Implement '--expiry' flag for 'mc admin user svcacct add & edit' #4570

kaankabalak · 2023-05-12T00:38:46Z

Description

This commit implements the --expiry flag for the mc admin user svcacct add and mc admin user svcacct edit commands, allowing users to set expiration dates for service accounts through mc.

The expiry date can be set in the following formats:

2023-06-24
2023-06-24T10:00
2023-06-24T10:00:00
2023-06-24T10:00:00Z
2023-06-24T10:00:00-07:00

Motivation and Context

We would like to implement this functionality as the APIs to set/edit expiration for service accounts already have been implemented in minio/madmin-go#170.

How to test this PR?

Build the mc binary from this branch
Create users called foobar1, foobar2, foobar3, foobar4 and foobar5 using the mc admin user add command.
Make sure that the service accounts are created successfully for the following cases where the --expiry flag is present:

$ ./mc admin user svcacct add myminio foobar1 --expiry 2023-06-24                      
$ ./mc admin user svcacct add myminio foobar2 --expiry 2023-06-24T10:00                
$ ./mc admin user svcacct add myminio foobar3 --expiry 2023-06-24T10:00:00             
$ ./mc admin user svcacct add myminio foobar4 --expiry 2023-06-24T10:00:00Z            
$ ./mc admin user svcacct add myminio foobar5 --expiry 2023-06-24T10:00:00-07:00

Make sure that service accounts with expiry values that cannot be parsed, such as the following, are not created:

$ ./mc admin user svcacct add myminio foobar1 --expiry 2023
$ ./mc admin user svcacct add myminio foobar1 --expiry 2023-06
$ ./mc admin user svcacct add myminio foobar1 --expiry 2023-06-24T
$ ./mc admin user svcacct add myminio foobar1 --expiry 2023-06-24T10
$ ./mc admin user svcacct add myminio foobar1 --expiry 2023-06-24T10:00:00Z07:00
$ ./mc admin user svcacct add myminio foobar1 --expiry RANDOM_TEXT

Make sure that service accounts can be created without the --expiry flag
For a service account with Access Key J123C4ZXEQN8RK6ND35I, make sure that it can be successfully edited as follows:

$ ./mc admin user svcacct edit myminio 'J123C4ZXEQN8RK6ND35I' --expiry 2023-08-24                      
$ ./mc admin user svcacct edit myminio 'J123C4ZXEQN8RK6ND35I' --expiry 2023-09-24T10:00                
$ ./mc admin user svcacct edit myminio 'J123C4ZXEQN8RK6ND35I' --expiry 2023-10-24T10:00:00             
$ ./mc admin user svcacct edit myminio 'J123C4ZXEQN8RK6ND35I' --expiry 2023-11-24T10:00:00Z            
$ ./mc admin user svcacct edit myminio 'J123C4ZXEQN8RK6ND35I' --expiry 2023-12-24T10:00:00-07:00

Make sure that service accounts with expiry values that cannot be parsed, such as the following, are not edited:

$ ./mc admin user svcacct edit myminio 'J123C4ZXEQN8RK6ND35I' --expiry 2023
$ ./mc admin user svcacct edit myminio 'J123C4ZXEQN8RK6ND35I' --expiry 2023-06
$ ./mc admin user svcacct edit myminio 'J123C4ZXEQN8RK6ND35I' --expiry 2023-06-24T
$ ./mc admin user svcacct edit myminio 'J123C4ZXEQN8RK6ND35I' --expiry 2023-06-24T10
$ ./mc admin user svcacct edit myminio 'J123C4ZXEQN8RK6ND35I' --expiry 2023-06-24T10:00:00Z07:00
$ ./mc admin user svcacct edit myminio 'J123C4ZXEQN8RK6ND35I' --expiry RANDOM_TEXT

Make sure that service accounts can be edited without the --expiry flag

Types of changes

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Optimization (provides speedup with no functional changes)
Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

Fixes a regression (If yes, please add commit-id or PR # here)
Unit tests added/updated
Internal documentation updated
Create a documentation update request here

shtripat · 2023-05-12T04:12:53Z

@kaankabalak while verifying edit without --expiry I see errors as below

$ ./mc admin user svcacct edit myminio foobar1 --secret-key "foobar11234"
mc: <ERROR> Unable to edit the specified service account. We encountered an internal error, please try again. (invalid argument).

$ ./mc admin user svcacct edit myminio foobar1 --expiry 2023-08-24
mc: <ERROR> Unable to edit the specified service account. We encountered an internal error, please try again. (invalid argument).

Server side I can see error as below

API: UpdateServiceAccount()
Time: 04:12:25 UTC 05/12/2023
DeploymentID: 27d30233-9448-472f-8249-e8f48dc4d953
RequestID: 175E4A108D0CDE88
RemoteHost: [::1]
Host: localhost:9000
UserAgent: MinIO (linux; amd64) madmin-go/2.0.0 mc/DEVELOPMENT.2023-05-12T00-56-01Z
Error: invalid argument (*errors.errorString)
       6: internal/logger/logger.go:258:logger.LogIf()
       5: cmd/api-errors.go:2291:cmd.toAPIErrorCode()
       4: cmd/admin-handler-utils.go:233:cmd.toAdminAPIErrCode()
       3: cmd/admin-handler-utils.go:220:cmd.toAdminAPIErr()
       2: cmd/admin-handlers-users.go:877:cmd.adminAPIHandlers.UpdateServiceAccount()
       1: net/http/server.go:2122:http.HandlerFunc.ServeHTTP()

kaankabalak · 2023-05-12T05:09:47Z

@kaankabalak while verifying edit without --expiry I see errors as below

Hi @shtripat, I can't seem to reproduce this for now, are you using the latest MinIO Server code while running these commands?

