fmorg-git commented on code in PR #11042:
URL: https://github.com/apache/ozone/pull/11042#discussion_r3817606593
##########
hadoop-ozone/dist/src/main/smoketest/security/ozone-secure-sts.resource:
##########
@@ -27,6 +27,8 @@ ${RANGER_ENDPOINT_URL} ${EMPTY}
${STS_ENDPOINT_URL} http://s3g:9880/sts
${S3G_ENDPOINT_URL} http://s3g:9878
${ROLE_SESSION_NAME} sts-session-name
+${EXPIRED_STS_TOKEN_PROFILE} expired_sts_token
+${EXPIRED_STS_TOKEN_MIN_ELAPSED_SECONDS} 902
Review Comment:
updated
##########
hadoop-ozone/dist/src/main/smoketest/security/ozone-secure-sts.resource:
##########
@@ -115,6 +117,51 @@ Assume Role And Get Temporary Credentials
Should Be True ${time_diff} >= ${minimum_expected}
Expected expiration to be at least ${minimum_expected}s in the future, but was
${time_diff}s
Should Be True ${time_diff} <= ${maximum_expected}
Expected expiration to be at most ${maximum_expected}s in the future, but was
${time_diff}s
+Assume Role And Store Expired STS Token Credentials
+ # Issue a 900s STS credential and store it in EXPIRED_STS_TOKEN_* globals
only (it should never be used/modified until the "Expired STS temporary
credentials return ExpiredToken on S3 APIs" test).
+ [Arguments] ${perm_access_key_id} ${perm_secret_key}
${role_arn} ${duration_seconds}=900
+ Configure AWS Profile permanent ${perm_access_key_id}
${perm_secret_key}
+ ${suffix} = Generate Random String 8 [LOWER]
+ ${role_session_name} = Set Variable
expired-sts-token-${suffix}
+
+ ${cmd} = Set Variable aws sts
assume-role --endpoint-url ${STS_ENDPOINT_URL} --role-arn ${role_arn}
--role-session-name ${role_session_name} --duration-seconds ${duration_seconds}
--output json --profile permanent
+
+ ${json} = Execute ${cmd}
+ Should Contain ${json} Credentials
+
+ ${issued_epoch} = Get Current Date
result_format=epoch time_zone=UTC
+
+ ${expiredStsAccessKeyId} = Execute printf '%s'
'${json}' | jq -r '.Credentials.AccessKeyId'
+ ${expiredStsSecretKey} = Execute printf '%s'
'${json}' | jq -r '.Credentials.SecretAccessKey'
+ ${expiredStsSessionToken} = Execute printf '%s'
'${json}' | jq -r '.Credentials.SessionToken'
+ Should Start With ${expiredStsAccessKeyId} ASIA
+ Set Global Variable ${EXPIRED_STS_TOKEN_ACCESS_KEY_ID}
${expiredStsAccessKeyId}
Review Comment:
updated
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
