{"action":"created","comment":{"url":"https://api.github.com/repos/ceph/ceph/pulls/comments/63093624","id":63093624,"diff_hunk":"@@ -239,3 +240,197 @@ RGWAuthApplier::aplptr_t RGWAnonymousAuthEngine::authenticate() const\n   return apl_factory->create_apl_local(cct, user_info,\n                                        RGWLocalAuthApplier::NO_SUBUSER);\n }\n+\n+\n+/* Keystone */\n+class RGWKeystoneHTTPTransceiver : public RGWHTTPTransceiver {\n+public:\n+  RGWKeystoneHTTPTransceiver(CephContext * const cct,\n+                             bufferlist * const token_body_bl)\n+    : RGWHTTPTransceiver(cct, token_body_bl,\n+                         cct->_conf->rgw_keystone_verify_ssl,\n+                         { \"X-Subject-Token\" }) {\n+  }\n+\n+  std::string get_subject_token() const {\n+    try {\n+      return get_header_value(\"X-Subject-Token\");\n+    } catch (std::out_of_range&) {\n+      return header_value_t();\n+    }\n+  }\n+};\n+\n+typedef RGWKeystoneHTTPTransceiver RGWValidateKeystoneToken;\n+typedef RGWKeystoneHTTPTransceiver RGWGetKeystoneAdminToken;\n+typedef RGWKeystoneHTTPTransceiver RGWGetRevokedTokens;\n+\n+\n+bool RGWKeystoneAuthEngine::is_applicable() const noexcept\n+{\n+  if (false == RGWTokenBasedAuthEngine::is_applicable()) {\n+    return false;\n+  }\n+\n+  return false == cct->_conf->rgw_keystone_url.empty();\n+}\n+\n+KeystoneToken RGWKeystoneAuthEngine::decode_pki_token(const std::string token) const\n+{\n+  bufferlist token_body_bl;\n+  int ret = rgw_decode_b64_cms(cct, token, token_body_bl);\n+  if (ret < 0) {\n+    ldout(cct, 20) << \"cannot decode pki token\" << dendl;\n+    throw ret;\n+  } else {\n+    ldout(cct, 20) << \"successfully decoded pki token\" << dendl;\n+  }\n+\n+  KeystoneToken token_body;\n+  ret = token_body.parse(cct, token, token_body_bl);\n+  if (ret < 0) {\n+    throw ret;\n+  }\n+\n+  return token_body;\n+}\n+\n+KeystoneToken RGWKeystoneAuthEngine::get_from_keystone(const std::string token) const\n+{\n+  bufferlist token_body_bl;\n+  RGWValidateKeystoneToken validate(cct, &token_body_bl);\n+\n+  std::string url;\n+  if (KeystoneService::get_keystone_url(cct, url) < 0) {\n+    throw -EINVAL;\n+  }\n+\n+  const auto keystone_version = KeystoneService::get_api_version();\n+  if (keystone_version == KeystoneApiVersion::VER_2) {\n+    url.append(\"v2.0/tokens/\" + token);\n+  } else if (keystone_version == KeystoneApiVersion::VER_3) {\n+    url.append(\"v3/auth/tokens\");\n+    validate.append_header(\"X-Subject-Token\", token);\n+  }\n+\n+  std::string admin_token;\n+  if (KeystoneService::get_keystone_admin_token(cct, admin_token) < 0) {\n+    throw -EINVAL;\n+  }\n+\n+  validate.append_header(\"X-Auth-Token\", admin_token);\n+  validate.set_send_length(0);\n+\n+  int ret = validate.process(url.c_str());\n+  if (ret < 0) {\n+    throw ret;\n+  }\n+  token_body_bl.append((char)0); // NULL terminate for debug output\n+\n+  ldout(cct, 20) << \"received response: \" << token_body_bl.c_str() << dendl;\n+\n+  KeystoneToken token_body;\n+  ret = token_body.parse(cct, token, token_body_bl);\n+  if (ret < 0) {\n+    throw ret;\n+  }\n+\n+  return token_body;\n+}\n+\n+RGWRemoteAuthApplier::AuthInfo\n+RGWKeystoneAuthEngine::get_creds_info(const KeystoneToken& token,\n+                                      const std::vector<std::string>& admin_roles\n+                                    ) const noexcept\n+{\n+  /* Check whether the user has an admin status. */\n+  bool is_admin = false;\n+  for (const auto admin_role : admin_roles) {\n+    if (token.has_role(admin_role)) {\n+      