Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

quincy: rgw/sts: AssumeRole no longer writes to user metadata #52049

Merged
merged 3 commits into from
Jan 12, 2024
Merged

quincy: rgw/sts: AssumeRole no longer writes to user metadata #52049

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
34be3d7
rgw/sts: AssumeRole no longer writes to user metadata
cbodley Apr 20, 2023
ba8e62e
rgw/dbstore: stop storing RGWUserInfo::assumed_role_arn
cbodley Apr 20, 2023
2ccd2f4
rgw: remove RGWUserInfo::assumed_role_arn
cbodley Apr 20, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
7 changes: 5 additions & 2 deletions src/rgw/rgw_common.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -754,7 +754,6 @@ struct RGWUserInfo
RGWQuotaInfo user_quota;
uint32_t type;
std::set<std::string> mfa_ids;
std::string assumed_role_arn;

RGWUserInfo()
: suspended(0),
Expand Down Expand Up @@ -819,7 +818,10 @@ struct RGWUserInfo
encode(admin, bl);
encode(type, bl);
encode(mfa_ids, bl);
encode(assumed_role_arn, bl);
{
std::string assumed_role_arn; // removed
encode(assumed_role_arn, bl);
}
encode(user_id.ns, bl);
ENCODE_FINISH(bl);
}
Expand Down Expand Up @@ -903,6 +905,7 @@ struct RGWUserInfo
decode(mfa_ids, bl);
}
if (struct_v >= 21) {
std::string assumed_role_arn; // removed
decode(assumed_role_arn, bl);
}
if (struct_v >= 22) {
Expand Down
24 changes: 0 additions & 24 deletions src/rgw/rgw_sts.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -319,23 +319,6 @@ std::tuple<int, rgw::sal::RGWRole*> STSService::getRoleInfo(const DoutPrefixProv
}
}

int STSService::storeARN(const DoutPrefixProvider *dpp, string& arn, optional_yield y)
{
int ret = 0;
std::unique_ptr<rgw::sal::User> user = store->get_user(user_id);
if ((ret = user->load_user(dpp, y)) < 0) {
return -ERR_NO_SUCH_ENTITY;
}

user->get_info().assumed_role_arn = arn;

ret = user->store_user(dpp, y, false, &user->get_info());
if (ret < 0) {
return -ERR_INTERNAL_ERROR;
}
return ret;
}

AssumeRoleWithWebIdentityResponse STSService::assumeRoleWithWebIdentity(const DoutPrefixProvider *dpp, AssumeRoleWithWebIdentityRequest& req)
{
AssumeRoleWithWebIdentityResponse response;
Expand Down Expand Up @@ -447,13 +430,6 @@ AssumeRoleResponse STSService::assumeRole(const DoutPrefixProvider *dpp,
return response;
}

//Save ARN with the user
string arn = response.user.getARN();
response.retCode = storeARN(dpp, arn, y);
if (response.retCode < 0) {
return response;
}

response.retCode = 0;
return response;
}
Expand Down
1 change: 0 additions & 1 deletion src/rgw/rgw_sts.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -239,7 +239,6 @@ class STSService {
rgw_user user_id;
std::unique_ptr<rgw::sal::RGWRole> role;
rgw::auth::Identity* identity;
int storeARN(const DoutPrefixProvider *dpp, std::string& arn, optional_yield y);
public:
STSService() = default;
STSService(CephContext* cct, rgw::sal::Store* store, rgw_user user_id,
Expand Down
9 changes: 4 additions & 5 deletions src/rgw/store/dbstore/common/dbstore.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -194,7 +194,6 @@ struct DBOpUserPrepareInfo {
string user_quota = ":user_quota";
string type = ":type";
string mfa_ids = ":mfa_ids";
string assumed_role_arn = ":assumed_role_arn";
string user_attrs = ":user_attrs";
string user_ver = ":user_vers";
string user_ver_tag = ":user_ver_tag";
Expand Down Expand Up @@ -685,10 +684,10 @@ class InsertUserOp : virtual public DBOp {
AccessKeysID, AccessKeysSecret, AccessKeys, SwiftKeys,\
SubUsers, Suspended, MaxBuckets, OpMask, UserCaps, Admin, \
System, PlacementName, PlacementStorageClass, PlacementTags, \
BucketQuota, TempURLKeys, UserQuota, Type, MfaIDs, AssumedRoleARN, \
BucketQuota, TempURLKeys, UserQuota, Type, MfaIDs, \
UserAttrs, UserVersion, UserVersionTag) \
VALUES ({}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, \
{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {});";
{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {});";

