{"action":"created","comment":{"url":"https://api.github.com/repos/ceph/ceph/pulls/comments/63059040","id":63059040,"diff_hunk":"@@ -239,3 +240,197 @@ RGWAuthApplier::aplptr_t RGWAnonymousAuthEngine::authenticate() const\n   return apl_factory->create_apl_local(cct, user_info,\n                                        RGWLocalAuthApplier::NO_SUBUSER);\n }\n+\n+\n+/* Keystone */\n+class RGWKeystoneHTTPTransceiver : public RGWHTTPTransceiver {\n+public:\n+  RGWKeystoneHTTPTransceiver(CephContext * const cct,\n+                             bufferlist * const token_body_bl)\n+    : RGWHTTPTransceiver(cct, token_body_bl,\n+                         cct->_conf->rgw_keystone_verify_ssl,\n+                         { \"X-Subject-Token\" }) {\n+  }\n+\n+  std::string get_subject_token() const {\n+    try {\n+      return get_header_value(\"X-Subject-Token\");\n+    } catch (std::out_of_range&) {\n+      return header_value_t();\n+    }\n+  }\n+};\n+\n+typedef RGWKeystoneHTTPTransceiver RGWValidateKeystoneToken;\n+typedef RGWKeystoneHTTPTransceiver RGWGetKeystoneAdminToken;\n+typedef RGWKeystoneHTTPTransceiver RGWGetRevokedTokens;\n+\n+\n+bool RGWKeystoneAuthEngine::is_applicable() const noexcept\n+{\n+  if (false == RGWTokenBasedAuthEngine::is_applicable()) {","path":"src/rgw/rgw_auth.cc","position":306,"original_position":42,"commit_id":"45494d40a7b9c648e817b0e00189e07363a3d6c9","original_commit_id":"0dd622cea7040a57f0066695d47d48020b01ad74","user":{"login":"mattbenjamin","id":301287,"avatar_url":"https://avatars.githubusercontent.com/u/301287?v=3","gravatar_id":"","url":"https://api.github.com/users/mattbenjamin","html_url":"https://github.com/mattbenjamin","followers_url":"https://api.github.com/users/mattbenjamin/followers","following_url":"https://api.github.com/users/mattbenjamin/following{/other_user}","gists_url":"https://api.github.com/users/mattbenjamin/gists{/gist_id}","starred_url":"https://api.github.com/users/mattbenjamin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mattbenjamin/subscriptions","organizations_url":"https://api.github.com/users/mattbenjamin/orgs","repos_url":"https://api.github.com/users/mattbenjamin/repos","events_url":"https://api.github.com/users/mattbenjamin/events{/privacy}","received_events_url":"https://api.github.com/users/mattbenjamin/received_events","type":"User","site_admin":false},"body":"Is this the same as \"if (! RGWTokenBasedAuthEngine::is_applicable())\"?  Having \"false\" on the left-hand side makes the code harder to read.","created_at":"2016-05-12T17:11:30Z","updated_at":"2016-05-12T17:11:30Z","html_url":"https://github.com/ceph/ceph/pull/8657#discussion_r63059040","pull_request_url":"https://api.github.com/repos/ceph/ceph/pulls/8657","_links":{"self":{"href":"https://api.github.com/repos/ceph/ceph/pulls/comments/63059040"},"html":{"href":"https://github.com/ceph/ceph/pull/8657#discussion_r63059040"},"pull_request":{"href":"https://api.github.com/repos/ceph/ceph/pulls/8657"}}},"pull_request":{"url":"https://api.github.com/repos/ceph/ceph/pulls/8657","id":67036994,"html_url":"https://github.com/ceph/ceph/pull/8657","diff_url":"https://github.com/ceph/ceph/pull/8657.diff","patch_url":"https://github.com/ceph/ceph/pull/8657.patch","issue_url":"https://api.github.com/repos/ceph/ceph/issues/8657","number":8657,"state":"open","locked":false,"title":"rgw: authentication subsystem rework","user":{"login":"rzarzynski","id":1891217,"avatar_url":"https://avatars.githubusercontent.com/u/1891217?v=3","gravatar_id":"","url":"https://api.github.com/users/rzarzynski","html_url":"https://github.com/rzarzynski","followers_url":"https://api.github.com/users/rzarzynski/followers","following_url":"https://api.github.com/users/rzarzynski/following{/other_user}","gists_url":"https://api.github.com/users/rzarzynski/gists{/gist_id}","starred_url":"https://api.github.com/users/rzarzynski/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rzarzynski/subscriptions","organizations_url":"https://api.github.com/users/rzarzynski/orgs","repos_url":"https://api.github.com/users/rzarzynski/repos","events_url":"https://api.github.com/users/rzarzynski/events{/privacy}","received_events_url":"https://api.github.com/users/rzarzynski/received_events","type":"User","site_admin":false},"body":"This pull request consists rework of the authentication infrastructure and its related components: HTTP client, Keystone token cache and the revocation mechanism.