is_admin = true;\n+      break;\n+    }\n+  }\n+\n+  return {\n+    /* Suggested account name for the authenticated user. */\n+    rgw_user(token.get_project_id()),\n+    /* User's display name (aka real name). */\n+    token.get_project_name(),\n+    /* Keystone doesn't support RGW's subuser concept, so we cannot cut down\n+     * the access rights through the perm_mask. At least at this layer. */\n+    RGW_PERM_FULL_CONTROL,\n+    is_admin,\n+  };\n+}\n+\n+RGWAuthApplier::aplptr_t RGWKeystoneAuthEngine::authenticate() const\n+{\n+  KeystoneToken t;\n+\n+  /* This will be initialized on the first call to this method. In C++11 it's\n+   * also thread-safe. */\n+  static struct RolesCacher {\n+    RolesCacher(CephContext * const cct) {\n+      get_str_vec(cct->_conf->rgw_keystone_accepted_roles, plain);\n+      get_str_vec(cct->_conf->rgw_keystone_accepted_admin_roles, admin);\n+\n+      /* Let's suppose that having an admin role implies also a regular one. */\n+      plain.insert(std::end(plain), std::begin(admin), std::end(admin));\n+    }\n+\n+    std::vector<std::string> plain;\n+    std::vector<std::string> admin;\n+  } roles(cct);\n+\n+  /* Token ID is a concept that makes dealing with PKI tokens more effective.\n+   * Instead of storing several kilobytes, a short hash can be burried. */\n+  const auto token_id = rgw_get_token_id(token);","path":"src/rgw/rgw_auth.cc","position":468,"original_position":159,"commit_id":"45494d40a7b9c648e817b0e00189e07363a3d6c9","original_commit_id":"0dd622cea7040a57f0066695d47d48020b01ad74","user":{"login":"rzarzynski","id":1891217,"avatar_url":"https://avatars.githubusercontent.com/u/1891217?v=3","gravatar_id":"","url":"https://api.github.com/users/rzarzynski","html_url":"https://github.com/rzarzynski","followers_url":"https://api.github.com/users/rzarzynski/followers","following_url":"https://api.github.com/users/rzarzynski/following{/other_user}","gists_url":"https://api.github.com/users/rzarzynski/gists{/gist_id}","starred_url":"https://api.github.com/users/rzarzynski/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rzarzynski/subscriptions","organizations_url":"https://api.github.com/users/rzarzynski/orgs","repos_url":"https://api.github.com/users/rzarzynski/repos","events_url":"https://api.github.com/users/rzarzynski/events{/privacy}","received_events_url":"https://api.github.com/users/rzarzynski/received_events","type":"User","site_admin":false},"body":"TODO.","created_at":"2016-05-12T20:44:08Z","updated_at":"2016-05-12T20:44:08Z","html_url":"https://github.com/ceph/ceph/pull/8657#discussion_r63093624","pull_request_url":"https://api.github.com/repos/ceph/ceph/pulls/8657","_links":{"self":{"href":"https://api.github.com/repos/ceph/ceph/pulls/comments/63093624"},"html":{"href":"https://github.com/ceph/ceph/pull/8657#discussion_r63093624"},"pull_request":{"href":"https://api.github.com/repos/ceph/ceph/pulls/8657"}}},"pull_request":{"url":"https://api.github.com/repos/ceph/ceph/pulls/8657","id":67036994,"html_url":"https://github.com/ceph/ceph/pull/8657","diff_url":"https://github.com/ceph/ceph/pull/8657.diff","patch_url":"https://github.com/ceph/ceph/pull/8657.patch","issue_url":"https://api.github.com/repos/ceph/ceph/issues/8657","number":8657,"state":"open","locked":false,"title":"rgw: authentication subsystem