[GitHub] [ozone] neils-dev commented on a change in pull request #2721: HDDS-5780. Support s3 authentication on a per request basis

[GitBox <gi...@apache.org>]

neils-dev commented on a change in pull request #2721:
URL: https://github.com/apache/ozone/pull/2721#discussion_r725731281



##########
File path: hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/OzoneManagerServiceGrpc.java
##########
@@ -60,22 +79,66 @@ public void submitRequest(OMRequest request,
         request.getCmdType().name());
     AtomicInteger callCount = new AtomicInteger(0);
     OMResponse omResponse;
+
+    if (secConfig.isSecurityEnabled()) {
+      if (request.hasS3Authentication()) {
+        S3Authentication auth = request.getS3Authentication();
+        OzoneTokenIdentifier identifier = new OzoneTokenIdentifier();
+        identifier.setTokenType(S3AUTHINFO);
+        identifier.setStrToSign(auth.getStringToSign());
+        identifier.setSignature(auth.getSignature());
+        identifier.setAwsAccessId(auth.getAccessId());
+        identifier.setOwner(new Text(auth.getAccessId()));
+        try {
+          // authenticate user with signature verification through
+          // delegationTokenMgr validateToken via retrievePassword
+          delegationTokenMgr.retrievePassword(identifier);
+        } catch (Throwable e) {
+          LOG.error("signatures do NOT match for S3 identifier:{}",
+              identifier, e);
+          responseObserver.onNext(
+              createErrorResponse(request,
+                  new OMException("User " + request.getUserInfo()
+                      .getUserName() +
+                      " request authorization failure: " +
+                      "signatures do NOT match",
+                      OMException.ResultCodes.S3_SECRET_NOT_FOUND)));
+          responseObserver.onCompleted();
+          return;
+        }
+      }
+    }
+
+    org.apache.hadoop.ipc.Server.getCurCall().set(new Server.Call(1,
+        callCount.incrementAndGet(),
+        null,
+        null,
+        RPC.RpcKind.RPC_PROTOCOL_BUFFER,
+        ClientId.getClientId()));
+    // TODO: currently require setting the Server class for each request
+    // with thread context (Server.Call()) that includes retries
+    // and importantly random ClientId.  This is currently necessary for
+    // Om Ratis Server to create createWriteRaftClientRequest.
+    // Look to remove Server class requirement for issuing ratis transactions
+    // for OMRequests.  Test through successful ratis-enabled OMRequest
+    // handling without dependency on hadoop IPC based Server.
     try {
-      org.apache.hadoop.ipc.Server.getCurCall().set(new Server.Call(1,
-          callCount.incrementAndGet(),
-          null,
-          null,
-          RPC.RpcKind.RPC_PROTOCOL_BUFFER,
-          ClientId.getClientId()));
-      // TODO: currently require setting the Server class for each request
-      // with thread context (Server.Call()) that includes retries
-      // and importantly random ClientId.  This is currently necessary for
-      // Om Ratis Server to create createWriteRaftClientRequest.
-      // Look to remove Server class requirement for issuing ratis transactions
-      // for OMRequests.  Test through successful ratis-enabled OMRequest 
-      // handling without dependency on hadoop IPC based Server.
-      omResponse = this.omTranslator.
-          submitRequest(NULL_RPC_CONTROLLER, request);
+      omResponse =
+          UserGroupInformation.getCurrentUser().doAs(
+              (PrivilegedExceptionAction<OMResponse>) () -> {
+                try {
+                  return this.omTranslator.
+                      submitRequest(NULL_RPC_CONTROLLER, request);
+                } catch (Throwable se) {
+                  Throwable e = se.getCause();
+                  if (se == null) {
+                    throw new IOException(se);
+                  } else {
+                    throw e instanceof IOException ?
+                        (IOException) e : new IOException(se);

Review comment:
       Thanks @adoroszlai.  I'm updating the exception handling block to check if `se.getCause() `is `null` ( `if e == null` ) like you suggested.
   Here though in this block checking if `e` (se.getCause() ) is `instanceof IOException` keep it **as is** with if check _is_ true, throwing e (IOException) and if e _is not_ (IOException) then throwing an new IOException constructed with the throwable (se).  Let me know your thoughts on keeping it as is.




-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org



---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org