Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

HDDS-11040. Disable REST endpoint for S3 secret manipulation by username #6839

Merged
merged 5 commits into from
Jul 10, 2024
Merged

HDDS-11040. Disable REST endpoint for S3 secret manipulation by username #6839

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
f4a509c
HDDS-11040. Temporary disable revoke/generate secret by name methods …
ivanzlenko Jun 21, 2024
e6c5c40
Fix checkstyle
ivanzlenko Jun 21, 2024
ca32458
Merge remote-tracking branch 'origin/master' into HDDS-11040
adoroszlai Jul 9, 2024
cb67773
disable test cases
adoroszlai Jul 9, 2024
a92430d
skip robot tests instead of commenting
adoroszlai Jul 10, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion hadoop-ozone/dist/src/main/smoketest/s3/secretgenerate.robot
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,13 +45,15 @@ S3 Gateway Secret Already Exists
Should contain ${result} HTTP/1.1 400 S3_SECRET_ALREADY_EXISTS ignore_case=True

S3 Gateway Generate Secret By Username
[Tags] robot:skip # TODO: Enable after HDDS-11041 is done.
Pass Execution If '${SECURITY_ENABLED}' == 'false' Skipping this check as security is not enabled
${result} = Execute curl -X PUT --negotiate -u : -v ${ENDPOINT_URL}/secret/testuser
Should contain ${result} HTTP/1.1 200 OK ignore_case=True
Should Match Regexp ${result} <awsAccessKey>.*</awsAccessKey><awsSecret>.*</awsSecret>

S3 Gateway Generate Secret By Username For Other User
[Tags] robot:skip # TODO: Enable after HDDS-11041 is done.
Pass Execution If '${SECURITY_ENABLED}' == 'false' Skipping this check as security is not enabled
${result} = Execute curl -X PUT --negotiate -u : -v ${ENDPOINT_URL}/secret/testuser2
Should contain ${result} HTTP/1.1 200 OK ignore_case=True
Should Match Regexp ${result} <awsAccessKey>.*</awsAccessKey><awsSecret>.*</awsSecret>
Should Match Regexp ${result} <awsAccessKey>.*</awsAccessKey><awsSecret>.*</awsSecret>
4 changes: 3 additions & 1 deletion hadoop-ozone/dist/src/main/smoketest/s3/secretrevoke.robot
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,13 +38,15 @@ S3 Gateway Revoke Secret
Should contain ${result} HTTP/1.1 200 OK ignore_case=True

S3 Gateway Revoke Secret By Username
[Tags] robot:skip # TODO: Enable after HDDS-11041 is done.
Pass Execution If '${SECURITY_ENABLED}' == 'false' Skipping this check as security is not enabled
Execute ozone s3 getsecret -u testuser ${OM_HA_PARAM}
${result} = Execute curl -X DELETE --negotiate -u : -v ${ENDPOINT_URL}/secret/testuser
Should contain ${result} HTTP/1.1 200 OK ignore_case=True

S3 Gateway Revoke Secret By Username For Other User
[Tags] robot:skip # TODO: Enable after HDDS-11041 is done.
Pass Execution If '${SECURITY_ENABLED}' == 'false' Skipping this check as security is not enabled
Execute ozone s3 getsecret -u testuser2 ${OM_HA_PARAM}
${result} = Execute curl -X DELETE --negotiate -u : -v ${ENDPOINT_URL}/secret/testuser2
Should contain ${result} HTTP/1.1 200 OK ignore_case=True
Should contain ${result} HTTP/1.1 200 OK ignore_case=True
7 changes: 5 additions & 2 deletions .../s3gateway/src/main/java/org/apache/hadoop/ozone/s3secret/S3SecretManagementEndpoint.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,7 @@
import java.io.IOException;

import static javax.ws.rs.core.Response.Status.BAD_REQUEST;
import static javax.ws.rs.core.Response.Status.METHOD_NOT_ALLOWED;
import static javax.ws.rs.core.Response.Status.NOT_FOUND;

/**
Expand All @@ -53,7 +54,8 @@ public Response generate() throws IOException {
@Path("/{username}")
public Response generate(@PathParam("username") String username)
throws IOException {
return generateInternal(username);
// TODO: It is a temporary solution. To be removed after HDDS-11041 is done.
return Response.status(METHOD_NOT_ALLOWED).build();
}

private Response generateInternal(@Nullable String username) throws IOException {
Expand Down Expand Up @@ -93,7 +95,8 @@ public Response revoke() throws IOException {
@Path("/{username}")
public Response revoke(@PathParam("username") String username)
throws IOException {
return revokeInternal(username);
// TODO: It is a temporary solution. To be removed after HDDS-11041 is done.
return Response.status(METHOD_NOT_ALLOWED).build();
}

private Response revokeInternal(@Nullable String username)
Expand Down
2 changes: 2 additions & 0 deletions ...op-ozone/s3gateway/src/test/java/org/apache/hadoop/ozone/s3secret/TestSecretGenerate.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,6 +33,7 @@
import org.apache.hadoop.ozone.client.protocol.ClientProtocol;
import org.apache.hadoop.ozone.om.exceptions.OMException;
import org.apache.hadoop.ozone.om.helpers.S3SecretValue;
import org.apache.ozone.test.tag.Unhealthy;
import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test;
import org.junit.jupiter.api.extension.ExtendWith;
Expand Down Expand Up @@ -111,6 +112,7 @@ void testIfSecretAlreadyExists() throws IOException {
}

@Test
@Unhealthy("HDDS-11041")
void testSecretGenerateWithUsername() throws IOException {
hasNoSecretYet();

Expand Down
2 changes: 2 additions & 0 deletions hadoop-ozone/s3gateway/src/test/java/org/apache/hadoop/ozone/s3secret/TestSecretRevoke.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,7 @@
import org.apache.hadoop.ozone.client.OzoneClient;
import org.apache.hadoop.ozone.client.OzoneClientStub;
import org.apache.hadoop.ozone.om.exceptions.OMException;
import org.apache.ozone.test.tag.Unhealthy;
import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test;
import org.junit.jupiter.api.extension.ExtendWith;
Expand Down Expand Up @@ -97,6 +98,7 @@ void testSecretRevoke() throws IOException {
}

@Test
@Unhealthy("HDDS-11041")
void testSecretRevokeWithUsername() throws IOException {
endpoint.revoke(OTHER_USER_NAME);
verify(objectStore, times(1))
Expand Down