ChenSammi commented on code in PR #11095:
URL: https://github.com/apache/ozone/pull/11095#discussion_r3841282097
##########
hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/security/STSTokenSecretManager.java:
##########
@@ -94,8 +95,16 @@ public String createSTSTokenString(String tempAccessKeyId,
String originalAccess
// Note - the encryptionKey will NOT be encoded in the token. When
generateToken() is called, it eventually calls
// the write() method in STSTokenIdentifier which calls toProtoBuf(), and
the encryptionKey is not
// serialized there.
- final STSTokenIdentifier identifier = new STSTokenIdentifier(
- tempAccessKeyId, originalAccessKeyId, roleArn, expiration,
secretAccessKey, sessionPolicy, encryptionKey);
+ final STSTokenIdentifier identifier = new
STSTokenIdentifier(STSTokenIdentifier.Params.newBuilder()
Review Comment:
The encryptionKey passed into STSTokenIdentifier which encrypts the
secretAccessKey, can be different than the currentKey in generateToken, which
signs the whole token, if the key secret is rotated during the small time
window.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
