You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@ozone.apache.org by "fmorg-git (via GitHub)" <gi...@apache.org> on 2026/01/07 20:03:36 UTC
[PR] HDDS-14364. [STS] Revoked permanent credential must render all associated STS tokens useless [ozone]
fmorg-git opened a new pull request, #9602:
URL: https://github.com/apache/ozone/pull/9602
Please describe your PR in detail:
* To create STS tokens, the AssumeRole API must be called with a user that has permanent S3 credentials. If that user is revoked, then all session tokens created by that user must be rendered useless.
## What is the link to the Apache JIRA
https://issues.apache.org/jira/browse/HDDS-14364
## How was this patch tested?
unit tests (and a prototype in a separate local branch)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-14364. [STS] Revoked permanent credential must render all associated STS tokens useless [ozone]
Posted by "ChenSammi (via GitHub)" <gi...@apache.org>.
ChenSammi commented on code in PR #9602:
URL: https://github.com/apache/ozone/pull/9602#discussion_r2684702382
##########
hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/security/S3SecurityUtil.java:
##########
@@ -166,4 +175,26 @@ private static boolean isRevokedStsToken(String sessionToken, OzoneManager ozone
throw new OMException(msg, e, INTERNAL_ERROR);
}
}
+
+ /**
+ * Returns true if the originalAccessKeyId of the STS token has been revoked.
+ */
+ private static boolean isOriginalAccessKeyIdRevoked(STSTokenIdentifier stsTokenIdentifier, OzoneManager ozoneManager)
+ throws OMException {
+ final String originalAccessKeyId = stsTokenIdentifier.getOriginalAccessKeyId();
+ if (originalAccessKeyId == null) {
Review Comment:
originalAccessKeyId is already checked in ensureEssentialFieldsArePresentInToken().
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-14364. [STS] Revoked permanent credential must render all associated STS tokens useless [ozone]
Posted by "ChenSammi (via GitHub)" <gi...@apache.org>.
ChenSammi merged PR #9602:
URL: https://github.com/apache/ozone/pull/9602
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-14364. [STS] Revoked permanent credential must render all associated STS tokens useless [ozone]
Posted by "fmorg-git (via GitHub)" <gi...@apache.org>.
fmorg-git commented on code in PR #9602:
URL: https://github.com/apache/ozone/pull/9602#discussion_r2687526534
##########
hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/security/S3SecurityUtil.java:
##########
@@ -166,4 +175,26 @@ private static boolean isRevokedStsToken(String sessionToken, OzoneManager ozone
throw new OMException(msg, e, INTERNAL_ERROR);
}
}
+
+ /**
+ * Returns true if the originalAccessKeyId of the STS token has been revoked.
+ */
+ private static boolean isOriginalAccessKeyIdRevoked(STSTokenIdentifier stsTokenIdentifier, OzoneManager ozoneManager)
+ throws OMException {
+ final String originalAccessKeyId = stsTokenIdentifier.getOriginalAccessKeyId();
+ if (originalAccessKeyId == null) {
Review Comment:
updated
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org
Re: [PR] HDDS-14364. [STS] Revoked permanent credential must render all associated STS tokens useless [ozone]
Posted by "ChenSammi (via GitHub)" <gi...@apache.org>.
ChenSammi commented on code in PR #9602:
URL: https://github.com/apache/ozone/pull/9602#discussion_r2684702382
##########
hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/security/S3SecurityUtil.java:
##########
@@ -166,4 +175,26 @@ private static boolean isRevokedStsToken(String sessionToken, OzoneManager ozone
throw new OMException(msg, e, INTERNAL_ERROR);
}
}
+
+ /**
+ * Returns true if the originalAccessKeyId of the STS token has been revoked.
+ */
+ private static boolean isOriginalAccessKeyIdRevoked(STSTokenIdentifier stsTokenIdentifier, OzoneManager ozoneManager)
+ throws OMException {
+ final String originalAccessKeyId = stsTokenIdentifier.getOriginalAccessKeyId();
+ if (originalAccessKeyId == null) {
Review Comment:
originalAccessKeyId is already checked in ensureEssentialFieldsArePresentInToken(). Rest looks good to me.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org