fmorg-git commented on code in PR #11030: URL: https://github.com/apache/ozone/pull/11030#discussion_r3834735604
########## hadoop-hdds/docs/content/design/ozone-sts.md: ########## @@ -146,9 +146,13 @@ credential will have the permissions and actions comprising the intersection of In the rare event temporary credentials need to be revoked (ex. for security reasons), a table in the OzoneManager RocksDB will be created to store revoked tokens, and a command-line utility will be created to add tokens to the table. A background cleaner service -will be created to run every 3 hours to delete revoked tokens that have been in the table for more than 12 hours. The -input parameter for the command-line utility will be the sessionToken - this value is returned in plain text as a result -of the AssumeRole call (mentioned above). In this way, specific STS tokens can be revoked as opposed to all tokens. Furthermore, +will be created to run every 3 hours to delete revoked tokens that have been in the table for more than 12 hours. The +command-line utility accepts `originalAccessKeyId` and `tempAccessKeyId`. The OM stores revocations by building a +single key from these two values joined by an unescaped `|` delimiter, with `tempAccessKeyId` first: +`tempAccessKeyId|originalAccessKeyId`. Because `tempAccessKeyId` is always `ASIA` followed by characters drawn only +from `[0-9A-Z]`, it can never contain the `|` delimiter, so no escaping is needed even though `originalAccessKeyId` +is unconstrained. In this way, specific STS tokens can be revoked as opposed +to all tokens. Furthermore, Review Comment: this is no longer here after the redesign -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
