Skip to content

HDDS-6175. Use s3Auth during proxy during decrypt in RpcClient. #2981

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
swagle merged 3 commits into from
Jan 13, 2022
Merged

HDDS-6175. Use s3Auth during proxy during decrypt in RpcClient. #2981

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
d9fd12b
HDDS-6175. Use s3Auth during proxy during decrypt in RpcClient.
bharatviswa504 Jan 11, 2022
86d9f32
fix code
bharatviswa504 Jan 11, 2022
9217d3d
fix code to remove login check as now with latest S3G we do based on …
bharatviswa504 Jan 11, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 10 additions & 6 deletions hadoop-ozone/client/src/main/java/org/apache/hadoop/ozone/client/rpc/RpcClient.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -870,13 +870,17 @@ private KeyProvider.KeyVersion getDEK(FileEncryptionInfo feInfo)
OzoneKMSUtil.checkCryptoProtocolVersion(feInfo);
KeyProvider.KeyVersion decrypted = null;
try {
// Do proxy thing only when current UGI not matching with login UGI
// In this way, proxying is done only for s3g where
// s3g can act as proxy to end user.

// After HDDS-5881 the user will not be different,
// as S3G uses single RpcClient. So we should be checking thread-local
// S3Auth and use it during proxy.
UserGroupInformation loginUser = UserGroupInformation.getLoginUser();
if (!ugi.getShortUserName().equals(loginUser.getShortUserName())) {
UserGroupInformation proxyUser = UserGroupInformation.createProxyUser(
ugi.getShortUserName(), loginUser);
UserGroupInformation proxyUser;
if (getThreadLocalS3Auth() != null) {
UserGroupInformation s3gUGI = UserGroupInformation.createRemoteUser(
getThreadLocalS3Auth().getAccessID());
proxyUser = UserGroupInformation.createProxyUser(
s3gUGI.getShortUserName(), loginUser);
decrypted = proxyUser.doAs(
(PrivilegedExceptionAction<KeyProvider.KeyVersion>) () -> {
return OzoneKMSUtil.decryptEncryptedDataEncryptionKey(feInfo,
Expand Down