fmorg-git commented on code in PR #11796:
URL: https://github.com/apache/ozone/pull/11796#discussion_r4450434171
##########
hadoop-ozone/ozone-manager/src/main/java/org/apache/hadoop/ozone/om/request/s3/tenant/OMTenantRevokeUserAccessIdRequest.java:
##########
@@ -205,6 +213,16 @@ public OMClientResponse
validateAndUpdateCache(OzoneManager ozoneManager, Execut
new CacheKey<>(accessId),
CacheValue.get(transactionLogIndex));
+ // Old log entries have no cutoff; replay must not invent a new
timestamp.
+ Long stsRevocationCutoff = null;
+ if (getOmRequest().hasRevokeSTSTokenRequest()) {
+ Table<String, Long> table =
omMetadataManager.getS3RevokedStsTokenTable();
+ Long existing = table.getIfExist(accessId);
+ long requested =
getOmRequest().getRevokeSTSTokenRequest().getRevocationTimeMillis();
+ stsRevocationCutoff = existing == null ? requested :
Math.max(existing, requested);
+ table.addCacheEntry(new CacheKey<>(accessId),
CacheValue.get(transactionLogIndex, stsRevocationCutoff));
Review Comment:
it might be good to move the `omMetadataManager.getS3RevokedStsTokenTable()`
and `table.addCacheEntry()` below the
`multiTenantManager.getCacheOp().revokeUserAccessId(accessId, tenantId);` call.
Otherwise, the code might end up caching a cutoff that never got revoked if
the `revokeUserAccessId` invocation failed. The revocation table is
`FULL_CACHE`, so that erroneous cutoff would be there until server restart.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
