Skip to content

Commit cd63ffa

Browse files
cbodleycbodley
authored
Merge pull request ceph#51161 from cbodley/wip-59495
rgw/sts: AssumeRole no longer writes to user metadata Reviewed-by: Daniel Gryniewicz <[email protected]> Reviewed-by: Pritha Srivastava <[email protected]>
2 parents 3f69785 + af5f9ca commit cd63ffa

File tree

7 files changed

+9
-46
lines changed

7 files changed

+9
-46
lines changed

‎src/rgw/driver/dbstore/common/dbstore.h‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -193,7 +193,6 @@ struct DBOpUserPrepareInfo {
193193
static constexpr const char* user_quota = ":user_quota";
194194
static constexpr const char* type = ":type";
195195
static constexpr const char* mfa_ids = ":mfa_ids";
196-
static constexpr const char* assumed_role_arn = ":assumed_role_arn";
197196
static constexpr const char* user_attrs = ":user_attrs";
198197
static constexpr const char* user_ver = ":user_vers";
199198
static constexpr const char* user_ver_tag = ":user_ver_tag";
@@ -725,10 +724,10 @@ class InsertUserOp : virtual public DBOp {
725724
AccessKeysID, AccessKeysSecret, AccessKeys, SwiftKeys,\
726725
SubUsers, Suspended, MaxBuckets, OpMask, UserCaps, Admin, \
727726
System, PlacementName, PlacementStorageClass, PlacementTags, \
728-
BucketQuota, TempURLKeys, UserQuota, Type, MfaIDs, AssumedRoleARN, \
727+
BucketQuota, TempURLKeys, UserQuota, Type, MfaIDs, \
729728
UserAttrs, UserVersion, UserVersionTag) \
730729
VALUES ({}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, \
731-
{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {});";
730+
{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {});";
732731

733732
public:
734733
virtual ~InsertUserOp() {}
@@ -746,8 +745,8 @@ class InsertUserOp : virtual public DBOp {
746745
params.op.user.placement_tags, params.op.user.bucket_quota,
747746
params.op.user.temp_url_keys, params.op.user.user_quota,
748747
params.op.user.type, params.op.user.mfa_ids,
749-
params.op.user.assumed_role_arn, params.op.user.user_attrs,
750-
params.op.user.user_ver, params.op.user.user_ver_tag);
748+
params.op.user.user_attrs, params.op.user.user_ver,
749+
params.op.user.user_ver_tag);
751750
}
752751

753752
};

‎src/rgw/driver/dbstore/dbstore_main.cc‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,6 @@ void* process(void *arg)
5050
params.op.user.uinfo.user_id.id = user1;
5151
params.op.user.uinfo.suspended = 123;
5252
params.op.user.uinfo.max_buckets = 456;
53-
params.op.user.uinfo.assumed_role_arn = "role";
5453
params.op.user.uinfo.placement_tags.push_back("tags1");
5554
params.op.user.uinfo.placement_tags.push_back("tags2");
5655

@@ -73,7 +72,6 @@ void* process(void *arg)
7372

7473
cout << "tenant: " << params2.op.user.uinfo.user_id.tenant << "\n";
7574
cout << "suspended: " << (int)params2.op.user.uinfo.suspended << "\n";
76-
cout << "assumed_role_arn: " << params2.op.user.uinfo.assumed_role_arn << "\n";
7775

7876
list<string>::iterator it = params2.op.user.uinfo.placement_tags.begin();
7977

‎src/rgw/driver/dbstore/sqlite/sqliteDB.cc‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -395,8 +395,6 @@ static int list_user(const DoutPrefixProvider *dpp, DBOpInfo &op, sqlite3_stmt *
395395

396396
SQL_DECODE_BLOB_PARAM(dpp, stmt, MfaIDs, op.user.uinfo.mfa_ids, sdb);
397397

398-
op.user.uinfo.assumed_role_arn = (const char*)sqlite3_column_text(stmt, AssumedRoleARN);
399-
400398
SQL_DECODE_BLOB_PARAM(dpp, stmt, UserAttrs, op.user.user_attrs, sdb);
401399
op.user.user_version.ver = sqlite3_column_int(stmt, UserVersion);
402400
op.user.user_version.tag = (const char*)sqlite3_column_text(stmt, UserVersionTag);
@@ -1179,9 +1177,6 @@ int SQLInsertUser::Bind(const DoutPrefixProvider *dpp, struct DBOpParams *params
11791177
SQL_BIND_INDEX(dpp, stmt, index, p_params.op.user.mfa_ids, sdb);
11801178
SQL_ENCODE_BLOB_PARAM(dpp, stmt, index, params->op.user.uinfo.mfa_ids, sdb);
11811179

