Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

rgw: use STSEngine::authenticate when post upload with x_amz_security_token #31879

Merged
merged 1 commit into from Jan 29, 2020
Merged

rgw: use STSEngine::authenticate when post upload with x_amz_security_token #31879

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
2 changes: 2 additions & 0 deletions src/rgw/rgw_common.h
View file
Open in desktop
Expand Up @@ -1648,6 +1648,7 @@ namespace rgw {
namespace auth {
namespace s3 {
class AWSBrowserUploadAbstractor;
class STSEngine;
}
class Completer;
}
Expand Down Expand Up @@ -2056,6 +2057,7 @@ struct req_state : DoutPrefixProvider {
friend class RGWPostObj_ObjStore_S3;
/* Reader. */
friend class rgw::auth::s3::AWSBrowserUploadAbstractor;
friend class rgw::auth::s3::STSEngine;

std::string access_key;
std::string signature;
Expand Down
10 changes: 8 additions & 2 deletions src/rgw/rgw_rest_s3.cc
View file
Open in desktop
Expand Up @@ -2308,7 +2308,12 @@ int RGWPostObj_ObjStore_S3::get_policy()
}
}

part_str(parts, "x-amz-security-token", &s->auth.s3_postobj_creds.x_amz_security_token);
if (part_str(parts, "x-amz-security-token", &s->auth.s3_postobj_creds.x_amz_security_token)) {
if (s->auth.s3_postobj_creds.x_amz_security_token.size() == 0) {
err_msg = "Invalid token";
return -EINVAL;
}
}

/* FIXME: this is a makeshift solution. The browser upload authentication will be
* handled by an instance of rgw::auth::Completer spawned in Handler's authorize()
Expand Down Expand Up @@ -5099,7 +5104,8 @@ rgw::auth::s3::STSEngine::authenticate(
const req_state* const s) const
{
if (! s->info.args.exists("X-Amz-Security-Token") &&
! s->info.env->exists("HTTP_X_AMZ_SECURITY_TOKEN")) {
! s->info.env->exists("HTTP_X_AMZ_SECURITY_TOKEN") &&
s->auth.s3_postobj_creds.x_amz_security_token.empty()) {
return result_t::deny();
}

Expand Down