/vsiswift/: expiration of SWIFT_AUTH_TOKEN doesn't make RasterIO() to fail

[talaj]

Expected behavior and actual behavior.

When SWIFT_AUTH_TOKEN expire, swift begins to return 401.
This behavior is documented here:
https://docs.openstack.org/swift/queens/api/authentication.html

In such case I would expect RasterIO() call to fail so user can handle it somehow.
Instead the call silently returns empty data.

With debugging on, I can see

VSICURL: Got response_code=401

which comes from here:

gdal/gdal/port/cpl_vsil_curl.cpp

Line 1335 in ef49c00

CPLDebug("VSICURL", "Got response_code=%ld", response_code);

I don't see any error handling in VSICurlHandle::DownloadRegion, it just returns empty string.

Steps to reproduce the problem.

Either it is possible to wait a day to let the token expire, or it is possible to make a small change to code to take the token always from config map, when constructing headers. It is then possible to change the token to invalid one.

diff --git a/gdal/port/cpl_swift.cpp b/gdal/port/cpl_swift.cpp
index 45155ac5d3..30662b63a5 100644
--- a/gdal/port/cpl_swift.cpp
+++ b/gdal/port/cpl_swift.cpp
@@ -52,13 +52,14 @@ static CPLString g_osLastAuthToken;
 /************************************************************************/

 static
-struct curl_slist* GetSwiftHeaders( const CPLString& osAuthToken )
+struct curl_slist* GetSwiftHeaders( const CPLString& )
 {
     struct curl_slist *headers=nullptr;
     headers = curl_slist_append(
         headers, "Accept: application/json");
+    const char * osAuthToken = CPLGetConfigOption("SWIFT_AUTH_TOKEN", "");
     headers = curl_slist_append(
-        headers, CPLSPrintf("x-auth-token: %s", osAuthToken.c_str()));
+        headers, CPLSPrintf("x-auth-token: %s", osAuthToken));
     return headers;
 }

Operating system

Debian Buster

GDAL version and provenance

The latest master from github.

[rouault]

A more appropriate / general fix would be to handle token expiration, and re-issue a request for a token for the case where the user doesn't provide SWIFT_AUTH_TOKEN, but uses SWIFT_AUTH_V1_URL + SWIFT_USER + SWIFT_KEY

[talaj]

I'm willing to implement the refresh of the token by SWIFT_AUTH_V1_URL. I would also like to add V3 interface for authentication.
If you would have some tips where to put the code that would be much appreciated.

[rouault]

port/cpl_swift.cpp for authentication logic and port/cpl_vsil_swift.cpp for virtual file system logic.

For the refresh, there is some logic in port/cpl_aws.cpp (which may not work according to #1593 (comment)). Not completely sure if that can help or is a model for inspiration

[rouault]

Fixed per #2296