1182-
SQL_BIND_INDEX(dpp, stmt, index, p_params.op.user.assumed_role_arn, sdb);
1183-
SQL_BIND_TEXT(dpp, stmt, index, params->op.user.uinfo.assumed_role_arn.c_str(), sdb);
1184-
11851180
SQL_BIND_INDEX(dpp, stmt, index, p_params.op.user.user_attrs, sdb);
11861181
SQL_ENCODE_BLOB_PARAM(dpp, stmt, index, params->op.user.user_attrs, sdb);
11871182

‎src/rgw/driver/dbstore/tests/dbstore_tests.cc‎

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -147,7 +147,6 @@ TEST_F(DBStoreTest, InsertUser) {
147147
params.op.user.uinfo.user_email = "[email protected]";
148148
params.op.user.uinfo.suspended = 123;
149149
params.op.user.uinfo.max_buckets = 456;
150-
params.op.user.uinfo.assumed_role_arn = "role";
151150
params.op.user.uinfo.placement_tags.push_back("tags");
152151
RGWAccessKey k1("id1", "key1");
153152
RGWAccessKey k2("id2", "key2");
@@ -171,7 +170,6 @@ TEST_F(DBStoreTest, GetUser) {
171170
ASSERT_EQ(params.op.user.uinfo.user_id.id, "user_id1");
172171
ASSERT_EQ(params.op.user.uinfo.suspended, 123);
173172
ASSERT_EQ(params.op.user.uinfo.max_buckets, 456);
174-
ASSERT_EQ(params.op.user.uinfo.assumed_role_arn, "role");
175173
ASSERT_EQ(params.op.user.uinfo.placement_tags.back(), "tags");
176174
RGWAccessKey k;
177175
map<string, RGWAccessKey>::iterator it2 = params.op.user.uinfo.access_keys.begin();
@@ -199,7 +197,6 @@ TEST_F(DBStoreTest, GetUserQuery) {
199197
ASSERT_EQ(params.op.user.uinfo.user_id.id, "user_id1");
200198
ASSERT_EQ(params.op.user.uinfo.suspended, 123);
201199
ASSERT_EQ(params.op.user.uinfo.max_buckets, 456);
202-
ASSERT_EQ(params.op.user.uinfo.assumed_role_arn, "role");
203200
ASSERT_EQ(params.op.user.uinfo.placement_tags.back(), "tags");
204201
RGWAccessKey k;
205202
map<string, RGWAccessKey>::iterator it2 = params.op.user.uinfo.access_keys.begin();
@@ -227,7 +224,6 @@ TEST_F(DBStoreTest, GetUserQueryByEmail) {
227224
ASSERT_EQ(uinfo.user_id.id, "user_id1");
228225
ASSERT_EQ(uinfo.suspended, 123);
229226
ASSERT_EQ(uinfo.max_buckets, 456);
230-
ASSERT_EQ(uinfo.assumed_role_arn, "role");
231227
ASSERT_EQ(uinfo.placement_tags.back(), "tags");
232228
RGWAccessKey k;
233229
map<string, RGWAccessKey>::iterator it2 = uinfo.access_keys.begin();
@@ -253,7 +249,6 @@ TEST_F(DBStoreTest, GetUserQueryByAccessKey) {
253249
ASSERT_EQ(uinfo.user_id.id, "user_id1");
254250
ASSERT_EQ(uinfo.suspended, 123);
255251
ASSERT_EQ(uinfo.max_buckets, 456);
256-
ASSERT_EQ(uinfo.assumed_role_arn, "role");
257252
ASSERT_EQ(uinfo.placement_tags.back(), "tags");
258253
RGWAccessKey k;
259254
map<string, RGWAccessKey>::iterator it2 = uinfo.access_keys.begin();
@@ -284,7 +279,6 @@ TEST_F(DBStoreTest, StoreUser) {
284279
uinfo.user_email = "[email protected]";
285280
uinfo.suspended = 123;
286281
uinfo.max_buckets = 456;
287-
uinfo.assumed_role_arn = "role";
288282
uinfo.placement_tags.push_back("tags");
289283
RGWAccessKey k1("id1", "key1");
290284
RGWAccessKey k2("id2", "key2");
@@ -336,7 +330,6 @@ TEST_F(DBStoreTest, GetUserQueryByUserID) {
336330
ASSERT_EQ(uinfo.user_id.id, "user_id2");
337331
ASSERT_EQ(uinfo.suspended, 123);
338332
ASSERT_EQ(uinfo.max_buckets, 456);
339-
ASSERT_EQ(uinfo.assumed_role_arn, "role");
340333
ASSERT_EQ(uinfo.placement_tags.back(), "tags");
341334
RGWAccessKey k;
342335
map<string, RGWAccessKey>::iterator it = uinfo.access_keys.begin();

