Re: [PR] HDDS-15140. Piggyback S3 derived key during key creation [ozone]

["Gargi-jais11 (via GitHub)" <gi...@apache.org>]

Gargi-jais11 commented on code in PR #10652:
URL: https://github.com/apache/ozone/pull/10652#discussion_r3709646248


##########
hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/request/key/OMKeyCreateRequest.java:
##########
@@ -475,4 +482,26 @@ public static OMRequest blockCreateKeyWithBucketLayoutFromOldClient(
     }
     return req;
   }
+
+  protected CreateKeyResponse.Builder getResponseBuilderWithDerivedKey(
+      OMRequest omRequest, OzoneManager ozoneManager,
+      CreateKeyRequest createKeyRequest) throws IOException {
+    CreateKeyResponse.Builder builder = CreateKeyResponse.newBuilder();
+    if (omRequest.hasS3Authentication() && ozoneManager.isSecurityEnabled()
+        && createKeyRequest.hasDerivedKeyPiggyBacking()
+        && createKeyRequest.getDerivedKeyPiggyBacking()
+    ) {
+      OzoneTokenIdentifier s3Token = S3SecurityUtil.constructS3Token(omRequest);
+      if (!s3Token.getTokenType().equals(OMTokenProto.Type.S3AUTHINFO)) {
+        // Piggyback was requested but this token type cannot produce a derived key.
+        // S3 Gateway should only set this flag for S3AUTHINFO tokens.
+        LOG.warn("Derived key piggyback requested but token type is {}, " +
+                "not S3AUTHINFO. Derived key will not be returned.",
+            s3Token.getTokenType());
+      }

Review Comment:
   This is doing opposite of what u are warning. If the Token type is not `S3AUTHINFO` then it could return a signing key for the wrong auth context.
   return the builder here itself.
   ```suggestion
         if (!s3Token.getTokenType().equals(OMTokenProto.Type.S3AUTHINFO)) {
           // Piggyback was requested but this token type cannot produce a derived key.
           // S3 Gateway should only set this flag for S3AUTHINFO tokens.
           LOG.warn("Derived key piggyback requested but token type is {}, " +
                   "not S3AUTHINFO. Derived key will not be returned.",
               s3Token.getTokenType());
               return builder;
         }
   ```



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@ozone.apache.org
For additional commands, e-mail: issues-help@ozone.apache.org