\r\n\r\nFeatures the rework brings:\r\n* Separation between authentication identities and user's resources a given `RGWOp` operates on (`RGWUserInfo` and friends; account in the Swift's terminology).\r\n* New framework for authentication backends that provides an uniform interface and decouples performing authentication from applying changes to underlying structures (RADOS store, `req_state` and similar).\r\n* Cross-tenants requests over Swift API altogether with the full Swift's URL schema support.\r\n* Account ACLs of Swift API.\r\n* HTTP Referrer-based ACLs of Swift API.\r\n* Cross-tenant ACLs of Swift API for the Keystone authentication backend.\r\n* Admin access (aka *reseller admin* in Swift).\r\n* Increased awareness of Pete's `rgw_keystone_implicit_tenants` across different auth engines.\r\n\r\nEnables:\r\n* Account quota of the Swift API.\r\n\r\nDerogates following PRs: #7296, #7326, #7683, #8448.\r\n\r\nCC: @yehudasa, @mattbenjamin.","created_at":"2016-04-19T15:16:04Z","updated_at":"2016-05-12T17:11:30Z","closed_at":null,"merged_at":null,"merge_commit_sha":"d0a8f1352b33a1afb2a4d85a791b22a102f1203f","assignee":{"login":"mattbenjamin","id":301287,"avatar_url":"https://avatars.githubusercontent.com/u/301287?v=3","gravatar_id":"","url":"https://api.github.com/users/mattbenjamin","html_url":"https://github.com/mattbenjamin","followers_url":"https://api.github.com/users/mattbenjamin/followers","following_url":"https://api.github.com/users/mattbenjamin/following{/other_user}","gists_url":"https://api.github.com/users/mattbenjamin/gists{/gist_id}","starred_url":"https://api.github.com/users/mattbenjamin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mattbenjamin/subscriptions","organizations_url":"https://api.github.com/users/mattbenjamin/orgs","repos_url":"https://api.github.com/users/mattbenjamin/repos","events_url":"https://api.github.com/users/mattbenjamin/events{/privacy}","received_events_url":"https://api.github.com/users/mattbenjamin/received_events","type":"User","site_admin":false},"milestone":null,"commits_url":"https://api.github.com/repos/ceph/ceph/pulls/8657/commits","review_comments_url":"https://api.github.com/repos/ceph/ceph/pulls/8657/comments","review_comment_url":"https://api.github.com/repos/ceph/ceph/pulls/comments{/number}","comments_url":"https://api.github.com/repos/ceph/ceph/issues/8657/comments","statuses_url":"https://api.github.com/repos/ceph/ceph/statuses/45494d40a7b9c648e817b0e00189e07363a3d6c9","head":{"label":"rzarzynski:wip-rgw-swift-auth","ref":"wip-rgw-swift-auth","sha":"45494d40a7b9c648e817b0e00189e07363a3d6c9","user":{"login":"rzarzynski","id":1891217,"avatar_url":"https://avatars.githubusercontent.com/u/1891217?v=3","gravatar_id":"","url":"https://api.github.com/users/rzarzynski","html_url":"https://github.com/rzarzynski","followers_url":"https://api.github.com/users/rzarzynski/followers","following_url":"https://api.github.com/users/rzarzynski/following{/other_user}","gists_url":"https://api.github.com/users/rzarzynski/gists{/gist_id}","starred_url":"https://api.github.com/users/rzarzynski/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rzarzynski/subscriptions","organizations_url":"https://api.github.com/users/rzarzynski/orgs","repos_url":"https://api.github.com/users/rzarzynski/repos","events_url":"https://api.github.com/users/rzarzynski/events{/privacy}","received_events_url":"https://api.github.com/users/rzarzynski/received_events","type":"User","site_admin":false},"repo":{"id":29937571,"name":"ceph","full_name":"rzarzynski/ceph","owner":{"login":"rzarzynski","id":1891217,"avatar_url":"https://avatars.githubusercontent.com/u/1891217?v=3","gravatar_id":"","url":"https://api.github.com/users/rzarzynski","html_url":"https://github.com/rzarzynski","followers_url":"https://api.github.com/users/rzarzynski/followers","following_url":"https://api.github.com/users/rzarzynski/following{/other_user}","gists_url":"https://api.github.com/users/rzarzynski/gists{/gist_id}","starred_url":"https://api.github.com/users/rzarzynski/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rzarzynski/subscriptions","organizations_url":"https://api.github.com/users/rzarzynski/orgs","repos_url":"https://api.github.com/users/rzarzynski/repos","events_url":"https://api.github.com/users/rzarzynski/events{/privacy}","received_events_url":"https://api.github.com/users/rzarzynski/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/rzarzynski/ceph","description":"Ceph