-
Notifications
You must be signed in to change notification settings - Fork 588
HDDS-14067. [STS] Plumbing and CLI utility to revoke STS token #9507
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: HDDS-13323-sts
Are you sure you want to change the base?
Conversation
2070528 to
da222e0
Compare
| OMException.ResultCodes.INVALID_REQUEST); | ||
| // Only S3/Ozone admins can revoke STS tokens by temporary access key ID. | ||
| final UserGroupInformation ugi = S3SecretRequestHelper.getOrCreateUgi(getUserInfo().getUserName()); | ||
| if (!ozoneManager.isS3Admin(ugi)) { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Shall we allow the user who creates the temporal access ID and session tokens, to revoke the tokens?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
If we have the access key ID as the only input parameter to the CLI utility that revokes STS tokens, we wouldn't know who the user was that created the token. (The previous implementation that took both the access key ID and the session token as parameters to the CLI utility had the capability to allow the user who created the temporal access ID to revoke the token, but this was a change to the design that was not agreed upon in Slack discussions, so this PR modified that implementation). If we use the session token instead of access key ID as the one input to the CLI utility, then we would know who created the token, but this would again be a change to the design. Please let me know if you prefer the design to be changed in this way to allow the user who created the token to revoke the token.
| throw new OMException("Access Key ID in request does not match the session token", | ||
| OMException.ResultCodes.INVALID_REQUEST); | ||
| // Only S3/Ozone admins can revoke STS tokens by temporary access key ID. | ||
| final UserGroupInformation ugi = S3SecretRequestHelper.getOrCreateUgi(getUserInfo().getUserName()); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Please assign getUserInfo() to a local variable, so that we can avoid call getUserInfo() again in the following omRequest construction.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
updated
Please describe your PR in detail:
What is the link to the Apache JIRA
https://issues.apache.org/jira/browse/HDDS-14067
How was this patch tested?
unit tests (and prototype)