mirror of
				https://github.com/minio/minio.git
				synced 2025-10-31 08:11:19 +01:00 
			
		
		
		
	This change uses the updated ldap library in minio/pkg (bumped up to v3). A new config parameter is added for LDAP configuration to specify extra user attributes to load from the LDAP server and to store them as additional claims for the user. A test is added in sts_handlers.go that shows how to access the LDAP attributes as a claim. This is in preparation for adding SSH pubkey authentication to MinIO's SFTP integration.
		
			
				
	
	
		
			168 lines
		
	
	
		
			4.6 KiB
		
	
	
	
		
			Go
		
	
	
	
	
	
			
		
		
	
	
			168 lines
		
	
	
		
			4.6 KiB
		
	
	
	
		
			Go
		
	
	
	
	
	
| // Copyright (c) 2015-2021 MinIO, Inc.
 | |
| //
 | |
| // This file is part of MinIO Object Storage stack
 | |
| //
 | |
| // This program is free software: you can redistribute it and/or modify
 | |
| // it under the terms of the GNU Affero General Public License as published by
 | |
| // the Free Software Foundation, either version 3 of the License, or
 | |
| // (at your option) any later version.
 | |
| //
 | |
| // This program is distributed in the hope that it will be useful
 | |
| // but WITHOUT ANY WARRANTY; without even the implied warranty of
 | |
| // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 | |
| // GNU Affero General Public License for more details.
 | |
| //
 | |
| // You should have received a copy of the GNU Affero General Public License
 | |
| // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 | |
| 
 | |
| package versioning
 | |
| 
 | |
| import (
 | |
| 	"encoding/xml"
 | |
| 	"io"
 | |
| 	"strings"
 | |
| 
 | |
| 	"github.com/minio/pkg/v3/wildcard"
 | |
| )
 | |
| 
 | |
| // State - enabled/disabled/suspended states
 | |
| // for multifactor and status of versioning.
 | |
| type State string
 | |
| 
 | |
| // Various supported states
 | |
| const (
 | |
| 	Enabled State = "Enabled"
 | |
| 	// Disabled  State = "Disabled" only used by MFA Delete not supported yet.
 | |
| 	Suspended State = "Suspended"
 | |
| )
 | |
| 
 | |
| var (
 | |
| 	errExcludedPrefixNotSupported = Errorf("excluded prefixes extension supported only when versioning is enabled")
 | |
| 	errTooManyExcludedPrefixes    = Errorf("too many excluded prefixes")
 | |
| )
 | |
| 
 | |
| // ExcludedPrefix - holds individual prefixes excluded from being versioned.
 | |
| type ExcludedPrefix struct {
 | |
| 	Prefix string
 | |
| }
 | |
| 
 | |
| // Versioning - Configuration for bucket versioning.
 | |
| type Versioning struct {
 | |
| 	XMLNS   string   `xml:"xmlns,attr,omitempty"`
 | |
| 	XMLName xml.Name `xml:"VersioningConfiguration"`
 | |
| 	// MFADelete State    `xml:"MFADelete,omitempty"` // not supported yet.
 | |
| 	Status State `xml:"Status,omitempty"`
 | |
| 	// MinIO extension - allows selective, prefix-level versioning exclusion.
 | |
| 	// Requires versioning to be enabled
 | |
| 	ExcludedPrefixes []ExcludedPrefix `xml:",omitempty"`
 | |
| 	ExcludeFolders   bool             `xml:",omitempty"`
 | |
| }
 | |
| 
 | |
| // Validate - validates the versioning configuration
 | |
| func (v Versioning) Validate() error {
 | |
| 	// Not supported yet
 | |
| 	// switch v.MFADelete {
 | |
| 	// case Enabled, Disabled:
 | |
| 	// default:
 | |
