From cf335f6c637ac5f1126ea39bf4033a8368710525 Mon Sep 17 00:00:00 2001 From: Harshavardhana Date: Tue, 27 Apr 2021 10:04:08 -0700 Subject: [PATCH] service accounts should use LDAP user DN to assign credentials (#12166) LDAP DN should be used when allowing setting service accounts for LDAP users instead of just simple user, Bonus root owner should be allowed full access to all service account APIs. Signed-off-by: Harshavardhana --- cmd/admin-handlers-users.go | 27 ++------------------------- 1 file changed, 2 insertions(+), 25 deletions(-) diff --git a/cmd/admin-handlers-users.go b/cmd/admin-handlers-users.go index 99644cb69..252bf35ea 100644 --- a/cmd/admin-handlers-users.go +++ b/cmd/admin-handlers-users.go @@ -522,11 +522,12 @@ func (a adminAPIHandlers) AddServiceAccount(w http.ResponseWriter, r *http.Reque // If LDAP enabled, service accounts need // to be created only for LDAP users. var err error - _, targetGroups, err = globalLDAPConfig.LookupUserDN(targetUser) + targetUser, targetGroups, err = globalLDAPConfig.LookupUserDN(targetUser) if err != nil { writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL) return } + // targerUser is set to bindDN at this point in time. } else { if targetUser == "" { targetUser = cred.AccessKey @@ -599,12 +600,6 @@ func (a adminAPIHandlers) UpdateServiceAccount(w http.ResponseWriter, r *http.Re return } - // Disallow editing service accounts by root user. - if owner { - writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrAdminAccountNotEligible), r.URL) - return - } - svcAccount, _, err := globalIAMSys.GetServiceAccount(ctx, accessKey) if err != nil { writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL) @@ -679,12 +674,6 @@ func (a adminAPIHandlers) InfoServiceAccount(w http.ResponseWriter, r *http.Requ return } - // Disallow creating service accounts by root user. - if owner { - writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrAdminAccountNotEligible), r.URL) - return - } - accessKey := mux.Vars(r)["accessKey"] if accessKey == "" { writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrInvalidRequest), r.URL) @@ -778,12 +767,6 @@ func (a adminAPIHandlers) ListServiceAccounts(w http.ResponseWriter, r *http.Req return } - // Disallow creating service accounts by root user. - if owner { - writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrAdminAccountNotEligible), r.URL) - return - } - var targetAccount string user := r.URL.Query().Get("user") @@ -856,12 +839,6 @@ func (a adminAPIHandlers) DeleteServiceAccount(w http.ResponseWriter, r *http.Re return } - // Disallow creating service accounts by root user. - if owner { - writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrAdminAccountNotEligible), r.URL) - return - } - serviceAccount := mux.Vars(r)["accessKey"] if serviceAccount == "" { writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrAdminInvalidArgument), r.URL)