Repository: minio/minio (language: go)

Issue:
Panic on add-service-account Endpoint
Hi Minio Team

I tried to create an access key using the following mc command:
```
mc idp ldap accesskey create s3 ${user}
mc: <ERROR> Unable to add service account. We encountered an internal error, please try again.
```

Server log output:
```
ERRO: panic: "PUT /minio/admin/v3/idp/ldap/add-service-account": runtime error: invalid memory address or nil pointer dereference
goroutine 1000 [running]:
runtime/debug.Stack()
        runtime/debug/stack.go:26 +0x5e
github.com/minio/minio/cmd.serverMain.func10.setCriticalErrorHandler.2.1()
        github.com/minio/minio/cmd/generic-handlers.go:583 +0x99
panic({0x31155a0?, 0x74af810?})
        runtime/panic.go:792 +0x132
github.com/minio/minio/cmd.commonAddServiceAccount(_, _)
        github.com/minio/minio/cmd/admin-handlers-users.go:2962 +0xcf7
github.com/minio/minio/cmd.adminAPIHandlers.AddServiceAccountLDAP({}, {0x568f980, 0xc000ffd900}, 0xc001e38dc0)
        github.com/minio/minio/cmd/admin-handlers-idp-ldap.go:193 +0xd1
net/http.HandlerFunc.ServeHTTP(0x60281f1?, {0x568f980?, 0xc000ffd900?}, 0xc001fdf980?)
        net/http/server.go:2294 +0x29
github.com/minio/minio/cmd.adminMiddleware.func1.httpTraceHdrs.httpTrace.2({0x568f980, 0xc000ffd900}, 0xc001e38dc0)
        github.com/minio/minio/cmd/http-tracer.go:190 +0xef
github.com/minio/minio/cmd.adminMiddleware.func1({0x568f980, 0xc000ffd900}, 0xc001e38c80)
        github.com/minio/minio/cmd/admin-router.go:123 +0x29d
net/http.HandlerFunc.ServeHTTP(0x74c0c90?, {0x568f980?, 0xc000ffd900?}, 0x4?)
        net/http/server.go:2294 +0x29
github.com/klauspost/compress/gzhttp.NewWrapper.func1.1({0x568ef50, 0xc00db32000}, 0xc001e38c80)
        github.com/klauspost/compress@v1.18.0/gzhttp/compress.go:519 +0x607
net/http.HandlerFunc.ServeHTTP(0xc00db2e270?, {0x568ef50?, 0xc00db32000?}, 0x1?)
        net/http/server.go:2294 +0x29
github.com/minio/minio/cmd.setBucketForwardingMiddleware.func1({0x568ef50, 0xc00db32000}, 0xc001e38c80)
        github.com/minio/minio/cmd/generic-handlers.go:488 +0x382
net/http.HandlerFunc.ServeHTTP(0xc000d70740?, {0x568ef50?, 0xc00db32000?}, 0x0?)
        net/http/server.go:2294 +0x29
github.com/minio/minio/cmd.setUploadForwardingMiddleware.func1({0x568ef50, 0xc00db32000}, 0xc001e38c80)
        github.com/minio/minio/cmd/generic-handlers.go:601 +0x23c
net/http.HandlerFunc.ServeHTTP(0x3648200?, {0x568ef50?, 0xc00db32000?}, 0x39?)
        net/http/server.go:2294 +0x29
github.com/minio/minio/cmd.setRequestValidityMiddleware.func1({0x568ef50, 0xc00db32000}, 0xc001e38c80)
        github.com/minio/minio/cmd/generic-handlers.go:471 +0x16b8
net/http.HandlerFunc.ServeHTTP(0xc00db2e1e0?, {0x568ef50?, 0xc00db32000?}, 0x7ffffffe847768a2?)
        net/http/server.go:2294 +0x29
github.com/minio/minio/cmd.setRequestLimitMiddleware.func1({0x568ef50, 0xc00db32000}, 0xc001e38c80)
        github.com/minio/minio/cmd/generic-handlers.go:137 +0x61c
net/http.HandlerFunc.ServeHTTP(0x0?, {0x568ef50?, 0xc00db32000?}, 0x2948ce8?)
        net/http/server.go:2294 +0x29
github.com/minio/minio/cmd.setCrossDomainPolicyMiddleware.func1({0x568ef50?, 0xc00db32000?}, 0x6?)
        github.com/minio/minio/cmd/crossdomain-xml-handler.go:46 +0xc5
net/http.HandlerFunc.ServeHTTP(0xc001e38c80?, {0x568ef50?, 0xc00db32000?}, 0x0?)
        net/http/server.go:2294 +0x29
github.com/minio/minio/cmd.setBrowserRedirectMiddleware.func1({0x568ef50, 0xc00db32000}, 0xc001e38c80)
        github.com/minio/minio/cmd/generic-handlers.go:167 +0x19c
net/http.HandlerFunc.ServeHTTP(0x0?, {0x568ef50?, 0xc00db32000?}, 0x31204a7c?)
        net/http/server.go:2294 +0x29
github.com/minio/minio/cmd.setAuthMiddleware.func1({0x568ef50, 0xc00db32000}, 0xc001e38c80)
        github.com/minio/minio/cmd/auth-handler.go:654 +0x66c
net/http.HandlerFunc.ServeHTTP(0x56971d0?, {0x568ef50?, 0xc00db32000?}, 0x5651d30?)
        net/http/server.go:2294 +0x29
github.com/minio/minio/cmd.httpTracerMiddleware.func1({0x568f550, 0xc00daeeb60}, 0xc001e38b40)
        github.com/minio/minio/cmd/http-tracer.go:89 +0x362
net/http.HandlerFunc.ServeHTTP(0x34aac80?, {0x568f550?, 0xc00daeeb60?}, 0xa?)
        net/http/server.go:2294 +0x29
github.com/minio/minio/cmd.addCustomHeadersMiddleware.func1({0x568f550, 0xc00daeeb60}, 0xc001e38b40)
        github.com/minio/minio/cmd/generic-handlers.go:566 +0x3f1
net/http.HandlerFunc.ServeHTTP(0xc001e38a00?, {0x568f550?, 0xc00daeeb60?}, 0xc00d8788d8?)
        net/http/server.go:2294 +0x29
github.com/minio/mux.(*Router).ServeHTTP(0xc000c543c0, {0x568f550, 0xc00daeeb60}, 0xc000c9f400)
        github.com/minio/mux@v1.9.2/mux.go:228 +0x222
github.com/minio/minio/cmd.corsHandler.(*Cors).Handler.func2({0x568f550, 0xc00daeeb60}, 0xc000c9f400)
        github.com/rs/cors@v1.11.1/cors.go:289 +0x184
net/http.HandlerFunc.ServeHTTP(0xc1faab103119de42?, {0x568f550?, 0xc00daeeb60?}, 0x1000000408b32?)
        net/http/server.go:2294 +0x29
github.com/minio/minio/cmd.serverMain.func10.setCriticalErrorHandler.2({0x568f550?, 0xc00daeeb60?}, 0x7566ac0?)
        github.com/minio/minio/cmd/generic-handlers.go:590 +0x6c
net/http.HandlerFunc.ServeHTTP(0xc00d878b30?, {0x568f550?, 0xc00daeeb60?}, 0x6fc23ac00?)
        net/http/server.go:2294 +0x29
github.com/minio/minio/internal/http.(*Server).Init.func1({0x568f550?, 0xc00daeeb60?}, 0x1?)
        github.com/minio/minio/internal/http/server.go:118 +0x23a
net/http.HandlerFunc.ServeHTTP(0x419fa5?, {0x568f550?, 0xc00daeeb60?}, 0xc00daeeb01?)
        net/http/server.go:2294 +0x29
net/http.serverHandler.ServeHTTP({0x5685db8?}, {0x568f550?, 0xc00daeeb60?}, 0x6?)
        net/http/server.go:3301 +0x8e
net/http.(*conn).serve(0xc00d5ad170, {0x56971d0, 0xc001e4d950})
        net/http/server.go:2102 +0x625
created by net/http.(*Server).Serve in goroutine 109
        net/http/server.go:3454 +0x485
```