| 	// 	return Errorf("unsupported MFADelete state %s", v.MFADelete)
 | |
| 	// }
 | |
| 	switch v.Status {
 | |
| 	case Enabled:
 | |
| 		const maxExcludedPrefixes = 10
 | |
| 		if len(v.ExcludedPrefixes) > maxExcludedPrefixes {
 | |
| 			return errTooManyExcludedPrefixes
 | |
| 		}
 | |
| 
 | |
| 	case Suspended:
 | |
| 		if len(v.ExcludedPrefixes) > 0 {
 | |
| 			return errExcludedPrefixNotSupported
 | |
| 		}
 | |
| 	default:
 | |
| 		return Errorf("unsupported Versioning status %s", v.Status)
 | |
| 	}
 | |
| 	return nil
 | |
| }
 | |
| 
 | |
| // Enabled - returns true if versioning is enabled
 | |
| func (v Versioning) Enabled() bool {
 | |
| 	return v.Status == Enabled
 | |
| }
 | |
| 
 | |
| // Versioned returns if 'prefix' has versioning enabled or suspended.
 | |
| func (v Versioning) Versioned(prefix string) bool {
 | |
| 	return v.PrefixEnabled(prefix) || v.PrefixSuspended(prefix)
 | |
| }
 | |
| 
 | |
| // PrefixEnabled - returns true if versioning is enabled at the bucket and given
 | |
| // prefix, false otherwise.
 | |
| func (v Versioning) PrefixEnabled(prefix string) bool {
 | |
| 	if v.Status != Enabled {
 | |
| 		return false
 | |
| 	}
 | |
| 
 | |
| 	if prefix == "" {
 | |
| 		return true
 | |
| 	}
 | |
| 	if v.ExcludeFolders && strings.HasSuffix(prefix, "/") {
 | |
| 		return false
 | |
| 	}
 | |
| 
 | |
| 	for _, sprefix := range v.ExcludedPrefixes {
 | |
| 		// Note: all excluded prefix patterns end with `/` (See Validate)
 | |
| 		sprefix.Prefix += "*"
 | |
| 
 | |
| 		if matched := wildcard.MatchSimple(sprefix.Prefix, prefix); matched {
 | |
| 			return false
 | |
| 		}
 | |
| 	}
 | |
| 	return true
 | |
| }
 | |
| 
 | |
| // Suspended - returns true if versioning is suspended
 | |
| func (v Versioning) Suspended() bool {
 | |
| 	return v.Status == Suspended
 | |
| }
 | |
| 
 | |
| // PrefixSuspended - returns true if versioning is suspended at the bucket level
 | |
| // or suspended on the given prefix.
 | |
| func (v Versioning) PrefixSuspended(prefix string) bool {
 | |
| 	if v.Status == Suspended {
 | |
| 		return true
 | |
| 	}
 | |
| 	if v.Status == Enabled {
 | |
| 		if prefix == "" {
 | |
| 			return false
 | |
| 		}
 | |
| 		if v.ExcludeFolders && strings.HasSuffix(prefix, "/") {
 | |
| 			return true
 | |
| 		}
 | |
| 
 | |
| 		for _, sprefix := range v.ExcludedPrefixes {
 | |
| 			// Note: all excluded prefix patterns end with `/` (See Validate)
 | |
| 			sprefix.Prefix += "*"
 | |
| 			if matched := wildcard.MatchSimple(sprefix.Prefix, prefix); matched {
 | |
| 				return true
 | |
| 			}
 | |
| 		}
 | |
| 	}
 | |
| 	return false
 | |
| }
 | |
| 
 | |
| // PrefixesExcluded returns true if v contains one or more excluded object
 | |
| // prefixes or if ExcludeFolders is true.
 | |
| func (v Versioning) PrefixesExcluded() bool {
 | |
| 	return len(v.ExcludedPrefixes) > 0 || v.ExcludeFolders
 | |
| }
 | |
| 
 | |
| // ParseConfig - parses data in given reader to VersioningConfiguration.
 | |
| func ParseConfig(reader io.Reader) (*Versioning, error) {
 | |
| 	var v Versioning
 | |
| 	if err := xml.NewDecoder(reader).Decode(&v); err != nil {
 | |
| 		return nil, err
 | |
| 	}
 | |
| 	if err := v.Validate(); err != nil {
 | |
| 		return nil, err
 | |
| 	}
 | |
| 	return &v, nil
 | |
| }
 |