maxmustermann/minio
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

fix: STS creds without "aud" should be honored with STS checks (#8868)

Browse source 
Fixes #8865
This commit is contained in:
Harshavardhana 2020-01-22 01:39:46 -08:00 committed by Nitish Tiwari
parent 55063906b5
commit fe5d599802
1 changed files with 7 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
cmd/iam.go
View file

@ -1367,8 +1367,13 @@ func (sys *IAMSys) IsAllowed(args iampolicy.Args) bool {
return true
}
// With claims set, we should do STS related checks and validation.
if _, ok := args.Claims["aud"]; ok {
// If the credential is temporary, perform STS related checks.
ok, err := sys.IsTempUser(args.AccountName)
if err != nil {
logger.LogIf(context.Background(), err)
return false
}
if ok {
return sys.IsAllowedSTS(args)
}