is a distributed object, block, and file storage platform ","fork":true,"url":"https://api.github.com/repos/rzarzynski/ceph","forks_url":"https://api.github.com/repos/rzarzynski/ceph/forks","keys_url":"https://api.github.com/repos/rzarzynski/ceph/keys{/key_id}","collaborators_url":"https://api.github.com/repos/rzarzynski/ceph/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/rzarzynski/ceph/teams","hooks_url":"https://api.github.com/repos/rzarzynski/ceph/hooks","issue_events_url":"https://api.github.com/repos/rzarzynski/ceph/issues/events{/number}","events_url":"https://api.github.com/repos/rzarzynski/ceph/events","assignees_url":"https://api.github.com/repos/rzarzynski/ceph/assignees{/user}","branches_url":"https://api.github.com/repos/rzarzynski/ceph/branches{/branch}","tags_url":"https://api.github.com/repos/rzarzynski/ceph/tags","blobs_url":"https://api.github.com/repos/rzarzynski/ceph/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/rzarzynski/ceph/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/rzarzynski/ceph/git/refs{/sha}","trees_url":"https://api.github.com/repos/rzarzynski/ceph/git/trees{/sha}","statuses_url":"https://api.github.com/repos/rzarzynski/ceph/statuses/{sha}","languages_url":"https://api.github.com/repos/rzarzynski/ceph/languages","stargazers_url":"https://api.github.com/repos/rzarzynski/ceph/stargazers","contributors_url":"https://api.github.com/repos/rzarzynski/ceph/contributors","subscribers_url":"https://api.github.com/repos/rzarzynski/ceph/subscribers","subscription_url":"https://api.github.com/repos/rzarzynski/ceph/subscription","commits_url":"https://api.github.com/repos/rzarzynski/ceph/commits{/sha}","git_commits_url":"https://api.github.com/repos/rzarzynski/ceph/git/commits{/sha}","comments_url":"https://api.github.com/repos/rzarzynski/ceph/comments{/number}","issue_comment_url":"https://api.github.com/repos/rzarzynski/ceph/issues/comments{/number}","contents_url":"https://api.github.com/repos/rzarzynski/ceph/contents/{+path}","compare_url":"https://api.github.com/repos/rzarzynski/ceph/compare/{base}...{head}","merges_url":"https://api.github.com/repos/rzarzynski/ceph/merges","archive_url":"https://api.github.com/repos/rzarzynski/ceph/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/rzarzynski/ceph/downloads","issues_url":"https://api.github.com/repos/rzarzynski/ceph/issues{/number}","pulls_url":"https://api.github.com/repos/rzarzynski/ceph/pulls{/number}","milestones_url":"https://api.github.com/repos/rzarzynski/ceph/milestones{/number}","notifications_url":"https://api.github.com/repos/rzarzynski/ceph/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/rzarzynski/ceph/labels{/name}","releases_url":"https://api.github.com/repos/rzarzynski/ceph/releases{/id}","deployments_url":"https://api.github.com/repos/rzarzynski/ceph/deployments","created_at":"2015-01-27T22:12:49Z","updated_at":"2016-02-09T13:55:19Z","pushed_at":"2016-05-11T15:49:29Z","git_url":"git://github.com/rzarzynski/ceph.git","ssh_url":"git@github.com:rzarzynski/ceph.git","clone_url":"https://github.com/rzarzynski/ceph.git","svn_url":"https://github.com/rzarzynski/ceph","homepage":"http://ceph.com","size":152259,"stargazers_count":0,"watchers_count":0,"language":"C++","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"ceph:master","ref":"master","sha":"3a570d711017acca0cf3a191a52729c0b37bbb05","user":{"login":"ceph","id":1015767,"avatar_url":"https://avatars.githubusercontent.com/u/1015767?v=3","gravatar_id":"","url":"https://api.github.com/users/ceph","html_url":"https://github.com/ceph","followers_url":"https://api.github.com/users/ceph/followers","following_url":"https://api.github.com/users/ceph/following{/other_user}","gists_url":"https://api.github.com/users/ceph/gists{/gist_id}","starred_url":"https://api.github.com/users/ceph/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ceph/subscriptions","organizations_url":"https://api.github.com/users/ceph/orgs","repos_url":"https://api.github.com/users/ceph/repos","events_url":"https://api.github.com/users/ceph/events{/privacy}","received_events_url":"https://api.github.com/users/ceph/received_events","type":"Organization","site_admin":false},"repo":{"id":2310495,"name":"ceph","full_name":"ceph/ceph","owner":{"login":"ceph","id":1015767,"avatar_url":"https://avatars.githubusercontent.com/u/1015767?v=3","gravatar_id":"","url":"https://api.github.com/users/ceph","html_url":"https://github.com/ceph","followers_url":"https://api.github.com/users/ceph/followers","following_url":"https://api.github.com/users/ceph/following{/other_user}","gists_url":"https://api.github.com/users/ceph/gists{/gist_id}","starred_url":"https://api.github.com/users/ceph/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ceph/subscriptions","organizations_url":"https://api.github.com/users/ceph/orgs","repos_url":"https://api.github.com/users/ceph/repos","events_url":"https://api.github.com/users/ceph/events{/privacy}","received_events_url":"https://api.github.com/users/ceph/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/ceph/ceph","description":"Ceph