ChenSammi commented on code in PR #11121:
URL: https://github.com/apache/ozone/pull/11121#discussion_r3913223626
##########
hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/request/s3/security/S3AssumeRoleRequest.java:
##########
@@ -174,12 +175,21 @@ public OMClientResponse
validateAndUpdateCache(OzoneManager ozoneManager, Execut
"S3AssumeRoleRequest does not have S3 authentication",
OMException.ResultCodes.INVALID_REQUEST);
}
- // Generate session token using leader-generated credentials
- final String sessionToken = generateSessionToken(
- targetRoleName, omRequest, ozoneManager, assumeRoleRequest,
secretAccessKey, tempAccessKeyId);
-
// Generate AssumedRoleId for response using leader-generated roleId
final String assumedRoleId = roleId + ":" + roleSessionName;
+ final String assumedRoleUserArn =
S3STSUtils.toAssumedRoleUserArn(roleArn, roleSessionName);
+
+ // Generate session token using leader-generated credentials
+ final String sessionToken =
generateSessionToken(GenerateSessionTokenParams.newBuilder()
+ .setTargetRoleName(targetRoleName)
+ .setOmRequest(omRequest)
+ .setOzoneManager(ozoneManager)
+ .setAssumeRoleRequest(assumeRoleRequest)
+ .setSecretAccessKey(secretAccessKey)
+ .setTempAccessKeyId(tempAccessKeyId)
+ .setAssumedRoleId(assumedRoleId)
Review Comment:
Current Role ID is generated for each assumeRole request. So same role
assume request will return different role ID to caller.
Is it possible for Ranger to return the Role ID to Ozone? Besides, it looks
like that AWS doesn't allow user to change Role name once created, while Ranger
allows, so if someone changes the role name in Ranger, then all the existing
STS token will fail at authorization.
This behavior is not introduced in this patch, is an existing behavior.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