‎src/rgw/rgw_common.h‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -560,7 +560,6 @@ struct RGWUserInfo
560560
RGWQuota quota;
561561
uint32_t type;
562562
std::set<std::string> mfa_ids;
563-
std::string assumed_role_arn;
564563

565564
RGWUserInfo()
566565
: suspended(0),
@@ -625,7 +624,10 @@ struct RGWUserInfo
625624
encode(admin, bl);
626625
encode(type, bl);
627626
encode(mfa_ids, bl);
628-
encode(assumed_role_arn, bl);
627+
{
628+
std::string assumed_role_arn; // removed
629+
encode(assumed_role_arn, bl);
630+
}
629631
encode(user_id.ns, bl);
630632
ENCODE_FINISH(bl);
631633
}
@@ -709,6 +711,7 @@ struct RGWUserInfo
709711
decode(mfa_ids, bl);
710712
}
711713
if (struct_v >= 21) {
714+
std::string assumed_role_arn; // removed
712715
decode(assumed_role_arn, bl);
713716
}
714717
if (struct_v >= 22) {

‎src/rgw/rgw_sts.cc‎

Lines changed: 0 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -319,23 +319,6 @@ std::tuple<int, rgw::sal::RGWRole*> STSService::getRoleInfo(const DoutPrefixProv
319319
}
320320
}
321321

322-
int STSService::storeARN(const DoutPrefixProvider *dpp, string& arn, optional_yield y)
323-
{
324-
int ret = 0;
325-
std::unique_ptr<rgw::sal::User> user = driver->get_user(user_id);
326-
if ((ret = user->load_user(dpp, y)) < 0) {
327-
return -ERR_NO_SUCH_ENTITY;
328-
}
329-
330-
user->get_info().assumed_role_arn = arn;
331-
332-
ret = user->store_user(dpp, y, false, &user->get_info());
333-
if (ret < 0) {
334-
return -ERR_INTERNAL_ERROR;
335-
}
336-
return ret;
337-
}
338-
339322
AssumeRoleWithWebIdentityResponse STSService::assumeRoleWithWebIdentity(const DoutPrefixProvider *dpp, AssumeRoleWithWebIdentityRequest& req)
340323
{
341324
AssumeRoleWithWebIdentityResponse response;
@@ -447,13 +430,6 @@ AssumeRoleResponse STSService::assumeRole(const DoutPrefixProvider *dpp,
447430
return response;
448431
}
449432

450-
//Save ARN with the user
451-
string arn = response.user.getARN();
452-
response.retCode = storeARN(dpp, arn, y);
453-
if (response.retCode < 0) {
454-
return response;
455-
}
456-
457433
response.retCode = 0;
458434
return response;
459435
}

‎src/rgw/rgw_sts.h‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -238,7 +238,6 @@ class STSService {
238238
rgw_user user_id;
239239
std::unique_ptr<rgw::sal::RGWRole> role;
240240
rgw::auth::Identity* identity;
241-
int storeARN(const DoutPrefixProvider *dpp, std::string& arn, optional_yield y);
242241
public:
243242
STSService() = default;
244243
STSService(CephContext* cct, rgw::sal::Driver* driver, rgw_user user_id,

0 commit comments

Comments
 (0)