Repository navigation
Conversation
Keystone roles are injected into the IAM policy evaluation environment as "keystone:role" condition keys. This enables bucket policies to grant or deny access based on Keystone roles. It bridges the gap between Openstack RBAC and S3 IAM policy. Document keystone:role in bucket policy and Keystone S3 integration Signed-off-by: Supriti Singh <supriti.singh@clyso.com> Signed-off-by: Marcel Lauhoff <marcel.lauhoff@clyso.com> On-behalf-of: SAP <supriti.singh@clyso.com> On-behalf-of: SAP <marcel.lauhoff@sap.com> (cherry picked from commit 1e6e393)
Expose the Keystone token user UUID as condition key "keystone:userid" so IAM and bucket policies can restrict access by user (e.g. per-user buckets or user-specific allow/deny). On-behalf-of: SAP <supriti.singh@clyso.com> Signed-off-by: Supriti Singh <supriti.singh@clyso.com> (cherry picked from commit b06b7a8)
Signed-off-by: Supriti Singh <supriti.singh@clyso.com>
The existing rgw_keystone_accepted_reader_roles is system-scoped: it grants read access across all Keystone projects and only takes effect when the role is also listed in rgw_keystone_accepted_admin_roles. This commit adds rgw_keystone_accepted_project_reader_roles for a project-scoped reader, mirroring Swift's project_reader_roles. When the listed role is the only granting role on a token, the identity is capped to read-only within its Keystone project: perm_mask is set to RGW_PERM_READ | RGW_PERM_READ_ACP, read object data and inspect bucket configuration (ACLs, policy, versioning, location,..). Writes are denied. This cap is a floor, not a hard ceiling: a bucket or IAM policy naming the user (keystone:userid / keystone:role) can still grant specific writes. CreateBucket and Swift account-metadata writes, which bypass the per-bucket ACL check, are refused up front for a capped Keystone identity. Like an admin role, a project-reader role admits the user on its own; it need not also appear in rgw_keystone_accepted_roles. The most permissive accepted role wins, so a user that also holds a plain accepted role (e.g. member) or admin receives full control. Every Keystone user in a project maps to the same RGW owner: the project account (acct_user = project id), so a reader reads and lists every bucket the project owns through the normal owner-scoped paths, and cannot reach another project (a different owner). This scoping is by ownership and holds regardless of rgw_keystone_implicit_tenants, which only controls the bucket-name namespace (per-project vs. global); implicit_tenants=true is recommended. Because the reader is itself the project owner, owner-scoped grant paths (bucket mdsearch, SNS topics) go through a new verify_owner_permission() helper so ownership alone does not lift the cap. STS AssumeRole is a separate case: it would swap in a role identity that carries no perm_mask, so it is refused outright for a capped identity. Also rename is_reader to is_system_reader and add is_project_reader to tell the two role types apart. Add unit tests. Fixes: https://tracker.ceph.com/issues/81098 On-behalf-of: SAP <supriti.singh@clyso.com> Signed-off-by: Supriti Singh <supriti.singh@clyso.com> (cherry picked from commit 87252a5)
Building on the project-scoped reader, add rgw_keystone_implicit_deny_roles: a Keystone role that authenticates a user but grants no implicit permissions. When such a role is the only granting role on a token, effective_perm_mask() returns RGW_PERM_NONE, so the user is authenticated but denied every operation by default (implicit deny). Access must then come from an explicit bucket or IAM policy naming the user (keystone:userid / keystone:role), and applies only to the buckets and objects the policy names. Like the reader, an implicit-deny role admits the user on its own (it need not also be in rgw_keystone_accepted_roles), and the most permissive accepted role still wins: admin, a project-reader, or another accepted role such as member takes precedence over the implicit-deny cap. Add the is_implicit_deny role flag and the config list, extend effective_perm_mask, and add unit tests. Fixes: https://tracker.ceph.com/issues/81098 On-behalf-of: SAP <supriti.singh@clyso.com> Signed-off-by: Supriti Singh <supriti.singh@clyso.com> (cherry picked from commit ba0c6ad)
Simplify how roles map to permissions by introducing an optional permission value (perm_tier) in the TokenEnvelope. Compute it once while updating the roles, instead of keeping several per-role flags and resolving them later in Role::perm_mask() / effective_perm_mask(). update_roles() now derives the token's permission mask directly: nullopt no accepted role -> token rejected RGW_PERM_NONE implicit-deny READ|READ_ACP project-reader FULL_CONTROL plain accepted or admin The most permissive role wins. admitted() replaces the duplicate role checks in both auth engines and the admin check uses the is_admin flag; only admin and system-reader stay as per-role flags. Fixes: https://tracker.ceph.com/issues/81098 On-behalf-of: SAP <supriti.singh@clyso.com> Signed-off-by: Supriti Singh <supriti.singh@clyso.com> (cherry picked from commit dcc1de7)
Signed-off-by: Supriti Singh <supriti.singh@clyso.com>
Author
|
oops did some mistake when cherry picking close this. Will reopen a new one |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes cobaltcore-dev/cloud-storage#
Backport file
release-management/backports/<uuid>.mdadded (or updated) by this PRidin frontmatter matches the filename stemprovenance.upstream_prsset (orprovenance.type: otherwith another:block)Stage-B risk (filled per
release-management/backports/RISK-RUBRIC.md)blast— cosmetic / availability / data-lossconflict— clean / trivial / substantivecoverage— strong / partial / weakhighband)Merge
Land this via
just merge-backport PR=<N>— do not click the green merge button.The just recipe constructs the merge commit's
Backport-Idtrailer.