From d98faeb26a39343d77959ff642aad7752d3ce4c5 Mon Sep 17 00:00:00 2001 From: Taran Pelkey Date: Mon, 3 Jun 2024 15:58:48 -0400 Subject: [PATCH] Check if LDAP User has attached policy before creating Service Account (#19843) Check if ldap user has policy before creating --- cmd/admin-handlers-idp-ldap.go | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/cmd/admin-handlers-idp-ldap.go b/cmd/admin-handlers-idp-ldap.go index 6dec56cbc..2da48e23d 100644 --- a/cmd/admin-handlers-idp-ldap.go +++ b/cmd/admin-handlers-idp-ldap.go @@ -20,6 +20,7 @@ package cmd import ( "encoding/json" "errors" + "fmt" "io" "net/http" "strings" @@ -284,6 +285,18 @@ func (a adminAPIHandlers) AddServiceAccountLDAP(w http.ResponseWriter, r *http.R opts.claims[ldapUser] = targetUser // DN opts.claims[ldapActualUser] = lookupResult.ActualDN + // Check if this user or their groups have a policy applied. + ldapPolicies, err := globalIAMSys.PolicyDBGet(targetUser, targetGroups...) + if err != nil { + writeErrorResponseJSON(ctx, w, toAdminAPIErr(ctx, err), r.URL) + return + } + if len(ldapPolicies) == 0 { + err = fmt.Errorf("No policy set for user `%s` or any of their groups: `%s`", opts.claims[ldapActualUser], strings.Join(targetGroups, "`,`")) + writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErrWithErr(ErrAdminNoSuchUser, err), r.URL) + return + } + // Add LDAP attributes that were looked up into the claims. for attribKey, attribValue := range lookupResult.Attributes { opts.claims[ldapAttribPrefix+attribKey] = attribValue