rework","user":{"login":"rzarzynski","id":1891217,"avatar_url":"https://avatars.githubusercontent.com/u/1891217?v=3","gravatar_id":"","url":"https://api.github.com/users/rzarzynski","html_url":"https://github.com/rzarzynski","followers_url":"https://api.github.com/users/rzarzynski/followers","following_url":"https://api.github.com/users/rzarzynski/following{/other_user}","gists_url":"https://api.github.com/users/rzarzynski/gists{/gist_id}","starred_url":"https://api.github.com/users/rzarzynski/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rzarzynski/subscriptions","organizations_url":"https://api.github.com/users/rzarzynski/orgs","repos_url":"https://api.github.com/users/rzarzynski/repos","events_url":"https://api.github.com/users/rzarzynski/events{/privacy}","received_events_url":"https://api.github.com/users/rzarzynski/received_events","type":"User","site_admin":false},"body":"This pull request consists rework of the authentication infrastructure and its related components: HTTP client, Keystone token cache and the revocation mechanism.\r\n\r\nFeatures the rework brings:\r\n* Separation between authentication identities and user's resources a given `RGWOp` operates on (`RGWUserInfo` and friends; account in the Swift's terminology).\r\n* New framework for authentication backends that provides an uniform interface and decouples performing authentication from applying changes to underlying structures (RADOS store, `req_state` and similar).\r\n* Cross-tenants requests over Swift API altogether with the full Swift's URL schema support.\r\n* Account ACLs of Swift API.\r\n* HTTP Referrer-based ACLs of Swift API.\r\n* Cross-tenant ACLs of Swift API for the Keystone authentication backend.\r\n* Admin access (aka *reseller admin* in Swift).\r\n* Increased awareness of Pete's `rgw_keystone_implicit_tenants` across different auth engines.\r\n\r\nEnables:\r\n* Account quota of the Swift API.\r\n\r\nDerogates following PRs: #7296, #7326, #7683, #8448.\r\n\r\nCC: @yehudasa, @mattbenjamin.","created_at":"2016-04-19T15:16:04Z","updated_at":"2016-05-12T20:44:08Z","closed_at":null,"merged_at":null,"merge_commit_sha":"3f3823ffd2377832dfd06d3d8b4990013635e003","assignee":{"login":"mattbenjamin","id":301287,"avatar_url":"https://avatars.githubusercontent.com/u/301287?v=3","gravatar_id":"","url":"https://api.github.com/users/mattbenjamin","html_url":"https://github.com/mattbenjamin","followers_url":"https://api.github.com/users/mattbenjamin/followers","following_url":"https://api.github.com/users/mattbenjamin/following{/other_user}","gists_url":"https://api.github.com/users/mattbenjamin/gists{/gist_id}","starred_url":"https://api.github.com/users/mattbenjamin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mattbenjamin/subscriptions","organizations_url":"https://api.github.com/users/mattbenjamin/orgs","repos_url":"https://api.github.com/users/mattbenjamin/repos","events_url":"https://api.github.com/users/mattbenjamin/events{/privacy}","received_events_url":"https://api.github.com/users/mattbenjamin/received_events","type":"User","site_admin":false},"milestone":null,"commits_url":"https://api.github.com/repos/ceph/ceph/pulls/8657/commits","review_comments_url":"https://api.github.com/repos/ceph/ceph/pulls/8657/comments","review_comment_url":"https://api.github.com/repos/ceph/ceph/pulls/comments{/number}","comments_url":"https://api.github.com/repos/ceph/ceph/issues/8657/comments","statuses_url":"https://api.github.com/repos/ceph/ceph/statuses/45494d40a7b9c648e817b0e00189e07363a3d6c9","head":{"label":"rzarzynski:wip-rgw-swift-auth","ref":"wip-rgw-swift-auth","sha":"45494d40a7b9c648e817b0e00189e07363a3d6c9","user":{"login":"rzarzynski","id":1891217,"avatar_url":"https://avatars.githubusercontent.com/u/1891217?v=3","gravatar_id":"","url":"https://api.github