Restrict access keys for users and groups to not allow '=' or ','

[taran-p]

Community Contribution License

All community contributions in this pull request are licensed to the project maintainers
under the terms of the Apache 2 license.
By creating this pull request I represent that I have the right to license the
contributions to the project maintainers under the Apache 2 license.

Description

Returns an error if a user or group name contains the characters = or ,

Motivation and Context

Future compatibility for builtin users and LDAP

How to test this PR?

Attempt to create a new user or group with one of the restricted characters

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Optimization (provides speedup with no functional changes)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

• Fixes a regression (If yes, please add commit-id or PR # here)
• Unit tests added/updated
• Internal documentation updated
• Create a documentation update request here

[harshavardhana]

isn't this okay to allow since the entire string is sent to MinIO unperturbed and are safer to use.

What we should avoid is .., or any other path components.

[harshavardhana]

@donatello, so are we just going to restrict this according to what we agreed upon?

[donatello]

@donatello, so are we just going to restrict this according to what we agreed upon?

Yes, restricting = and , in the username and group name (and valid utf8) would be good to make the internal implementation clean and to make it possible to simultaneously support ldap with internal users/groups as these names would not conflict with ldap DNs.

[klauspost]

LGTM