From 3c82cf9327527881ebbc4b5f27ff8b0bb501b726 Mon Sep 17 00:00:00 2001 From: Taran Pelkey Date: Mon, 16 Sep 2024 19:04:51 -0400 Subject: [PATCH] Fix behavior of `AddServiceAccountLDAP` for non-admin users (#20442) --- cmd/admin-handlers-idp-ldap.go | 2 +- cmd/admin-handlers-users.go | 14 +++++++++++--- 2 files changed, 12 insertions(+), 4 deletions(-) diff --git a/cmd/admin-handlers-idp-ldap.go b/cmd/admin-handlers-idp-ldap.go index 3a13504cb..b3ac618b3 100644 --- a/cmd/admin-handlers-idp-ldap.go +++ b/cmd/admin-handlers-idp-ldap.go @@ -190,7 +190,7 @@ func (a adminAPIHandlers) AttachDetachPolicyLDAP(w http.ResponseWriter, r *http. // // PUT /minio/admin/v3/idp/ldap/add-service-account func (a adminAPIHandlers) AddServiceAccountLDAP(w http.ResponseWriter, r *http.Request) { - ctx, cred, opts, createReq, targetUser, APIError := commonAddServiceAccount(r) + ctx, cred, opts, createReq, targetUser, APIError := commonAddServiceAccount(r, true) if APIError.Code != "" { writeErrorResponseJSON(ctx, w, APIError, r.URL) return diff --git a/cmd/admin-handlers-users.go b/cmd/admin-handlers-users.go index 188acc6c7..68f8117fb 100644 --- a/cmd/admin-handlers-users.go +++ b/cmd/admin-handlers-users.go @@ -637,7 +637,7 @@ func (a adminAPIHandlers) TemporaryAccountInfo(w http.ResponseWriter, r *http.Re // AddServiceAccount - PUT /minio/admin/v3/add-service-account func (a adminAPIHandlers) AddServiceAccount(w http.ResponseWriter, r *http.Request) { - ctx, cred, opts, createReq, targetUser, APIError := commonAddServiceAccount(r) + ctx, cred, opts, createReq, targetUser, APIError := commonAddServiceAccount(r, false) if APIError.Code != "" { writeErrorResponseJSON(ctx, w, APIError, r.URL) return @@ -2529,7 +2529,7 @@ func addExpirationToCondValues(exp *time.Time, condValues map[string][]string) e return nil } -func commonAddServiceAccount(r *http.Request) (context.Context, auth.Credentials, newServiceAccountOpts, madmin.AddServiceAccountReq, string, APIError) { +func commonAddServiceAccount(r *http.Request, ldap bool) (context.Context, auth.Credentials, newServiceAccountOpts, madmin.AddServiceAccountReq, string, APIError) { ctx := r.Context() // Get current object layer instance. @@ -2596,6 +2596,14 @@ func commonAddServiceAccount(r *http.Request) (context.Context, auth.Credentials return ctx, auth.Credentials{}, newServiceAccountOpts{}, madmin.AddServiceAccountReq{}, "", toAdminAPIErr(ctx, err) } + denyOnly := (targetUser == cred.AccessKey || targetUser == cred.ParentUser) + if ldap && !denyOnly { + res, _ := globalIAMSys.LDAPConfig.GetValidatedDNForUsername(targetUser) + if res.NormDN == cred.ParentUser { + denyOnly = true + } + } + // Check if action is allowed if creating access key for another user // Check if action is explicitly denied if for self if !globalIAMSys.IsAllowed(policy.Args{ @@ -2605,7 +2613,7 @@ func commonAddServiceAccount(r *http.Request) (context.Context, auth.Credentials ConditionValues: condValues, IsOwner: owner, Claims: cred.Claims, - DenyOnly: (targetUser == cred.AccessKey || targetUser == cred.ParentUser), + DenyOnly: denyOnly, }) { return ctx, auth.Credentials{}, newServiceAccountOpts{}, madmin.AddServiceAccountReq{}, "", errorCodes.ToAPIErr(ErrAccessDenied) }