return
|
|
}
|
|
if len(batch.Items) != 1 || batch.Items[0].SvcAccChange == nil || batch.Items[0].SvcAccChange.Delete == nil || batch.Items[0].SvcAccChange.Delete.AccessKey != target.AccessKey {
|
|
t.Error("replication did not carry the service account deletion")
|
|
} else {
|
|
deletions.Add(1)
|
|
}
|
|
_ = json.NewEncoder(w).Encode(iamRevisionResponse{iamRevisionStatus: iamRevisionStatus{Version: iamRevisionProtocol, Node: "peer", Instance: "peer-boot", Digest: "deleted"}})
|
|
}))
|
|
t.Cleanup(peer.Close)
|
|
globalSiteReplicatorCred.RLock()
|
|
previousSecret := globalSiteReplicatorCred.secretKey
|
|
globalSiteReplicatorCred.RUnlock()
|
|
globalSiteReplicatorCred.Set(caller.SecretKey)
|
|
t.Cleanup(func() { globalSiteReplicatorCred.Set(previousSecret) })
|
|
globalSiteReplicationSys.Lock()
|
|
globalSiteReplicationSys.enabled = true
|
|
globalSiteReplicationSys.state = srState{ServiceAccountAccessKey: caller.AccessKey, Peers: map[string]madmin.PeerInfo{
|
|
globalDeploymentID(): {DeploymentID: globalDeploymentID(), Name: "local"},
|
|
"peer": {DeploymentID: "peer", Name: "peer", Endpoint: peer.URL},
|
|
}}
|
|
globalSiteReplicationSys.Unlock()
|
|
t.Cleanup(func() {
|
|
globalSiteReplicationSys.Lock()
|
|
globalSiteReplicationSys.enabled = false
|
|
globalSiteReplicationSys.Unlock()
|
|
})
|
|
api := adminAPIHandlers{}
|
|
assertIAMAdminStatus(t, "replicated cleanup", iamAdminCall(t, caller, "DELETE", "/minio/admin/v3/delete-service-account?accessKey="+target.AccessKey, nil, map[string]string{"accessKey": target.AccessKey}, api.DeleteServiceAccount), 204)
|
|
if deletions.Load() != 1 {
|
|
t.Fatalf("expected one immediate deletion notification, got %d", deletions.Load())
|
|
}
|
|
}
|
|
|
|
func TestIAMAdminListSelfAliases(t *testing.T) {
|
|
for _, kind := range []string{"service", "sts"} {
|
|
t.Run(kind, func(t *testing.T) {
|
|
ctx, sys := iamAdminFixture(t)
|
|
parent := iamAdminUser(ctx, t, sys, "alias-parent", "readwrite")
|
|
target := iamAdminServiceAccount(ctx, t, sys, parent.AccessKey, "alias-target", "")
|
|
caller := iamAdminServiceAccount(ctx, t, sys, parent.AccessKey, "alias-caller", "")
|
|
if kind == "sts" {
|
|
var err error
|
|
caller, err = auth.GetNewCredentialsWithMetadata(map[string]any{parentClaim: parent.AccessKey, "exp": UTCNow().Add(time.Hour).Unix()}, globalActiveCred.SecretKey)
|
|
mustIAM(t, err)
|
|
caller.ParentUser = parent.AccessKey
|
|
_, err = sys.SetTempUser(ctx, caller.AccessKey, caller, "")
|
|
mustIAM(t, err)
|
|
}
|
|
api := adminAPIHandlers{}
|
|
for _, alias := range []string{"", caller.AccessKey, parent.AccessKey} {
|
|
rec := iamAdminCall(t, caller, "GET", "/minio/admin/v3/list-service-accounts?user="+alias, nil, nil, api.ListServiceAccounts)
|
|
assertIAMAdminStatus(t, "list self alias", rec, 200)
|
|
data, err := madmin.DecryptData(caller.SecretKey, rec.Body)
|
|
mustIAM(t, err)
|
|
var response madmin.ListServiceAccountsResp
|
|
mustIAM(t, json.Unmarshal(data, &response))
|
|
found := false
|
|
for _, account := range response.Accounts {
|
|
found = found || account.AccessKey == target.AccessKey
|
|
}
|
|
if !found {
|
|
t.Fatalf("self alias %q did not list the parent's service accounts", alias)
|
|
}
|
|
}
|
|
})
|
|
}
|
|
}
|