config: Avoid stale credentials in memory. (#4466)

cmd/admin-handlers.go

@@ -181,8 +181,14 @@ func (adminAPI adminAPIHandlers) ServiceCredentialsHandler(w http.ResponseWriter
 	}
 
 	// Update local credentials in memory.
-	serverConfig.SetCredential(creds)
+	prevCred := serverConfig.SetCredential(creds)
+
+	// Save credentials to config file
 	if err = serverConfig.Save(); err != nil {
+		// Save the current creds when failed to update.
+		serverConfig.SetCredential(prevCred)
+
+		errorIf(err, "Unable to update the config with new credentials.")
 		writeErrorResponse(w, ErrInternalError, r.URL)
 		return
 	}

cmd/browser-peer-rpc.go

@@ -69,11 +69,14 @@ func (br *browserPeerAPIHandlers) SetAuthPeer(args SetAuthPeerArgs, reply *AuthR
 	}
 
 	// Update credentials in memory
-	serverConfig.SetCredential(args.Creds)
+	prevCred := serverConfig.SetCredential(args.Creds)
 
 	// Save credentials to config file
 	if err := serverConfig.Save(); err != nil {
-		errorIf(err, "Error updating config file with new credentials sent from browser RPC.")
+		// Save the current creds when failed to update.
+		serverConfig.SetCredential(prevCred)
+
+		errorIf(err, "Unable to update the config with new credentials sent from browser RPC.")
 		return err
 	}
 

cmd/config-v19.go

@@ -61,11 +61,12 @@ func (s *serverConfigV19) GetVersion() string {
 	return s.Version
 }
 
-// SetRegion set new region.
+// SetRegion set a new region.
 func (s *serverConfigV19) SetRegion(region string) {
 	s.Lock()
 	defer s.Unlock()
 
+	// Save new region.
 	s.Region = region
 }
 
@@ -77,13 +78,19 @@ func (s *serverConfigV19) GetRegion() string {
 	return s.Region
 }
 
-// SetCredentials set new credentials.
-func (s *serverConfigV19) SetCredential(creds credential) {
+// SetCredentials set new credentials. SetCredential returns the previous credential.
+func (s *serverConfigV19) SetCredential(creds credential) (prevCred credential) {
 	s.Lock()
 	defer s.Unlock()
 
+	// Save previous credential.
+	prevCred = s.Credential
+
 	// Set updated credential.
 	s.Credential = creds
+
+	// Return previous credential.
+	return prevCred
 }
 
 // GetCredentials get current credentials.

cmd/web-handlers.go

@@ -405,10 +405,13 @@ func (web *webAPIHandlers) SetAuth(r *http.Request, args *SetAuthArgs, reply *Se
 	errsMap := updateCredsOnPeers(creds)
 
 	// Update local credentials
-	serverConfig.SetCredential(creds)
+	prevCred := serverConfig.SetCredential(creds)
 
 	// Persist updated credentials.
 	if err = serverConfig.Save(); err != nil {
+		// Save the current creds when failed to update.
+		serverConfig.SetCredential(prevCred)
+
 		errsMap[globalMinioAddr] = err
 	}