fmorg-git commented on code in PR #10771:
URL: https://github.com/apache/ozone/pull/10771#discussion_r3591571921
##########
hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/OmMetadataReader.java:
##########
@@ -673,14 +673,21 @@ public boolean checkAcls(OzoneObj obj,
RequestContext.Builder contextBuilder,
* thread locals: the session policy from {@link STSTokenIdentifier} (set on
STS requests) and the
* S3 action from {@link S3Authentication} (set on S3 requests). Either or
both may be absent, in
* which case the corresponding field is left untouched on the builder.
+ * <p>
+ * The S3 action is only propagated when the S3 STS feature flag is enabled,
since it is only used
+ * for fine-grained STS authorization.
* @param contextBuilder the builder to enrich in-place
*/
- public static void maybeAddToContextFromThreadLocal(RequestContext.Builder
contextBuilder) {
+ private void maybeAddToContextFromThreadLocal(RequestContext.Builder
contextBuilder) {
final STSTokenIdentifier stsTokenIdentifier =
OzoneManager.getStsTokenIdentifier();
if (stsTokenIdentifier != null) {
contextBuilder.setSessionPolicy(stsTokenIdentifier.getSessionPolicy());
}
+ if (!ozoneManager.isS3STSEnabled()) {
+ return;
Review Comment:
right, so I can see how this is confusing. If STS is disabled, there would
be no STS server to call the AssumeRole API, so there would be no
STSTokenIdentifier nor sessionPolicy. In contrast, if STS is disabled, the
actions previously were still being set in the RequestContext for S3 calls.
However, just so it's clear, I updated to move the flag check to top of the
method.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
