[GitHub] [ozone] prashantpogde commented on a diff in pull request #3327: HDDS-6625. [Multi-Tenant] Follow-up: Set owner of buckets created via S3 Gateway to actual user

[GitBox <gi...@apache.org>]

prashantpogde commented on code in PR #3327:
URL: https://github.com/apache/ozone/pull/3327#discussion_r869604548


##########
hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/OzoneManager.java:
##########
@@ -3117,14 +3117,39 @@ public S3VolumeContext getS3VolumeContext() throws IOException {
     // to the default S3 volume.
     String s3Volume = HddsClientUtils.getDefaultS3VolumeName(configuration);
     S3Authentication s3Auth = getS3Auth();
-    String userPrincipal = Server.getRemoteUser().getShortUserName();
+    final String userPrincipal;
 
-    if (s3Auth != null) {
+    if (s3Auth == null) {
+      // This is the default user principal if request does not have S3Auth set
+      userPrincipal = Server.getRemoteUser().getShortUserName();
+
+      if (LOG.isDebugEnabled()) {
+        // An old S3 gateway talking to a new OM may not attach the auth info.
+        // This old version of s3g will also not have a client that supports
+        // multi-tenancy, so we can direct requests to the default S3 volume.
+        LOG.debug("S3 authentication was not attached to the OM request. " +
+                "Directing requests to the default S3 volume {}.",
+            s3Volume);
+      }
+    } else {
       String accessId = s3Auth.getAccessId();
       Optional<String> optionalTenantId =
           multiTenantManager.getTenantForAccessID(accessId);
 
-      if (optionalTenantId.isPresent()) {
+      if (!optionalTenantId.isPresent()) {
+        final UserGroupInformation s3gUGI =
+            UserGroupInformation.createRemoteUser(accessId);
+        // When the accessId belongs to the default s3v (i.e. when the accessId
+        // key pair is generated using the regular `ozone s3 getsecret`), the
+        // user principal returned here should simply be the accessId's short
+        // user name (processed by the auth_to_local rule)
+        userPrincipal = s3gUGI.getShortUserName();
+
+        if (LOG.isDebugEnabled()) {
+          LOG.debug("No tenant found for access ID {}. Directing "
+              + "requests to default s3 volume {}.", accessId, s3Volume);
+        }
+      } else {
         final String tenantId = optionalTenantId.get();

Review Comment:
   userPrincipal doesn't seem to be set in this Else path.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org