Skip to content

Conversation

@fmorg-git
Copy link
Contributor

@fmorg-git fmorg-git commented Dec 16, 2025

Please describe your PR in detail:

  • Plumbing and CLI utility to revoke STS token. The CLI utility is invoked like in the following example:
ozone s3 revokeststoken -k ASIALMO9PNUEKTDPTWM4
Enter 'y' to confirm STS token revocation for accessKeyId 'ASIALMO9PNUEKTDPTWM4': y
STS token revoked for accessKeyId 'ASIALMO9PNUEKTDPTWM4'.

What is the link to the Apache JIRA

https://issues.apache.org/jira/browse/HDDS-14067

How was this patch tested?

unit tests (and prototype)

@fmorg-git fmorg-git changed the base branch from master to HDDS-13323-sts December 16, 2025 00:12
@fmorg-git fmorg-git marked this pull request as draft December 16, 2025 00:19
@Tejaskriya Tejaskriya added the sts Changes for Ozone's S3 Security Token Service label Dec 16, 2025
@fmorg-git fmorg-git marked this pull request as ready for review December 18, 2025 00:09
OMException.ResultCodes.INVALID_REQUEST);
// Only S3/Ozone admins can revoke STS tokens by temporary access key ID.
final UserGroupInformation ugi = S3SecretRequestHelper.getOrCreateUgi(getUserInfo().getUserName());
if (!ozoneManager.isS3Admin(ugi)) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Shall we allow the user who creates the temporal access ID and session tokens, to revoke the tokens?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If we have the access key ID as the only input parameter to the CLI utility that revokes STS tokens, we wouldn't know who the user was that created the token. (The previous implementation that took both the access key ID and the session token as parameters to the CLI utility had the capability to allow the user who created the temporal access ID to revoke the token, but this was a change to the design that was not agreed upon in Slack discussions, so this PR modified that implementation). If we use the session token instead of access key ID as the one input to the CLI utility, then we would know who created the token, but this would again be a change to the design. Please let me know if you prefer the design to be changed in this way to allow the user who created the token to revoke the token.

throw new OMException("Access Key ID in request does not match the session token",
OMException.ResultCodes.INVALID_REQUEST);
// Only S3/Ozone admins can revoke STS tokens by temporary access key ID.
final UserGroupInformation ugi = S3SecretRequestHelper.getOrCreateUgi(getUserInfo().getUserName());
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please assign getUserInfo() to a local variable, so that we can avoid call getUserInfo() again in the following omRequest construction.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

updated

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

sts Changes for Ozone's S3 Security Token Service

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants