scottk/vault
1
0
Fork 0
mirror of https://github.com/optim-enterprises-bv/vault.git synced 2025-10-31 18:48:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix an edge case bug that "identity_policies" is nil (#17007)

Browse Source 
* check if "identity_policies" is nil to fix cli vault login error

* add changelog

* skip add identity_policies to resp when there's no identity_policies associated in token's namespace

This is an edge case, when an entity has identity_policies associated in other namespaces but no identity_policies in this token's namespace, `identityPolicies[out.NamespaceID]` is nil, client side doesn't handle nil which raises error.

* update changelog

---------

Co-authored-by: Violet Hynes <violet.hynes@hashicorp.com>
This commit is contained in:
Tianhao Guo
2024-05-29 03:34:59 +08:00
committed by GitHub
parent 476b0d57c9
commit 2a1775f45f
3 changed files with 11 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
api/secret.go
View File

@@ -159,6 +159,10 @@ TOKEN_DONE:
goto DONE goto DONE
} }
if s.Data["identity_policies"] == nil {
goto DONE
}
sList, ok := s.Data["identity_policies"].([]string) sList, ok := s.Data["identity_policies"].([]string)
if ok { if ok {
identityPolicies = sList identityPolicies = sList

3
changelog/17007.txt Normal file
View File

@@ -0,0 +1,3 @@
```release-note:bug
auth/token: fixes an edge case bug that "identity_policies" is nil and causes cli vault login error
```

2
vault/token_store.go
View File

@@ -3435,8 +3435,10 @@ func (ts *TokenStore) handleLookup(ctx context.Context, req *logical.Request, da
return nil, err return nil, err
} }
if len(identityPolicies) != 0 { if len(identityPolicies) != 0 {
if _, ok := identityPolicies[out.NamespaceID]; ok {
resp.Data["identity_policies"] = identityPolicies[out.NamespaceID] resp.Data["identity_policies"] = identityPolicies[out.NamespaceID]
delete(identityPolicies, out.NamespaceID) delete(identityPolicies, out.NamespaceID)
}
resp.Data["external_namespace_policies"] = identityPolicies resp.Data["external_namespace_policies"] = identityPolicies
} }
} }