Gargi-jais11 commented on code in PR #10652:
URL: https://github.com/apache/ozone/pull/10652#discussion_r3709781845
##########
hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/request/key/OMKeyCreateRequestWithFSO.java:
##########
@@ -202,11 +206,22 @@ public OMClientResponse
validateAndUpdateCache(OzoneManager ozoneManager, Execut
// Prepare response. Sets user given full key name in the 'keyName'
// attribute in response object.
int clientVersion = getOmRequest().getVersion();
- omResponse.setCreateKeyResponse(CreateKeyResponse.newBuilder()
+ CreateKeyResponse.Builder createKeyResponseBuilder =
CreateKeyResponse.newBuilder()
.setKeyInfo(omFileInfo.getNetworkProtobuf(keyName, clientVersion,
keyArgs.getLatestVersionLocation()))
.setID(clientID)
- .setOpenVersion(openVersion).build())
+ .setOpenVersion(openVersion);
+ if (getOmRequest().hasS3Authentication() &&
ozoneManager.isSecurityEnabled()
+ && createKeyRequest.hasDerivedKeyPiggyBacking()
+ && createKeyRequest.getDerivedKeyPiggyBacking()
+ ) {
+ OzoneTokenIdentifier s3Token =
S3SecurityUtil.constructS3Token(getOmRequest());
+ if (s3Token.getTokenType().equals(OMTokenProto.Type.S3AUTHINFO)) {
+ byte[] derivedKey =
ozoneManager.getS3DerivedKey(s3Token.getAwsAccessId(), s3Token.getStrToSign());
+
createKeyResponseBuilder.setDerivedKey(ByteString.copyFrom(derivedKey));
+ }
+ }
+ omResponse.setCreateKeyResponse(createKeyResponseBuilder.build())
Review Comment:
@chungen0126 I agree with ur point as well that all security, authentication
check is done in preExecute. Early S3 validation reduces secret failures on the
leader, but placement before `addCacheEntry` is a defensive ordering for any
IOException, not only auth. What I think is keeping it before cache write is
correct as it t avoids orphan open keys if anything throws, not only auth
failures.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