is a distributed object, block, and file storage platform ","fork":false,"url":"https://api.github.com/repos/ceph/ceph","forks_url":"https://api.github.com/repos/ceph/ceph/forks","keys_url":"https://api.github.com/repos/ceph/ceph/keys{/key_id}","collaborators_url":"https://api.github.com/repos/ceph/ceph/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/ceph/ceph/teams","hooks_url":"https://api.github.com/repos/ceph/ceph/hooks","issue_events_url":"https://api.github.com/repos/ceph/ceph/issues/events{/number}","events_url":"https://api.github.com/repos/ceph/ceph/events","assignees_url":"https://api.github.com/repos/ceph/ceph/assignees{/user}","branches_url":"https://api.github.com/repos/ceph/ceph/branches{/branch}","tags_url":"https://api.github.com/repos/ceph/ceph/tags","blobs_url":"https://api.github.com/repos/ceph/ceph/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/ceph/ceph/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/ceph/ceph/git/refs{/sha}","trees_url":"https://api.github.com/repos/ceph/ceph/git/trees{/sha}","statuses_url":"https://api.github.com/repos/ceph/ceph/statuses/{sha}","languages_url":"https://api.github.com/repos/ceph/ceph/languages","stargazers_url":"https://api.github.com/repos/ceph/ceph/stargazers","contributors_url":"https://api.github.com/repos/ceph/ceph/contributors","subscribers_url":"https://api.github.com/repos/ceph/ceph/subscribers","subscription_url":"https://api.github.com/repos/ceph/ceph/subscription","commits_url":"https://api.github.com/repos/ceph/ceph/commits{/sha}","git_commits_url":"https://api.github.com/repos/ceph/ceph/git/commits{/sha}","comments_url":"https://api.github.com/repos/ceph/ceph/comments{/number}","issue_comment_url":"https://api.github.com/repos/ceph/ceph/issues/comments{/number}","contents_url":"https://api.github.com/repos/ceph/ceph/contents/{+path}","compare_url":"https://api.github.com/repos/ceph/ceph/compare/{base}...{head}","merges_url":"https://api.github.com/repos/ceph/ceph/merges","archive_url":"https://api.github.com/repos/ceph/ceph/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/ceph/ceph/downloads","issues_url":"https://api.github.com/repos/ceph/ceph/issues{/number}","pulls_url":"https://api.github.com/repos/ceph/ceph/pulls{/number}","milestones_url":"https://api.github.com/repos/ceph/ceph/milestones{/number}","notifications_url":"https://api.github.com/repos/ceph/ceph/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/ceph/ceph/labels{/name}","releases_url":"https://api.github.com/repos/ceph/ceph/releases{/id}","deployments_url":"https://api.github.com/repos/ceph/ceph/deployments","created_at":"2011-09-01T21:41:26Z","updated_at":"2016-05-12T17:11:27Z","pushed_at":"2016-05-12T17:10:16Z","git_url":"git://github.com/ceph/ceph.git","ssh_url":"git@github.com:ceph/ceph.git","clone_url":"https://github.com/ceph/ceph.git","svn_url":"https://github.com/ceph/ceph","homepage":"http://ceph.com","size":211418,"stargazers_count":2137,"watchers_count":2137,"language":"C++","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":1265,"mirror_url":null,"open_issues_count":339,"forks":1265,"open_issues":339,"watchers":2137,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/ceph/ceph/pulls/8657"},"html":{"href":"https://github.com/ceph/ceph/pull/8657"},"issue":{"href":"https://api.github.com/repos/ceph/ceph/issues/8657"},"comments":{"href":"https://api.github.com/repos/ceph/ceph/issues/8657/comments"},"review_comments":{"href":"https://api.github.com/repos/ceph/ceph/pulls/8657/comments"},"review_comment":{"href":"https://api.github.com/repos/ceph/ceph/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/ceph/ceph/pulls/8657/commits"},"statuses":{"href":"https://api.github.com/repos/ceph/ceph/statuses/45494d40a7b9c648e817b0e00189e07363a3d6c9"}}}}