public:
virtual ~InsertUserOp() {}
Expand All @@ -706,8 +705,8 @@ class InsertUserOp : virtual public DBOp {
params.op.user.placement_tags, params.op.user.bucket_quota,
params.op.user.temp_url_keys, params.op.user.user_quota,
params.op.user.type, params.op.user.mfa_ids,
params.op.user.assumed_role_arn, params.op.user.user_attrs,
params.op.user.user_ver, params.op.user.user_ver_tag);
params.op.user.user_attrs, params.op.user.user_ver,
params.op.user.user_ver_tag);
}

};
Expand Down
2 changes: 0 additions & 2 deletions src/rgw/store/dbstore/dbstore_main.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,6 @@ void* process(void *arg)
params.op.user.uinfo.user_id.id = user1;
params.op.user.uinfo.suspended = 123;
params.op.user.uinfo.max_buckets = 456;
params.op.user.uinfo.assumed_role_arn = "role";
params.op.user.uinfo.placement_tags.push_back("tags1");
params.op.user.uinfo.placement_tags.push_back("tags2");

Expand All @@ -72,7 +71,6 @@ void* process(void *arg)

cout << "tenant: " << params2.op.user.uinfo.user_id.tenant << "\n";
cout << "suspended: " << (int)params2.op.user.uinfo.suspended << "\n";
cout << "assumed_role_arn: " << params2.op.user.uinfo.assumed_role_arn << "\n";

list<string>::iterator it = params2.op.user.uinfo.placement_tags.begin();

Expand Down
5 changes: 0 additions & 5 deletions src/rgw/store/dbstore/sqlite/sqliteDB.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -330,8 +330,6 @@ static int list_user(const DoutPrefixProvider *dpp, DBOpInfo &op, sqlite3_stmt *

SQL_DECODE_BLOB_PARAM(dpp, stmt, MfaIDs, op.user.uinfo.mfa_ids, sdb);

op.user.uinfo.assumed_role_arn = (const char*)sqlite3_column_text(stmt, AssumedRoleARN);

SQL_DECODE_BLOB_PARAM(dpp, stmt, UserAttrs, op.user.user_attrs, sdb);
op.user.user_version.ver = sqlite3_column_int(stmt, UserVersion);
op.user.user_version.tag = (const char*)sqlite3_column_text(stmt, UserVersionTag);
Expand Down Expand Up @@ -1110,9 +1108,6 @@ int SQLInsertUser::Bind(const DoutPrefixProvider *dpp, struct DBOpParams *params
SQL_BIND_INDEX(dpp, stmt, index, p_params.op.user.mfa_ids.c_str(), sdb);
SQL_ENCODE_BLOB_PARAM(dpp, stmt, index, params->op.user.uinfo.mfa_ids, sdb);

SQL_BIND_INDEX(dpp, stmt, index, p_params.op.user.assumed_role_arn.c_str(), sdb);
SQL_BIND_TEXT(dpp, stmt, index, params->op.user.uinfo.assumed_role_arn.c_str(), sdb);

SQL_BIND_INDEX(dpp, stmt, index, p_params.op.user.user_attrs.c_str(), sdb);
SQL_ENCODE_BLOB_PARAM(dpp, stmt, index, params->op.user.user_attrs, sdb);

