fmorg-git commented on code in PR #10009:
URL: https://github.com/apache/ozone/pull/10009#discussion_r3278312601
##########
hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/ratis/OzoneManagerStateMachine.java:
##########
@@ -662,7 +664,29 @@ public void close() {
*/
@VisibleForTesting
OMResponse runCommand(OMRequest request, TermIndex termIndex) {
+ boolean isStsThreadLocalSet = false;
try {
+ if (ozoneManager.isSecurityEnabled() && request.hasS3Authentication()) {
+ // STS token verification runs on the leader RPC path so we don't need
to recheck here on the apply
+ // after the log is committed
+ STSSecurityUtil.ensureResolvedStsFieldsInvariants(request);
+
+ final OzoneManagerProtocolProtos.S3Authentication s3Auth =
request.getS3Authentication();
+ if (s3Auth.hasSessionToken() && !s3Auth.getSessionToken().isEmpty()) {
+ // ThreadLocal carries session policy for OmMetadataReader
+ final STSTokenIdentifier rehydratedTokenIdentifier = new
STSTokenIdentifier(
+ s3Auth.hasResolvedStsTempAccessKeyId() ?
s3Auth.getResolvedStsTempAccessKeyId() : "",
+ s3Auth.hasResolvedStsOriginalAccessKeyId() ?
s3Auth.getResolvedStsOriginalAccessKeyId() : "",
+ s3Auth.hasResolvedStsRoleArn() ?
s3Auth.getResolvedStsRoleArn() : "",
+ java.time.Instant.MAX, // ensure it deterministically is not
expired
+ "", // no secretAccessKey needed
+ s3Auth.hasResolvedStsSessionPolicy() ?
s3Auth.getResolvedStsSessionPolicy() : "",
+ null // no encryption key needed
+ );
+ OzoneManager.setStsTokenIdentifier(rehydratedTokenIdentifier);
+ isStsThreadLocalSet = true;
+ }
Review Comment:
updated - c483af56f0ef4f0e45b7cbc935b63bc37424afb7
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
