From 7a0a5bdc0d9b78383c2c3fc59b0f124a463a4e06 Mon Sep 17 00:00:00 2001 From: Harshavardhana Date: Fri, 16 Apr 2021 18:18:55 -0700 Subject: [PATCH] remove legacy path for LDAP during policy map removal (#12081) Thanks to @Alevsk for noticing this nuanced behavior change between releases from 03-04 to 03-20, make sure that we handle the legacy path removal as well. --- cmd/iam.go | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/cmd/iam.go b/cmd/iam.go index 5a5af1fe1..5c21755d7 100644 --- a/cmd/iam.go +++ b/cmd/iam.go @@ -1729,7 +1729,14 @@ func (sys *IAMSys) policyDBSet(name, policyName string, userType IAMUserType, is // Handle policy mapping removal if policyName == "" { - if err := sys.store.deleteMappedPolicy(context.Background(), name, userType, isGroup); err != nil && err != errNoSuchPolicy { + if sys.usersSysType == LDAPUsersSysType { + // Add a fallback removal towards previous content that may come back + // as a ghost user due to lack of delete, this change occurred + // introduced in PR #11840 + sys.store.deleteMappedPolicy(context.Background(), name, regularUser, false) + } + err := sys.store.deleteMappedPolicy(context.Background(), name, userType, isGroup) + if err != nil && err != errNoSuchPolicy { return err } if !isGroup {