Expand Down
7 changes: 0 additions & 7 deletions src/rgw/store/dbstore/tests/dbstore_tests.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -122,7 +122,6 @@ TEST_F(DBStoreTest, InsertUser) {
params.op.user.uinfo.user_email = "user1@dbstore.com";
params.op.user.uinfo.suspended = 123;
params.op.user.uinfo.max_buckets = 456;
params.op.user.uinfo.assumed_role_arn = "role";
params.op.user.uinfo.placement_tags.push_back("tags");
RGWAccessKey k1("id1", "key1");
RGWAccessKey k2("id2", "key2");
Expand All @@ -146,7 +145,6 @@ TEST_F(DBStoreTest, GetUser) {
ASSERT_EQ(params.op.user.uinfo.user_id.id, "user_id1");
ASSERT_EQ(params.op.user.uinfo.suspended, 123);
ASSERT_EQ(params.op.user.uinfo.max_buckets, 456);
ASSERT_EQ(params.op.user.uinfo.assumed_role_arn, "role");
ASSERT_EQ(params.op.user.uinfo.placement_tags.back(), "tags");
RGWAccessKey k;
map<string, RGWAccessKey>::iterator it2 = params.op.user.uinfo.access_keys.begin();
Expand Down Expand Up @@ -174,7 +172,6 @@ TEST_F(DBStoreTest, GetUserQuery) {
ASSERT_EQ(params.op.user.uinfo.user_id.id, "user_id1");
ASSERT_EQ(params.op.user.uinfo.suspended, 123);
ASSERT_EQ(params.op.user.uinfo.max_buckets, 456);
ASSERT_EQ(params.op.user.uinfo.assumed_role_arn, "role");
ASSERT_EQ(params.op.user.uinfo.placement_tags.back(), "tags");
RGWAccessKey k;
map<string, RGWAccessKey>::iterator it2 = params.op.user.uinfo.access_keys.begin();
Expand Down Expand Up @@ -202,7 +199,6 @@ TEST_F(DBStoreTest, GetUserQueryByEmail) {
ASSERT_EQ(uinfo.user_id.id, "user_id1");
ASSERT_EQ(uinfo.suspended, 123);
ASSERT_EQ(uinfo.max_buckets, 456);
ASSERT_EQ(uinfo.assumed_role_arn, "role");
ASSERT_EQ(uinfo.placement_tags.back(), "tags");
RGWAccessKey k;
map<string, RGWAccessKey>::iterator it2 = uinfo.access_keys.begin();
Expand All @@ -228,7 +224,6 @@ TEST_F(DBStoreTest, GetUserQueryByAccessKey) {
ASSERT_EQ(uinfo.user_id.id, "user_id1");
ASSERT_EQ(uinfo.suspended, 123);
ASSERT_EQ(uinfo.max_buckets, 456);
ASSERT_EQ(uinfo.assumed_role_arn, "role");
ASSERT_EQ(uinfo.placement_tags.back(), "tags");
RGWAccessKey k;
map<string, RGWAccessKey>::iterator it2 = uinfo.access_keys.begin();
Expand Down Expand Up @@ -259,7 +254,6 @@ TEST_F(DBStoreTest, StoreUser) {
uinfo.user_email = "user2@dbstore.com";
uinfo.suspended = 123;
uinfo.max_buckets = 456;
uinfo.assumed_role_arn = "role";
uinfo.placement_tags.push_back("tags");
RGWAccessKey k1("id1", "key1");
RGWAccessKey k2("id2", "key2");
Expand Down Expand Up @@ -311,7 +305,6 @@ TEST_F(DBStoreTest, GetUserQueryByUserID) {
ASSERT_EQ(uinfo.user_id.id, "user_id2");
ASSERT_EQ(uinfo.suspended, 123);
ASSERT_EQ(uinfo.max_buckets, 456);
ASSERT_EQ(uinfo.assumed_role_arn, "role");
ASSERT_EQ(uinfo.placement_tags.back(), "tags");
RGWAccessKey k;
map<string, RGWAccessKey>::iterator it = uinfo.access_keys.begin();
Expand Down