.com/users/rzarzynski","html_url":"https://github.com/rzarzynski","followers_url":"https://api.github.com/users/rzarzynski/followers","following_url":"https://api.github.com/users/rzarzynski/following{/other_user}","gists_url":"https://api.github.com/users/rzarzynski/gists{/gist_id}","starred_url":"https://api.github.com/users/rzarzynski/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rzarzynski/subscriptions","organizations_url":"https://api.github.com/users/rzarzynski/orgs","repos_url":"https://api.github.com/users/rzarzynski/repos","events_url":"https://api.github.com/users/rzarzynski/events{/privacy}","received_events_url":"https://api.github.com/users/rzarzynski/received_events","type":"User","site_admin":false},"repo":{"id":29937571,"name":"ceph","full_name":"rzarzynski/ceph","owner":{"login":"rzarzynski","id":1891217,"avatar_url":"https://avatars.githubusercontent.com/u/1891217?v=3","gravatar_id":"","url":"https://api.github.com/users/rzarzynski","html_url":"https://github.com/rzarzynski","followers_url":"https://api.github.com/users/rzarzynski/followers","following_url":"https://api.github.com/users/rzarzynski/following{/other_user}","gists_url":"https://api.github.com/users/rzarzynski/gists{/gist_id}","starred_url":"https://api.github.com/users/rzarzynski/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rzarzynski/subscriptions","organizations_url":"https://api.github.com/users/rzarzynski/orgs","repos_url":"https://api.github.com/users/rzarzynski/repos","events_url":"https://api.github.com/users/rzarzynski/events{/privacy}","received_events_url":"https://api.github.com/users/rzarzynski/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/rzarzynski/ceph","description":"Ceph is a distributed object, block, and file storage platform ","fork":true,"url":"https://api.github.com/repos/rzarzynski/ceph","forks_url":"https://api.github.com/repos/rzarzynski/ceph/forks","keys_url":"https://api.github.com/repos/rzarzynski/ceph/keys{/key_id}","collaborators_url":"https://api.github.com/repos/rzarzynski/ceph/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/rzarzynski/ceph/teams","hooks_url":"https://api.github.com/repos/rzarzynski/ceph/hooks","issue_events_url":"https://api.github.com/repos/rzarzynski/ceph/issues/events{/number}","events_url":"https://api.github.com/repos/rzarzynski/ceph/events","assignees_url":"https://api.github.com/repos/rzarzynski/ceph/assignees{/user}","branches_url":"https://api.github.com/repos/rzarzynski/ceph/branches{/branch}","tags_url":"https://api.github.com/repos/rzarzynski/ceph/tags","blobs_url":"https://api.github.com/repos/rzarzynski/ceph/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/rzarzynski/ceph/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/rzarzynski/ceph/git/refs{/sha}","trees_url":"https://api.github.com/repos/rzarzynski/ceph/git/trees{/sha}","statuses_url":"https://api.github.com/repos/rzarzynski/ceph/statuses/{sha}","languages_url":"https://api.github.com/repos/rzarzynski/ceph/languages","stargazers_url":"https://api.github.com/repos/rzarzynski/ceph/stargazers","contributors_url":"https://api.github.com/repos/rzarzynski/ceph/contributors","subscribers_url":"https://api.github.com/repos/rzarzynski/ceph/subscribers","subscription_url":"https://api.github.com/repos/rzarzynski/ceph/subscription","commits_url":"https://api.github.com/repos/rzarzynski/ceph/commits{/sha}","git_commits_url":"https://api.github.com/repos/rzarzynski/ceph/git/commits{/sha}","comments_url":"https://api.github.com/repos/rzarzynski/ceph/comments{/number}","issue_comment_url":"https://api.github.com/repos/rzarzynski/ceph/issues/comments{/number}","contents_url":"https://api.github.com/repos/rzarzynski/ceph/contents/{+path}","compare_url":"https://api.github.com/repos/rzarzynski/ceph/compare/{base}...