From 9a39f8ad4d40b53dc4c73196e75570df23a01257 Mon Sep 17 00:00:00 2001 From: Aditya Manthramurthy Date: Thu, 21 Nov 2024 18:24:04 -0800 Subject: [PATCH] fix: Remove User should fail for a service account (#20677) The RemoveUser API only removes internal users, and it reports success when it didnt find the internal user account for deletion. When provided with a service account, it should not report success as that is misleading. --- cmd/admin-handlers-users.go | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/cmd/admin-handlers-users.go b/cmd/admin-handlers-users.go index 1093aaa45..0e54c13de 100644 --- a/cmd/admin-handlers-users.go +++ b/cmd/admin-handlers-users.go @@ -65,6 +65,17 @@ func (a adminAPIHandlers) RemoveUser(w http.ResponseWriter, r *http.Request) { return } + // This API only supports removal of internal users not service accounts. + ok, _, err = globalIAMSys.IsServiceAccount(accessKey) + if err != nil { + writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL) + return + } + if ok { + writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, errIAMActionNotAllowed), r.URL) + return + } + // When the user is root credential you are not allowed to // remove the root user. Also you cannot delete yourself. if accessKey == globalActiveCred.AccessKey || accessKey == cred.AccessKey {