chungen0126 commented on code in PR #11479:
URL: https://github.com/apache/ozone/pull/11479#discussion_r4312752486
##########
hadoop-ozone/dist/src/main/smoketest/security/ozone-secure-sts-multitenant.robot:
##########
@@ -269,7 +269,7 @@ Verify Limited-Scoped Token Accesses
Get Object Should Fail ${TENANT_ONE_LINKED_BUCKET}
${ANOTHER_BUCKET_TESTFILE} AccessDenied
Put Object Should Fail ${TENANT_ONE_LINKED_BUCKET}
${ANOTHER_BUCKET_TESTFILE} AccessDenied
Get Object Should Fail ${TENANT_TWO_ANOTHER_BUCKET}
${ANOTHER_BUCKET_TESTFILE} NoSuchBucket
- Put Object Should Fail ${TENANT_TWO_ANOTHER_BUCKET}
${ANOTHER_BUCKET_TESTFILE} AccessDenied
+ Put Object Should Fail ${TENANT_TWO_ANOTHER_BUCKET}
${ANOTHER_BUCKET_TESTFILE} NoSuchBucket
Review Comment:
Yes, it is intentional. InfoBucket with assumeS3Context resolves the S3
volume with getS3VolumeContext(true), the same as getKeyInfo for GetObject, so
a missing bucket now returns NoSuchBucket for PutObject as well.
This matches the existing GetObject expectation on line 271 and the
role-token PutObject case on line 203.
It’s a bit of a shortcut/compromise, but I believe it’s harmless. Here’s
what’s happening under the hood:
- Previously, the workflow called getS3VolumeContext first before looking up
the bucket. It would fail at the first step and throw AccessDenied due to
lacking volume permissions.
- Now, since we’ve consolidated everything into a single RPC, it goes
straight to the bucket lookup. The catch here is that instead of checking
volume permissions upfront, it fetches the bucket and volume info first before
performing the permission checks. Because the bucket isn't found during the
lookup, it throws NoSuchBucket instead.
I think this difference in error message is harmless, and trying to preserve
the exact AccessDenied behavior here would introduce unnecessary overhead.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