{head}","merges_url":"https://api.github.com/repos/rzarzynski/ceph/merges","archive_url":"https://api.github.com/repos/rzarzynski/ceph/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/rzarzynski/ceph/downloads","issues_url":"https://api.github.com/repos/rzarzynski/ceph/issues{/number}","pulls_url":"https://api.github.com/repos/rzarzynski/ceph/pulls{/number}","milestones_url":"https://api.github.com/repos/rzarzynski/ceph/milestones{/number}","notifications_url":"https://api.github.com/repos/rzarzynski/ceph/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/rzarzynski/ceph/labels{/name}","releases_url":"https://api.github.com/repos/rzarzynski/ceph/releases{/id}","deployments_url":"https://api.github.com/repos/rzarzynski/ceph/deployments","created_at":"2015-01-27T22:12:49Z","updated_at":"2016-02-09T13:55:19Z","pushed_at":"2016-05-11T15:49:29Z","git_url":"git://github.com/rzarzynski/ceph.git","ssh_url":"git@github.com:rzarzynski/ceph.git","clone_url":"https://github.com/rzarzynski/ceph.git","svn_url":"https://github.com/rzarzynski/ceph","homepage":"http://ceph.com","size":152259,"stargazers_count":0,"watchers_count":0,"language":"C++","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":0,"mirror_url":null,"open_issues_count":0,"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"ceph:master","ref":"master","sha":"3a570d711017acca0cf3a191a52729c0b37bbb05","user":{"login":"ceph","id":1015767,"avatar_url":"https://avatars.githubusercontent.com/u/1015767?v=3","gravatar_id":"","url":"https://api.github.com/users/ceph","html_url":"https://github.com/ceph","followers_url":"https://api.github.com/users/ceph/followers","following_url":"https://api.github.com/users/ceph/following{/other_user}","gists_url":"https://api.github.com/users/ceph/gists{/gist_id}","starred_url":"https://api.github.com/users/ceph/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ceph/subscriptions","organizations_url":"https://api.github.com/users/ceph/orgs","repos_url":"https://api.github.com/users/ceph/repos","events_url":"https://api.github.com/users/ceph/events{/privacy}","received_events_url":"https://api.github.com/users/ceph/received_events","type":"Organization","site_admin":false},"repo":{"id":2310495,"name":"ceph","full_name":"ceph/ceph","owner":{"login":"ceph","id":1015767,"avatar_url":"https://avatars.githubusercontent.com/u/1015767?v=3","gravatar_id":"","url":"https://api.github.com/users/ceph","html_url":"https://github.com/ceph","followers_url":"https://api.github.com/users/ceph/followers","following_url":"https://api.github.com/users/ceph/following{/other_user}","gists_url":"https://api.github.com/users/ceph/gists{/gist_id}","starred_url":"https://api.github.com/users/ceph/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ceph/subscriptions","organizations_url":"https://api.github.com/users/ceph/orgs","repos_url":"https://api.github.com/users/ceph/repos","events_url":"https://api.github.com/users/ceph/events{/privacy}","received_events_url":"https://api.github.com/users/ceph/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/ceph/ceph","description":"Ceph is a distributed object, block, and file storage platform ","fork":false,"url":"https://api.github.com/repos/ceph/ceph","forks_url":"https://api.github.com/repos/ceph/ceph/forks","keys_url":"https://api.github.com/repos/ceph/ceph/keys{/key_id}","collaborators_url":"https://api.github.com/repos/ceph/ceph/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/ceph/ceph/teams","hooks_url":"https://api.github.com/repos/ceph/ceph/hooks","issue_events_url":"https://api.github.com/repos/ceph/ceph/issues/events{/number}","events_url":"https://api.github.com/repos/ceph/ceph/events","assignees_url":"https://api.github.com/repos/ceph/ceph/assignees{/user}","branches_url":"https://api.github.com/repos/ceph/ceph/branches{/branch}","tags_url":"https://api.github.com/repos/ceph/ceph/tags","blobs_url":"https://api.github.com/repos/ceph/ceph/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/ceph/ceph/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/ceph/ceph/git/refs{/sha}","trees_url":"https://api.github.com/repos/ceph/ceph/git/trees{/sha}","statuses_url":"https://api.github.com/repos/ceph/ceph/statuses/{sha}","languages_url":"https://api.github.com/repos/ceph/ceph/languages","stargazers_url":"https://api.github.com/repos/ceph/ceph/stargazers","contributors_url":"https://api.github.com/repos/ceph/ceph/contributors","subscribers_url":"https://api.github.com/repos/ceph/ceph/subscribers","subscription_url":"https://api.github.com/repos/ceph/ceph/subscription","commits_url":"https://api.github.com/repos/ceph/ceph/commits{/sha}","git_commits_url":"https://api.github.com/repos/ceph/ceph/git/commits{/sha}","comments_url":"https://api.github.com/repos/ceph/ceph/comments{/number}","issue_comment_url":"https://api.github.com/repos/ceph/ceph/issues/comments{/number}","contents_url":"https://api.github.com/repos/ceph/ceph/contents/{+path}","compare_url":"https://api.github.com/repos/ceph/ceph/compare/{base}...{head}","merges_url":"https://api.github.com/repos/ceph/ceph/merges","archive_url":"https://api.github.com/repos/ceph/ceph/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/ceph/ceph/downloads","issues_url":"https://api.github.com/repos/ceph/ceph/issues{/number}","pulls_url":"https://api.github.com/repos/ceph/ceph/pulls{/number}","milestones_url":"https://api.github.com/repos/ceph/ceph/milestones{/number}","notifications_url":"https://api.github.com/repos/ceph/ceph/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/ceph/ceph/labels{/name}","releases_url":"https://api.github.com/repos/ceph/ceph/releases{/id}","deployments_url":"https://api.github.com/repos/ceph/ceph/deployments","created_at":"2011-09-01T21:41:26Z","updated_at":"2016-05-12T18:24:29Z","pushed_at":"2016-05-12T19:45:42Z","git_url":"git://github.com/ceph/ceph.git","ssh_url":"git@github.com:ceph/ceph.git","clone_url":"https://github.com/ceph/ceph.git","svn_url":"https://github.com/ceph/ceph","homepage":"http://ceph.com","size":211389,"stargazers_count":2138,"watchers_count":2138,"language":"C++","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":1265,"mirror_url":null,"open_issues_count":340,"forks":1265,"open_issues":340,"watchers":2138,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/ceph/ceph/pulls/8657"},"html":{"href":"https://github.com/ceph/ceph/pull/8657"},"issue":{"href":"https://api.github.com/repos/ceph/ceph/issues/8657"},"comments":{"href":"https://api.github.com/repos/ceph/ceph/issues/8657/comments"},"review_comments":{"href":"https://api.github.com/repos/ceph/ceph/pulls/8657/comments"},"review_comment":{"href":"https://api.github.com/repos/ceph/ceph/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/ceph/ceph/pulls/8657/commits"},"statuses":{"href":"https://api.github.com/repos/ceph/ceph/statuses/45494d40a7b9c648e817b0e00189e07363a3d6c9"}}}}