PR #10014 was not complete as only handled policy claims partially.
Showing the changes to cmd/auth-handler.go (1 of 5 files). Show all
Unified · Split
| @@ -213,15 +213,15 @@ func getClaimsFromToken(r *http.Request, token string) (map[string]interface{}, · 212 unmodified lines | ||
| 213 | 213 | |
| 214 | 214 | if globalPolicyOPA == nil { |
| 215 | 215 | // If OPA is not set and if ldap claim key is set, allow the claim. |
| 216 | − if _, ok := claims.Lookup(ldapUser); ok { | |
| 216 | + if _, ok := claims.MapClaims[ldapUser]; ok { | |
| 217 | 217 | return claims.Map(), nil |
| 218 | 218 | } |
| 219 | 219 | |
| 220 | 220 | // If OPA is not set, session token should |
| 221 | 221 | // have a policy and its mandatory, reject |
| 222 | 222 | // requests without policy claim. |
| 223 | − _, pokOpenID := claims.Lookup(iamPolicyClaimNameOpenID()) | |
| 224 | − _, pokSA := claims.Lookup(iamPolicyClaimNameSA()) | |
| 223 | + _, pokOpenID := claims.MapClaims[iamPolicyClaimNameOpenID()] | |
| 224 | + _, pokSA := claims.MapClaims[iamPolicyClaimNameSA()] | |
| 225 | 225 | if !pokOpenID && !pokSA { |
| 226 | 226 | return nil, errAuthentication |
| 227 | 227 | } |
| @@ -360,6 +360,7 @@ func checkRequestAuthTypeToAccessKey(ctx context.Context, r *http.Request, actio · 132 unmodified lines | ||
| 360 | 360 | // Request is allowed return the appropriate access key. |
| 361 | 361 | return cred.AccessKey, owner, ErrNone |
| 362 | 362 | } |
| 363 | + | |
| 363 | 364 | return cred.AccessKey, owner, ErrAccessDenied |
| 364 | 365 | } |
| 365 | 366 | |