Merge commit from fork

GHSA-c9p4-xwr9-rfhx

authN/authZ creds are added to the request context so that they can be
tracked and enforced in the various subsystems. However, it was
previously a appended list (incorrectly); consequently, even if the user
has been removed from the group configuration, the user could still
log in.

Signed-off-by: Ramkumar Chinchani <rchincha.dev@gmail.com>

pkg/meta/boltdb/boltdb.go

@@ -1662,7 +1662,7 @@ func (bdw *BoltDB) SetUserGroups(ctx context.Context, groups []string) error {
 			return err
 		}
 
-		userData.Groups = append(userData.Groups, groups...)
+		userData.Groups = groups
 
 		err = bdw.setUserData(userid, tx, userData)
 

pkg/meta/dynamodb/dynamodb.go

@@ -1647,7 +1647,7 @@ func (dwr DynamoDB) SetUserGroups(ctx context.Context, groups []string) error {
 		return err
 	}
 
-	userData.Groups = append(userData.Groups, groups...)
+	userData.Groups = groups
 
 	return dwr.SetUserData(ctx, userData)
 }