Hello, I’m building a object storage environment and I’m in trouble with some administration ops, to manage the entire environment I decided create an admin user and use that to manage the client users which I’ll create further.
Using the admin (called “italux") I created a new user (called "cliente”) and after that I created a new bucket with the admin user (called cliente-bucket). After that, still using the admin, I change the permissions of the "cliente-bucket” (which is owned by admin) granting FULL_CONTROL to the “cliente” user. So, using the admin API I unlink the “cliente-bucket” from the admin user and link to the “cliente” user, changing the ownership of the bucket: In [86]: url = 'http://radosgw.example.com/admin/bucket?format=json&bucket=cliente-bucket' In [87]: r = requests.get(url, auth=S3Auth(access_key, secret_key, server)) In [88]: r.content Out[88]: '{"bucket":"cliente-bucket","pool":".rgw.buckets","index_pool":".rgw.buckets.index","id":"default.4361528.1","marker":"default.4361528.1","owner":"cliente","ver":1,"master_ver":0,"mtime":1425670280,"max_marker":"","usage":{},"bucket_quota":{"enabled":false,"max_size_kb":-1,"max_objects":-1}}’ After that, when I try change the permissions/acls of the bucket using the “cliente” user and I’m getting AccessDenied. Looking to the raw debug logs it seems that the owner of the bucket wasn’t change. Anyone knows why? RadosGW debug logs: 2015-03-06 16:32:55.943167 7fd32bf57700 1 ====== starting new request req=0x3cf78a0 ===== 2015-03-06 16:32:55.943183 7fd32bf57700 2 req 2:0.000016::PUT /::initializing 2015-03-06 16:32:55.943189 7fd32bf57700 10 host=cliente-bucket.radosgw.example.com rgw_dns_name=object-storage.locaweb.com.br 2015-03-06 16:32:55.943220 7fd32bf57700 10 s->object=<NULL> s->bucket=cliente-bucket 2015-03-06 16:32:55.943225 7fd32bf57700 2 req 2:0.000057:s3:PUT /::getting op 2015-03-06 16:32:55.943230 7fd32bf57700 2 req 2:0.000062:s3:PUT /:put_acls:authorizing 2015-03-06 16:32:55.943269 7fd32bf57700 10 get_canon_resource(): dest=/cliente-bucket/?acl 2015-03-06 16:32:55.943272 7fd32bf57700 10 auth_hdr: PUT Fri, 06 Mar 2015 19:32:55 GMT /cliente-bucket/?acl 2015-03-06 16:32:55.943370 7fd32bf57700 15 calculated digest=xtSrQR+GsHyqjqGLdiPmjoP62x4= 2015-03-06 16:32:55.943375 7fd32bf57700 15 auth_sign=xtSrQR+GsHyqjqGLdiPmjoP62x4= 2015-03-06 16:32:55.943377 7fd32bf57700 15 compare=0 2015-03-06 16:32:55.943384 7fd32bf57700 2 req 2:0.000216:s3:PUT /:put_acls:reading permissions 2015-03-06 16:32:55.943425 7fd32bf57700 15 Read AccessControlPolicy<AccessControlPolicy xmlns="http://s3.amazonaws.com/doc/2006-03-01/";><Owner><ID>italux</ID><DisplayName>Italo Santos</DisplayName></Owner><AccessControlList><Grant><Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"; xsi:type="CanonicalUser"><ID>cliente</ID><DisplayName>Cliente</DisplayName></Grantee><Permission>FULL_CONTROL</Permission></Grant></AccessControlList></AccessControlPolicy> 2015-03-06 16:32:55.943441 7fd32bf57700 2 req 2:0.000273:s3:PUT /:put_acls:init op 2015-03-06 16:32:55.943447 7fd32bf57700 2 req 2:0.000280:s3:PUT /:put_acls:verifying op mask 2015-03-06 16:32:55.943451 7fd32bf57700 20 required_mask= 2 user.op_mask=7 2015-03-06 16:32:55.943453 7fd32bf57700 2 req 2:0.000286:s3:PUT /:put_acls:verifying op permissions 2015-03-06 16:32:55.943457 7fd32bf57700 5 Searching permissions for uid=cliente mask=56 2015-03-06 16:32:55.943461 7fd32bf57700 5 Found permission: 15 2015-03-06 16:32:55.943462 7fd32bf57700 5 Searching permissions for group=1 mask=56 2015-03-06 16:32:55.943464 7fd32bf57700 5 Permissions for group not found 2015-03-06 16:32:55.943466 7fd32bf57700 5 Searching permissions for group=2 mask=56 2015-03-06 16:32:55.943468 7fd32bf57700 5 Permissions for group not found 2015-03-06 16:32:55.943469 7fd32bf57700 5 Getting permissions id=cliente owner=italux perm=8 2015-03-06 16:32:55.943471 7fd32bf57700 10 uid=cliente requested perm (type)=8, policy perm=8, user_perm_mask=8, acl perm=8 2015-03-06 16:32:55.943475 7fd32bf57700 2 req 2:0.000308:s3:PUT /:put_acls:verifying op params 2015-03-06 16:32:55.943480 7fd32bf57700 2 req 2:0.000313:s3:PUT /:put_acls:executing 2015-03-06 16:32:55.943547 7fd32bf57700 15 read len=831 data=<?xml version="1.0" encoding="UTF-8"?><AccessControlPolicy xmlns="http://s3.amazonaws.com/doc/2006-03-01/";><Owner><ID>italux</ID><DisplayName>Italo Santos</DisplayName></Owner><AccessControlList><Grant><Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"; xsi:type="CanonicalUser"><ID>italux</ID><DisplayName>Italo Santos</DisplayName></Grantee><Permission>READ</Permission></Grant><Grant><Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"; xsi:type="CanonicalUser"><ID>italux</ID><DisplayName>Italo Santos</DisplayName></Grantee><Permission>WRITE</Permission></Grant><Grant><Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"; xsi:type="CanonicalUser"><ID>cliente</ID><DisplayName>Cliente</DisplayName></Grantee><Permission>FULL_CONTROL</Permission></Grant></AccessControlList></AccessControlPolicy> 2015-03-06 16:32:55.943750 7fd32bf57700 15 Old AccessControlPolicy<AccessControlPolicy xmlns="http://s3.amazonaws.com/doc/2006-03-01/";><Owner><ID>italux</ID><DisplayName>Italo Santos</DisplayName></Owner><AccessControlList><Grant><Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"; xsi:type="CanonicalUser"><ID>cliente</ID><DisplayName>Cliente</DisplayName></Grantee><Permission>FULL_CONTROL</Permission></Grant><Grant><Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"; xsi:type="CanonicalUser"><ID>italux</ID><DisplayName>Italo Santos</DisplayName></Grantee><Permission>READ</Permission></Grant><Grant><Grantee xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"; xsi:type="CanonicalUser"><ID>italux</ID><DisplayName>Italo Santos</DisplayName></Grantee><Permission>WRITE</Permission></Grant></AccessControlList></AccessControlPolicy> 2015-03-06 16:32:55.943977 7fd32bf57700 2 req 2:0.000809:s3:PUT /:put_acls:http status=403 2015-03-06 16:32:55.943986 7fd32bf57700 1 ====== req done req=0x3cf78a0 http_status=403 ====== At. Italo Santos http://italosantos.com.br/
_______________________________________________ ceph-users mailing list ceph-users@lists.ceph.com http://lists.ceph.com/listinfo.cgi/ceph-users-ceph.com