shtripat · 2023-05-12T05:18:08Z

./mc admin user svcacct edit myminio foobar1 --secret-key "foobar11234"

Yes, latest master build of minio and this PR branch of mc as below

./minio -version
minio version DEVELOPMENT.2023-05-12T00-41-33Z (commit-id=f5a20a5d06b7980c85fd010a52a0f8b2ce9c8ed7)
Runtime: go1.20.2 linux/amd64
License: GNU AGPLv3 <https://www.gnu.org/licenses/agpl-3.0.html>
Copyright: 2015-2023 MinIO, Inc.

./mc --version
mc version DEVELOPMENT.2023-05-12T00-56-01Z (commit-id=ca75c63029fcccd6b942d32ed727ef21ff4a0b32)
Runtime: go1.20.2 linux/amd64
Copyright (c) 2015-2023 MinIO, Inc.
License GNU AGPLv3 <https://www.gnu.org/licenses/agpl-3.0.html>

./mc admin user svcacct edit myminio foobar1 --secret-key "foobar11234" 
mc: <ERROR> Unable to edit the specified service account. We encountered an internal error, please try again. (invalid argument).

kaankabalak · 2023-05-12T06:40:34Z

Thanks @shtripat, I will investigate further and get back to you 👍

kaankabalak · 2023-05-16T23:55:28Z

mc admin user svcacct add myminio foobar1 --expiry 2023-06-24

My apologies @shtripat, looks like I have pasted the edit command incorrectly on the PR instructions. The following should work for a service account with access key J123C4ZXEQN8RK6ND35I. I have updated all the instructions accordingly in the first message of the PR:

./mc admin user svcacct edit myminio 'J123C4ZXEQN8RK6ND35I' --expiry 2023-09-28

shtripat · 2023-05-17T04:11:50Z

--expiry 2023-09-28

Ah yes, this works as expected. I should have looked at help of the command :(

shtripat

LGTM. Verified the changes.

shtripat · 2023-05-26T03:38:46Z

@kaankabalak please resolve the conflicts.

kaankabalak · 2023-05-26T22:03:36Z

@kaankabalak please resolve the conflicts.

Done @shtripat 👍

kaankabalak assigned kaankabalak and unassigned kaankabalak May 12, 2023

shtripat approved these changes May 17, 2023

View reviewed changes

kaankabalak mentioned this pull request May 19, 2023

List expiration dates for 'mc admin user svcacct list' command #4576

Merged

8 tasks

kaankabalak requested a review from donatello May 24, 2023 20:30

kaankabalak self-assigned this May 24, 2023

kaankabalak added 3 commits May 26, 2023 12:21

Implement '--expiry' flag to 'mc admin user svcacct add'

fd12cd1

Implement '--expiry' flag to 'mc admin user svcacct edit'

d9b04e7

Run gofumpt

ffe2a1b

kaankabalak force-pushed the svcacct-expiry branch from ca75c63 to ffe2a1b Compare May 26, 2023 21:38

kaankabalak requested a review from vadmeste May 26, 2023 22:04

Merge branch 'master' into svcacct-expiry

dacbf71

harshavardhana approved these changes May 30, 2023

View reviewed changes

harshavardhana merged commit ca1d007 into minio:master May 30, 2023

djwfyi mentioned this pull request Jun 5, 2023

[RELEASE] mc RELEASE.2023-05-30T22-41-38Z minio/docs#870

Closed

2 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Implement '--expiry' flag for 'mc admin user svcacct add & edit' #4570

Implement '--expiry' flag for 'mc admin user svcacct add & edit' #4570

kaankabalak commented May 12, 2023 •

edited

Loading

shtripat commented May 12, 2023

kaankabalak commented May 12, 2023

shtripat commented May 12, 2023 •

edited

Loading

kaankabalak commented May 12, 2023

kaankabalak commented May 16, 2023 •

edited

Loading

shtripat commented May 17, 2023 •

edited

Loading

shtripat left a comment

shtripat commented May 26, 2023

kaankabalak commented May 26, 2023

Implement '--expiry' flag for 'mc admin user svcacct add & edit' #4570

Implement '--expiry' flag for 'mc admin user svcacct add & edit' #4570

Conversation

kaankabalak commented May 12, 2023 • edited Loading

Description

Motivation and Context

How to test this PR?

Types of changes

Checklist:

shtripat commented May 12, 2023

kaankabalak commented May 12, 2023

shtripat commented May 12, 2023 • edited Loading

kaankabalak commented May 12, 2023

kaankabalak commented May 16, 2023 • edited Loading

shtripat commented May 17, 2023 • edited Loading

shtripat left a comment

Choose a reason for hiding this comment

shtripat commented May 26, 2023

kaankabalak commented May 26, 2023

kaankabalak commented May 12, 2023 •

edited

Loading

shtripat commented May 12, 2023 •

edited

Loading

kaankabalak commented May 16, 2023 •

edited

Loading

shtripat commented May 17, 2023 •

edited

Loading