This error was caused by my specific setup.
The username in LDAP (Active Directory) was too long for the `sAMAccountName` attribute.
`CN` and `sAMAccountName` did not match.

```
user_dn_search_filter: (&(objectCategory=user)(sAMAccountName=%s))
```


## Your Environment
Server Version:
```
Version: RELEASE.2025-04-22T22-12-26Z (go1.24.2 linux/amd64)
```

Client Version:
```
mc --version
mc version RELEASE.2025-04-16T18-13-26Z (commit-id=b00526b153a31b36767991a4f5ce2cced435ee8e)
```


Discussion / hints:

Fix patch:
diff --git a/cmd/admin-handlers-users.go b/cmd/admin-handlers-users.go
index 8c0c744228334..b5831d3ec3d16 100644
--- a/cmd/admin-handlers-users.go
+++ b/cmd/admin-handlers-users.go
@@ -2816,7 +2816,7 @@ func commonAddServiceAccount(r *http.Request, ldap bool) (context.Context, auth.
 	denyOnly := (targetUser == cred.AccessKey || targetUser == cred.ParentUser)
 	if ldap && !denyOnly {
 		res, _ := globalIAMSys.LDAPConfig.GetValidatedDNForUsername(targetUser)
-		if res.NormDN == cred.ParentUser {
+		if res != nil && res.NormDN == cred.ParentUser {
 			denyOnly = true
 		}
 	}


Test patch: