fmorg-git commented on code in PR #11030:
URL: https://github.com/apache/ozone/pull/11030#discussion_r3800235812
##########
hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/request/s3/security/S3RevokeSTSTokenRequest.java:
##########
@@ -85,24 +85,39 @@ public OMClientResponse validateAndUpdateCache(OzoneManager
ozoneManager, Execut
final OMResponse.Builder omResponse =
OmResponseUtil.getOMResponseBuilder(getOmRequest());
final OzoneManagerProtocolProtos.RevokeSTSTokenRequest revokeReq =
getOmRequest().getRevokeSTSTokenRequest();
- final String sessionToken = revokeReq.getSessionToken();
+ final String originalAccessKeyId = revokeReq.getOriginalAccessKeyId();
+ final String tempAccessKeyId = revokeReq.getTempAccessKeyId();
+ final String revokedStsTokenKey =
STSSecurityUtil.buildRevokedStsTokenKey(tempAccessKeyId, originalAccessKeyId);
// All actual DB mutations are done in the response's addToDBBatch().
- final OMClientResponse omClientResponse = new S3RevokeSTSTokenResponse(
- sessionToken, omResponse.build());
+ final OMClientResponse omClientResponse = new
S3RevokeSTSTokenResponse(revokedStsTokenKey, omResponse.build());
// Audit log
final Map<String, String> auditMap = new HashMap<>();
final OzoneManagerProtocolProtos.UserInfo userInfo =
getOmRequest().getUserInfo();
auditMap.put(OzoneConsts.S3_REVOKESTSTOKEN_USER, userInfo.getUserName());
+ auditMap.put(OzoneConsts.S3_REVOKESTSTOKEN_ORIGINAL_ACCESS_KEY_ID,
originalAccessKeyId);
+ auditMap.put(OzoneConsts.S3_REVOKESTSTOKEN_TEMP_ACCESS_KEY_ID,
tempAccessKeyId);
markForAudit(ozoneManager.getAuditLogger(), buildAuditMessage(
OMAction.REVOKE_STS_TOKEN, auditMap, null, userInfo));
// Update the cache immediately so subsequent validation checks see the
revocation
ozoneManager.getMetadataManager().getS3RevokedStsTokenTable().addCacheEntry(
- new CacheKey<>(sessionToken), CacheValue.get(context.getIndex(),
CLOCK.millis()));
+ new CacheKey<>(revokedStsTokenKey), CacheValue.get(context.getIndex(),
CLOCK.millis()));
- LOG.info("Marked STS session token '{}' as revoked.", sessionToken);
+ LOG.info(
+ "Marked STS token as revoked for originalAccessKeyId={},
tempAccessKeyId={}.", originalAccessKeyId,
+ tempAccessKeyId);
return omClientResponse;
}
+
+ private static void
validateRevokeRequestFields(OzoneManagerProtocolProtos.RevokeSTSTokenRequest
revokeReq)
Review Comment:
good catch - updated
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
