From 9ed4fc96870576075d374324600192d839beae06 Mon Sep 17 00:00:00 2001 From: Aditya Manthramurthy Date: Sat, 25 Feb 2023 21:01:37 -0800 Subject: [PATCH] Remove globalOpenIDConfig (#16708) --- cmd/admin-handlers-idp-config.go | 8 ++++---- cmd/common-main.go | 5 +++-- cmd/globals.go | 2 -- cmd/iam.go | 13 ++++++------- cmd/site-replication.go | 2 +- cmd/sts-handlers.go | 2 +- cmd/utils.go | 2 +- 7 files changed, 16 insertions(+), 18 deletions(-) diff --git a/cmd/admin-handlers-idp-config.go b/cmd/admin-handlers-idp-config.go index dc64476c6..21067fc75 100644 --- a/cmd/admin-handlers-idp-config.go +++ b/cmd/admin-handlers-idp-config.go @@ -178,7 +178,7 @@ func handleCreateUpdateValidation(s config.Config, subSys, cfgTarget string, isU var cfgInfos []madmin.IDPCfgInfo switch subSys { case madmin.IdentityOpenIDSubSys: - cfgInfos, _ = globalOpenIDConfig.GetConfigInfo(s, cfgTarget) + cfgInfos, _ = globalIAMSys.OpenIDConfig.GetConfigInfo(s, cfgTarget) case madmin.IdentityLDAPSubSys: cfgInfos, _ = globalIAMSys.LDAPConfig.GetConfigInfo(s, cfgTarget) } @@ -240,7 +240,7 @@ func (a adminAPIHandlers) ListIdentityProviderCfg(w http.ResponseWriter, r *http switch idpCfgType { case madmin.OpenidIDPCfg: cfg := globalServerConfig.Clone() - cfgList, err = globalOpenIDConfig.GetConfigList(cfg) + cfgList, err = globalIAMSys.OpenIDConfig.GetConfigList(cfg) case madmin.LDAPIDPCfg: cfg := globalServerConfig.Clone() cfgList, err = globalIAMSys.LDAPConfig.GetConfigList(cfg) @@ -296,7 +296,7 @@ func (a adminAPIHandlers) GetIdentityProviderCfg(w http.ResponseWriter, r *http. var err error switch idpCfgType { case madmin.OpenidIDPCfg: - cfgInfos, err = globalOpenIDConfig.GetConfigInfo(cfg, cfgName) + cfgInfos, err = globalIAMSys.OpenIDConfig.GetConfigInfo(cfg, cfgName) case madmin.LDAPIDPCfg: cfgInfos, err = globalIAMSys.LDAPConfig.GetConfigInfo(cfg, cfgName) } @@ -355,7 +355,7 @@ func (a adminAPIHandlers) DeleteIdentityProviderCfg(w http.ResponseWriter, r *ht switch idpCfgType { case madmin.OpenidIDPCfg: subSys = config.IdentityOpenIDSubSys - cfgInfos, err := globalOpenIDConfig.GetConfigInfo(cfgCopy, cfgName) + cfgInfos, err := globalIAMSys.OpenIDConfig.GetConfigInfo(cfgCopy, cfgName) if err != nil { if errors.Is(err, openid.ErrProviderConfigNotFound) { writeErrorResponseJSON(ctx, w, errorCodes.ToAPIErr(ErrAdminNoSuchConfigTarget), r.URL) diff --git a/cmd/common-main.go b/cmd/common-main.go index 126501b35..beb666cc7 100644 --- a/cmd/common-main.go +++ b/cmd/common-main.go @@ -215,8 +215,9 @@ func minioConfigToConsoleFeatures() { } func buildOpenIDConsoleConfig() consoleoauth2.OpenIDPCfg { - m := make(map[string]consoleoauth2.ProviderConfig, len(globalOpenIDConfig.ProviderCfgs)) - for name, cfg := range globalOpenIDConfig.ProviderCfgs { + pcfgs := globalIAMSys.OpenIDConfig.ProviderCfgs + m := make(map[string]consoleoauth2.ProviderConfig, len(pcfgs)) + for name, cfg := range pcfgs { callback := getConsoleEndpoints()[0] + "/oauth_callback" if cfg.RedirectURI != "" { callback = cfg.RedirectURI diff --git a/cmd/globals.go b/cmd/globals.go index f0fc39104..8986d93f6 100644 --- a/cmd/globals.go +++ b/cmd/globals.go @@ -42,7 +42,6 @@ import ( "github.com/minio/minio/internal/config/callhome" "github.com/minio/minio/internal/config/compress" "github.com/minio/minio/internal/config/dns" - "github.com/minio/minio/internal/config/identity/openid" idplugin "github.com/minio/minio/internal/config/identity/plugin" xtls "github.com/minio/minio/internal/config/identity/tls" polplugin "github.com/minio/minio/internal/config/policy/plugin" @@ -200,7 +199,6 @@ var ( globalStorageClass storageclass.Config - globalOpenIDConfig openid.Config globalSTSTLSConfig xtls.Config globalAuthNPlugin *idplugin.AuthNPlugin diff --git a/cmd/iam.go b/cmd/iam.go index 4bbdbb273..ccb3e7dbe 100644 --- a/cmd/iam.go +++ b/cmd/iam.go @@ -88,7 +88,7 @@ type IAMSys struct { iamRefreshInterval time.Duration LDAPConfig xldap.Config // only valid if usersSysType is LDAPUsers - openIDConfig openid.Config // only valid if OpenID is configured + OpenIDConfig openid.Config // only valid if OpenID is configured usersSysType UsersSysType @@ -213,8 +213,7 @@ func (sys *IAMSys) Init(ctx context.Context, objAPI ObjectLayer, etcdClient *etc s := globalServerConfig globalServerConfigMu.RUnlock() - var err error - globalOpenIDConfig, err = openid.LookupConfig(s, + openidConfig, err := openid.LookupConfig(s, NewHTTPTransport(), xhttp.DrainBody, globalSite.Region) if err != nil { logger.LogIf(ctx, fmt.Errorf("Unable to initialize OpenID: %w", err)) @@ -258,7 +257,7 @@ func (sys *IAMSys) Init(ctx context.Context, objAPI ObjectLayer, etcdClient *etc defer sys.Unlock() sys.LDAPConfig = ldapConfig - sys.openIDConfig = globalOpenIDConfig.Clone() + sys.OpenIDConfig = openidConfig sys.iamRefreshInterval = iamRefreshInterval // Initialize IAM store @@ -322,7 +321,7 @@ func (sys *IAMSys) Init(ctx context.Context, objAPI ObjectLayer, etcdClient *etc // Set up polling for expired accounts and credentials purging. switch { - case sys.openIDConfig.ProviderEnabled(): + case sys.OpenIDConfig.ProviderEnabled(): go func() { timer := time.NewTimer(refreshInterval) defer timer.Stop() @@ -363,7 +362,7 @@ func (sys *IAMSys) Init(ctx context.Context, objAPI ObjectLayer, etcdClient *etc sys.rolesMap = make(map[arn.ARN]string) // From OpenID - if riMap := globalOpenIDConfig.GetRoleInfo(); riMap != nil { + if riMap := sys.OpenIDConfig.GetRoleInfo(); riMap != nil { sys.validateAndAddRolePolicyMappings(ctx, riMap) } @@ -1280,7 +1279,7 @@ func (sys *IAMSys) purgeExpiredCredentialsForExternalSSO(ctx context.Context) { continue } roleArn = roleArns[0] - u, err := sys.openIDConfig.LookupUser(roleArn, puInfo.subClaimValue) + u, err := sys.OpenIDConfig.LookupUser(roleArn, puInfo.subClaimValue) if err != nil { logger.LogIf(GlobalContext, err) continue diff --git a/cmd/site-replication.go b/cmd/site-replication.go index f0eeee875..d3cfbc1b5 100644 --- a/cmd/site-replication.go +++ b/cmd/site-replication.go @@ -605,7 +605,7 @@ func (c *SiteReplicationSys) GetIDPSettings(ctx context.Context) madmin.IDPSetti LDAPGroupSearchBase: globalIAMSys.LDAPConfig.LDAP.GroupSearchBaseDistName, LDAPGroupSearchFilter: globalIAMSys.LDAPConfig.LDAP.GroupSearchFilter, } - s.OpenID = globalOpenIDConfig.GetSettings() + s.OpenID = globalIAMSys.OpenIDConfig.GetSettings() if s.OpenID.Enabled { s.OpenID.Region = globalSite.Region } diff --git a/cmd/sts-handlers.go b/cmd/sts-handlers.go index 4ba02eecb..b01872ca9 100644 --- a/cmd/sts-handlers.go +++ b/cmd/sts-handlers.go @@ -361,7 +361,7 @@ func (sts *stsAPIHandlers) AssumeRoleWithSSO(w http.ResponseWriter, r *http.Requ } // Validate JWT; check clientID in claims matches the one associated with the roleArn - if err := globalOpenIDConfig.Validate(r.Context(), roleArn, token, accessToken, r.Form.Get(stsDurationSeconds), claims); err != nil { + if err := globalIAMSys.OpenIDConfig.Validate(r.Context(), roleArn, token, accessToken, r.Form.Get(stsDurationSeconds), claims); err != nil { switch err { case openid.ErrTokenExpired: switch action { diff --git a/cmd/utils.go b/cmd/utils.go index 10724a41a..fc30b1758 100644 --- a/cmd/utils.go +++ b/cmd/utils.go @@ -920,7 +920,7 @@ func getMinioMode() string { } func iamPolicyClaimNameOpenID() string { - return globalOpenIDConfig.GetIAMPolicyClaimName() + return globalIAMSys.OpenIDConfig.GetIAMPolicyClaimName() } func iamPolicyClaimNameSA() string {