fmorg-git commented on code in PR #11121:
URL: https://github.com/apache/ozone/pull/11121#discussion_r3918083126
##########
hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/request/s3/security/S3AssumeRoleRequest.java:
##########
@@ -174,12 +175,21 @@ public OMClientResponse
validateAndUpdateCache(OzoneManager ozoneManager, Execut
"S3AssumeRoleRequest does not have S3 authentication",
OMException.ResultCodes.INVALID_REQUEST);
}
- // Generate session token using leader-generated credentials
- final String sessionToken = generateSessionToken(
- targetRoleName, omRequest, ozoneManager, assumeRoleRequest,
secretAccessKey, tempAccessKeyId);
-
// Generate AssumedRoleId for response using leader-generated roleId
final String assumedRoleId = roleId + ":" + roleSessionName;
+ final String assumedRoleUserArn =
S3STSUtils.toAssumedRoleUserArn(roleArn, roleSessionName);
+
+ // Generate session token using leader-generated credentials
+ final String sessionToken =
generateSessionToken(GenerateSessionTokenParams.newBuilder()
+ .setTargetRoleName(targetRoleName)
+ .setOmRequest(omRequest)
+ .setOzoneManager(ozoneManager)
+ .setAssumeRoleRequest(assumeRoleRequest)
+ .setSecretAccessKey(secretAccessKey)
+ .setTempAccessKeyId(tempAccessKeyId)
+ .setAssumedRoleId(assumedRoleId)
Review Comment:
I see your point that it's weird for the roleId to change for the same role,
so I updated it make it deterministic based on the roleArn -
9521089d4a31bc22b7e5d36e9d67fe148a632bea.
Please note that the roleId is only metadata and not used in any validation,
so it doesn't appear that it would be helpful for Ranger to return it (even if
it could be returned). Also, like you highlighted, the role name could change
in Ranger, and this is what's most important in terms of validation, access,
etc.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
