PR #10014 was not complete as only handled policy claims partially.
Showing the changes to cmd/auth-handler.go (1 of 5 files). Show all
Unified · Split
| @@ -213,15 +213,15 @@ func getClaimsFromToken(r *http.Request, token string) (map[string]interface{}, · 212 unmodified lines | |||
| 213 | 213 | ||
| 214 | if globalPolicyOPA == nil { | 214 | if globalPolicyOPA == nil { |
| 215 | // If OPA is not set and if ldap claim key is set, allow the claim. | 215 | // If OPA is not set and if ldap claim key is set, allow the claim. |
| 216 | if _, ok := claims.Lookup(ldapUser); ok { | 216 | if _, ok := claims.MapClaims[ldapUser]; ok { |
| 217 | return claims.Map(), nil | 217 | return claims.Map(), nil |
| 218 | } | 218 | } |
| 219 | 219 | ||
| 220 | // If OPA is not set, session token should | 220 | // If OPA is not set, session token should |
| 221 | // have a policy and its mandatory, reject | 221 | // have a policy and its mandatory, reject |
| 222 | // requests without policy claim. | 222 | // requests without policy claim. |
| 223 | _, pokOpenID := claims.Lookup(iamPolicyClaimNameOpenID()) | 223 | _, pokOpenID := claims.MapClaims[iamPolicyClaimNameOpenID()] |
| 224 | _, pokSA := claims.Lookup(iamPolicyClaimNameSA()) | 224 | _, pokSA := claims.MapClaims[iamPolicyClaimNameSA()] |
| 225 | if !pokOpenID && !pokSA { | 225 | if !pokOpenID && !pokSA { |
| 226 | return nil, errAuthentication | 226 | return nil, errAuthentication |
| 227 | } | 227 | } |
| @@ -360,6 +360,7 @@ func checkRequestAuthTypeToAccessKey(ctx context.Context, r *http.Request, actio · 132 unmodified lines | |||
| 360 | // Request is allowed return the appropriate access key. | 360 | // Request is allowed return the appropriate access key. |
| 361 | return cred.AccessKey, owner, ErrNone | 361 | return cred.AccessKey, owner, ErrNone |
| 362 | } | 362 | } |
| 363 | |||
| 363 | return cred.AccessKey, owner, ErrAccessDenied | 364 | return cred.AccessKey, owner, ErrAccessDenied |
| 364 | } | 365 | } |
| 365 | 366 | ||