mirror of
https://github.com/versity/versitygw.git
synced 2026-10-22 14:22:40 +00:00
niksis02
c99f9ba757
Fixes #2445 The S3 auth middlewares (header, presigned and POST) return 403 `InvalidAccessKeyId` only when the IAM lookup returns exactly `auth.ErrNoSuchUser`, since they compare with `==`. Three IAM backends returned a different error for an unknown access key, and the client received that error unchanged. The root-only `IAMServiceSingle` returned the admin API's `ErrAdminUserNotFound`, so clients got 404 `XAdminUserNotFound`, which tools such as pgBackRest and rclone read as missing data rather than bad credentials. It now returns `ErrNoSuchUser`. The `ErrAdminUserNotFound` check in `resolveAccountsByLookup` is removed because no backend returns that error anymore. In the Vault backend, `KvV2Read` of a missing key fails with a 404, which was passed through and rendered as 500 `InternalError`. The same error broke the admin `create-bucket`, `change-bucket-owner` and `update-user` commands for unknown users, which returned 500 instead of `XAdminUserNotFound`. `GetUserAccount` now maps a 404 to `ErrNoSuchUser` on both the initial read and the retry after re-authentication, the same way `ListUserAccounts` already handles 404. FreeIPA reports a missing object as `NotFound` (code `4001`), both from `user_show` for an unknown user and from `vault_retrieve_internal` for a user who has no S3 vault. Both cases rendered as 500. `rpcInternal` now returns `errRpcNotFound`, which wraps `errRpc`, for code `4001`, and `GetUserAccount` maps it to `ErrNoSuchUser` in both places. A user without the vault has no S3 secret, so it is treated as a nonexistent account, and the PKCS#1 v1.5 to OAEP retry is skipped in that case.
72 lines
2.2 KiB
Go
72 lines
2.2 KiB
Go
// Copyright 2023 Versity Software
|
|
// This file is licensed under the Apache License, Version 2.0
|
|
// (the "License"); you may not use this file except in compliance
|
|
// with the License. You may obtain a copy of the License at
|
|
//
|
|
// http://www.apache.org/licenses/LICENSE-2.0
|
|
//
|
|
// Unless required by applicable law or agreed to in writing,
|
|
// software distributed under the License is distributed on an
|
|
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
|
|
// KIND, either express or implied. See the License for the
|
|
// specific language governing permissions and limitations
|
|
// under the License.
|
|
|
|
package auth
|
|
|
|
import (
|
|
"github.com/versity/versitygw/s3err"
|
|
)
|
|
|
|
// IAMServiceSingle manages the single tenant (root-only) IAM service
|
|
type IAMServiceSingle struct {
|
|
root Account
|
|
}
|
|
|
|
var _ IAMService = &IAMServiceSingle{}
|
|
|
|
func NewIAMServiceSingle(r Account) IAMService {
|
|
return &IAMServiceSingle{
|
|
root: r,
|
|
}
|
|
}
|
|
|
|
// CreateAccount not valid in single tenant mode
|
|
func (IAMServiceSingle) CreateAccount(account Account) error {
|
|
return s3err.GetAPIError(s3err.ErrAdminMethodNotSupported)
|
|
}
|
|
|
|
// GetUserAccount returns root account, if the root access key
|
|
// is provided and ErrNoSuchUser otherwise
|
|
func (s IAMServiceSingle) GetUserAccount(access string) (Account, error) {
|
|
if access == s.root.Access {
|
|
return s.root, nil
|
|
}
|
|
return Account{}, ErrNoSuchUser
|
|
}
|
|
|
|
// ResolveAccounts returns the subset of accessKeyIDs that do not exist.
|
|
func (s IAMServiceSingle) ResolveAccounts(accessKeyIDs []string) ([]string, error) {
|
|
return resolveAccountsByLookup(accessKeyIDs, s.GetUserAccount)
|
|
}
|
|
|
|
// UpdateUserAccount no accounts in single tenant mode
|
|
func (IAMServiceSingle) UpdateUserAccount(access string, props MutableProps) error {
|
|
return s3err.GetAPIError(s3err.ErrAdminMethodNotSupported)
|
|
}
|
|
|
|
// DeleteUserAccount no accounts in single tenant mode
|
|
func (IAMServiceSingle) DeleteUserAccount(access string) error {
|
|
return s3err.GetAPIError(s3err.ErrAdminMethodNotSupported)
|
|
}
|
|
|
|
// ListUserAccounts no accounts in single tenant mode
|
|
func (IAMServiceSingle) ListUserAccounts() ([]Account, error) {
|
|
return []Account{}, s3err.GetAPIError(s3err.ErrAdminMethodNotSupported)
|
|
}
|
|
|
|
// Shutdown graceful termination of service
|
|
func (IAMServiceSingle) Shutdown() error {
|
|
return nil
|
|
}
|