fmorg-git commented on code in PR #11134:
URL: https://github.com/apache/ozone/pull/11134#discussion_r3910619689
##########
hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/request/s3/security/S3AssumeRoleRequest.java:
##########
@@ -274,13 +284,129 @@ String getSessionPolicy(OzoneManager ozoneManager,
String originalAccessKeyId, S
final Set<OzoneGrant> grants = Strings.isNullOrEmpty(awsIamPolicy) ?
null :
- IamSessionPolicyResolver.resolve(awsIamPolicy, volumeName,
IamSessionPolicyResolver.AuthorizerType.RANGER);
+ resolveGrantsAgainstBucketLinks(
+ IamSessionPolicyResolver.resolve(awsIamPolicy, volumeName,
IamSessionPolicyResolver.AuthorizerType.RANGER),
+ (linkVolume, linkBucket) ->
ozoneManager.resolveBucketLink(Pair.of(linkVolume, linkBucket), true, false));
Review Comment:
> There is one more thing about S3AssumeRoleRequest implementation.
>
> Permission check is moved from validateAndUpdateCache to preExecute for
most the OM requests in master branch. The effort is to reduce the requests
send to Ranger for authorization, from 3 to 1, and simplify the OM state
machine workload, and avoid Ranger authorization failure which caused a severe
Ozone data loss issue. Since currently authorization is checked in
generateAssumeRoleSessionPolicy(), we should move the whole session generation
process to preExecute, let validateAndUpdateCache only do the DB update, and
audit log work.
updated - 7f3141a8736e4f5b32cfef645568d751a4171a3a
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
